WordPress plugin Site Offline 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

WordPress UsersWP plugin <= 1.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by stealthcopter in WordPress Plugin UsersWP versions = 1.2.42...

WordPress Makeaholic Theme <= 1.8.5 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Makeaholic versions = 1.8.5...

WordPress Podlove Podcast Publisher Plugin <= 4.2.5 - Open Redirection Vulnerability

Open Redirection Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Podlove Podcast Publisher versions = 4.2.5...

WordPress Solace Extra Plugin <= 1.3.2 - Server Side Request Forgery (SSRF) Vulnerability

Server Side Request Forgery SSRF Vulnerability discovered by Que Thanh Tuan Blue Rock in WordPress Plugin Solace Extra versions = 1.3.2...

WordPress Xpro Theme Builder Plugin <= 1.2.9 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Denver Jackson in WordPress Plugin Xpro Theme Builder versions = 1.2.9...

CVE-2025-58211

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in alexvtn Chatbox Manager wa-chatbox-manager allows Stored XSS.This issue affects Chatbox Manager: from n/a through = 1.2.6...

CVE-2025-58205

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows DOM-Based XSS.This issue affects ElementInvader Addons for Elementor: from n/a through = 1.3.6...

CVE-2025-58195

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Stored XSS.This issue affects Xpro Elementor Addons: from n/a through = 1.4.17...

CVE-2025-58193

Missing Authorization vulnerability in Uncanny Owl Uncanny Automator uncanny-automator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uncanny Automator: from n/a through = 6.7.0.1...

CVE-2025-58213

CVE-2025-58213 affects the Booking System Trafft WordPress plugin. The issue is a Stored Cross-Site Scripting (XSS) caused by improper input neutralization during web page generation, affecting Trafft versions up to 1.0.14. The vulnerability is documented with a CVSS v3.1 base score of 6.5 (Mediu...

CVE-2025-58203 WordPress Solace Extra Plugin <= 1.3.2 - Server Side Request Forgery (SSRF) Vulnerability

Server-Side Request Forgery SSRF vulnerability in solacewp Solace Extra solace-extra allows Server Side Request Forgery.This issue affects Solace Extra: from n/a through = 1.3.2...

CVE-2025-58203 WordPress Solace Extra Plugin <= 1.3.2 - Server Side Request Forgery (SSRF) Vulnerability

Server-Side Request Forgery SSRF vulnerability in solacewp Solace Extra solace-extra allows Server Side Request Forgery.This issue affects Solace Extra: from n/a through = 1.3.2...

CVE-2025-58202

CVE-2025-58202 describes a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Simple Page Access Restriction , affecting versions up to and including 1.0.32 . The CVE notes a CSRF flaw that could allow unauthorized actions on behalf of authenticated users; the published CVSS ...

CVE-2025-58192 WordPress WP Bulk Delete Plugin <= 1.3.6 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Xylus Themes WP Bulk Delete wp-bulk-delete allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Bulk Delete: from n/a through = 1.3.6...

CVE-2025-9513 editso fuso mod.rs PenetrateRsaAndAesHandshake inadequate encryption

A flaw has been found in editso fuso up to 1.0.4-beta.7. This affects the function PenetrateRsaAndAesHandshake of the file src/net/penetrate/handshake/mod.rs. This manipulation of the argument privkey causes inadequate encryption strength. Remote exploitation of the attack is possible. A high...

CVE-2025-48081 WordPress Printeers Print & Ship plugin <= 1.17.0 - Directory Traversal vulnerability

Path Traversal: '.../...//' vulnerability in Printeers Printeers Print & Ship allows Path Traversal.This issue affects Printeers Print & Ship: from n/a through 1.17.0...

CVE-2025-49040 WordPress Backup Bolt plugin <= 1.5.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Backup Bolt Backup Bolt backup-bolt allows Cross Site Request Forgery.This issue affects Backup Bolt: from n/a through = 1.5.0...

CVE-2025-8490

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Import in all versions up to, and including, 7.97 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-lev...

PT-2025-34826 · Unknown · Backup Bolt

Name of the Vulnerable Software and Affected Versions: Backup Bolt versions through 1.4.1 Description: Backup Bolt is susceptible to a Cross-Site Request Forgery CSRF issue, which allows attackers to perform actions on behalf of authenticated users. Recommendations: Update Backup Bolt to a versio...