CVE-2025-31808 WordPress SCSS WP Editor Plugin <= 1.1.8 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in IT Path Solutions SCSS WP Editor allows Cross Site Request Forgery. This issue affects SCSS WP Editor: from n/a through 1.1.8...

CVE-2025-31803 WordPress Turisbook Booking System plugin <= 1.3.7 - Stored Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Neteuro Turisbook Booking System allows Stored XSS. This issue affects Turisbook Booking System: from n/a through 1.3.7...

CVE-2025-31788

CVE-2025-31788 affects the AIO Performance Profiler, Monitor, Optimize, Compress & Debug plugin family. The issue is an Insertion of Sensitive Information into Log File, enabling unauthenticated exposure of embedded data via log contents. Affected versions are reported as up to 1.2 (n/a to 1.2). ...

CVE-2025-31751 WordPress Breaking News WP Plugin <= 1.3 - CSRF to Settings Change vulnerability

Cross-Site Request Forgery CSRF vulnerability in doit Breaking News WP breaking-news-wp allows Cross Site Request Forgery.This issue affects Breaking News WP: from n/a through = 1.3...

CVE-2025-31742

CVE-2025-31742 is documented in connected sources as an Apache HTTP Server mod_proxy SSRF vulnerability (not specifically tied to Dima Take Action). Reported impact is internal service exposure via SSRF; remediation guidance in the connected doc includes upgrading to patched Apache and deploying ...

WordPress Themify Sidepane WordPress Theme <=1.9.8 - Arbitrary File Upload Vulnerability

Arbitrary File Upload Vulnerability discovered by Tran Nguyen Bao KhanhVCI - VNPT in WordPress Theme Themify Sidepane WordPress Theme versions = 1.9.8...

CVE-2025-30878

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in JoomSky JS Help Desk allows Path Traversal. This issue affects JS Help Desk: from n/a through 2.9.2...

CVE-2025-30827

WP2LEADS (WordPress plugin)

CVE-2025-30794 WordPress Event Tickets plugin <= 5.20.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in StellarWP Event Tickets event-tickets allows Reflected XSS.This issue affects Event Tickets: from n/a through = 5.20.0...

PT-2025-14186 · Unknown · Follow Us Badges

Name of the Vulnerable Software and Affected Versions: Follow Us Badges versions n/a through 3.1.11 Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored XSS. This means that an attacker can inject malicious scripts into the...

PT-2025-14430 · Wiredminds · Leadlab

Name of the Vulnerable Software and Affected Versions: LeadLab by wiredminds versions n/a through 1.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This means an attacker can inject...

WordPress plugin XV Random Quotes SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...

WordPress Varnish WordPress plugin <= 1.7 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by SOPROBRO in WordPress Plugin Varnish WordPress versions = 1.7...

WordPress CookieHint WP plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by SOPROBRO in WordPress Plugin CookieHint WP versions = 1.0.0...

WordPress Welcome Popup plugin <= 1.0.10 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Pham Van Tam in WordPress Plugin Welcome Popup versions = 1.0.10...

WordPress Timeline Event History plugin <= 3.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Peter Thaleikis in WordPress Plugin Timeline Event History versions = 3.2...

WordPress OpenMenu plugin <= 3.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by muhammad yudha in WordPress Plugin OpenMenu versions = 3.5...

WordPress Elfsight Testimonials Slider plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Pham Van Tam in WordPress Plugin Elfsight Testimonials Slider versions = 1.0.1...

WordPress Appointify plugin <= 1.0.8 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Tri Doan in WordPress Plugin Appointify versions = 1.0.8...

WordPress IMPress for IDX Broker plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Peter Thaleikis in WordPress Plugin IMPress for IDX Broker versions = 3.2.3...