CVE-2025-54693 WordPress Form Block Plugin <= 1.5.5 - Arbitrary File Upload Vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in epiphyt Form Block form-block allows Upload a Web Shell to a Web Server.This issue affects Form Block: from n/a through = 1.5.5...

CVE-2025-54685 WordPress SureDash Plugin <= 1.1.0 - Sensitive Data Exposure Vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Brainstorm Force SureDash suredash allows Retrieve Embedded Sensitive Data.This issue affects SureDash: from n/a through = 1.1.0...

CVE-2025-54685

The CVE-2025-54685 describes a vulnerability in WordPress SureDash (Brainstorm Force) plugin versions up to 1.1.0 where insertion of sensitive information into sent data can lead to retrieval of embedded sensitive data. The issue affects SureDash dated to n/a through 1.1.0, with a CVSS v3.1 base ...

CVE-2025-54678 WordPress Easy Form Builder Plugin <= 3.8.15 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in hassantafreshi Easy Form Builder easy-form-builder allows Blind SQL Injection.This issue affects Easy Form Builder: from n/a through = 3.8.15...

CVE-2025-54674 WordPress Product Configurator for WooCommerce Plugin plugin <= 1.4.4 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in mklacroix Product Configurator for WooCommerce allows Cross Site Request Forgery. This issue affects Product Configurator for WooCommerce: from n/a through 1.4.4...

CVE-2025-54675 WordPress YITH WooCommerce Popup Plugin plugin <= 1.48.0 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in YITHEMES YITH WooCommerce Popup yith-woocommerce-popup allows Cross Site Request Forgery.This issue affects YITH WooCommerce Popup: from n/a through = 1.48.0...

CVE-2025-54675

CVE-2025-54675 is a CSRF vulnerability in the WordPress plugin YITH WooCommerce Popup affecting versions up to 1.48.0 . The issue enables cross-site requests from authenticated users (CSRF) as described in multiple connected sources. The CVSS details show an attack vector of NETWORK , no confiden...

CVE-2025-54671

The connected documents confirm CVE-2025-54671 affects the WordPress plugin oik (versions n/a–4.15.2) with a Cross‑Site Request Forgery (CSRF) flaw. No exploits, vectors, or vulnerable configurations are detailed beyond the CSRF condition and affected versions. Public sources indicate the issue i...

CVE-2025-25172

CVE-2025-25172 affects VidMov WordPress Theme (

CVE-2025-25172 WordPress VidMov <= 1.9.4 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in beeteam368 VidMov vidmov allows PHP Local File Inclusion.This issue affects VidMov: from n/a through = 1.9.4...

CVE-2025-28975 WordPress Alike - WordPress Custom Post Comparison <= 3.0.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in redqteam Alike - WordPress Custom Post Comparison alike allows Reflected XSS.This issue affects Alike - WordPress Custom Post Comparison: from n/a through = 3.0.1...

CVE-2025-28962 WordPress Advanced Google Universal Analytics plugin <= 1.0.3 - Broken Access Control to Sensitive Data Exposure vulnerability

Missing Authorization vulnerability in stefanoai Advanced Google Universal Analytics advanced-google-universal-analytics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Google Universal Analytics: from n/a through = 1.0.3...

CVE-2025-28979

CVE-2025-28979 concerns the WordPress plugin WP Pipes (version &lt;= 1.4.3). The flaw is an improper control of the filename for include/require statements, enabling Local File Inclusion (LFI). Multiple sources (NVD, Red Hat advisory, CVE lists, Patchstack) confirm WP Pipes

CVE-2025-47689

CVE-2025-47689 concerns the WordPress plugin Video Blogster Lite (affected: versions through 1.2) and describes a reflected XSS vulnerability arising from improper input neutralization during web page generation. The related connected documents consistently identify the issue as affecting Video B...

CVE-2025-49038

CVE-2025-49038 describes a reflected XSS in the WordPress plugin WP Dynamic Links (versions through 1.0.1) due to improper input neutralization during web page generation. The vulnerability affects WP Dynamic Links and could impact visitors/users via crafted input reflected in the page. Public so...

CVE-2025-49052

CVE-2025-49052 affects WordPress plugin Netease Music up to version 3.2.1, with a Missing/Broken Access Control vulnerability (no explicit exploit details in the provided docs). Root cause: improper authorization checks enabling access control bypass. Impact: potential unauthorized access or acti...

CVE-2025-49058 WordPress SoundSt SEO Search plugin <= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Sound Strategies SoundSt SEO Search soundst-seo-search allows Reflected XSS.This issue affects SoundSt SEO Search: from n/a through = 1.2.3...

CVE-2025-49058 WordPress SoundSt SEO Search plugin <= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Sound Strategies SoundSt SEO Search allows Reflected XSS. This issue affects SoundSt SEO Search: from n/a through 1.2.3...

CVE-2025-49059 WordPress CleverReach® WP Plugin <= 1.5.20 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in CleverReach® CleverReach® WP allows SQL Injection. This issue affects CleverReach® WP: from n/a through 1.5.20...

CVE-2025-49433 WordPress Supermalink <= 1.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThanhD Supermalink supermalink allows DOM-Based XSS.This issue affects Supermalink: from n/a through = 1.1...