CVE-2025-30546 WordPress Cackle plugin <= 4.33 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in boroV Cackle cackle allows Cross Site Request Forgery.This issue affects Cackle: from n/a through = 4.33...

CVE-2025-30534

CVE-2025-30534 refers to a CSRF vulnerability in Image Captcha (captcha.image-captcha) affecting Image Captcha versions up to 1.2. The connected Wordfence vulnerability report lists this CVE under Image Captcha, noting a Cross-Site Request Forgery to change settings but does not provide explicit ...

CVE-2025-30532

CVE-2025-30532 describes a Stored XSS in Weather Layer (WordPress plugin). In Weather Layer: from n/a through 4.2.1, the issue stems from improper input neutralization during web page generation, enabling stored XSS. The provided metrics classify the exploit as Cross-site Scripting with Low/Moder...

WordPress Map Contact plugin <= 3.0.4 - CSRF to Stored XSS Vulnerability

CSRF to Stored XSS Vulnerability discovered by Abdi Pranata in WordPress Plugin Map Contact versions = 3.0.4...

WordPress My Default Post Content plugin <= - 0.7.3 Cross Site Scripting (XSS) Vulnerability

0.7.3 Cross Site Scripting XSS Vulnerability discovered by Nabil Irawan in WordPress Plugin My Default Post Content versions = 0.7.3...

WordPress WP SoundCloud Ultimate plugin <= 1.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nabil Irawan in WordPress Plugin SoundCloud Ultimate versions = 1.5...

WordPress Custom Product Stickers for Woocommerce plugin <= 1.9.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 Patchstack Alliance in WordPress Plugin Custom Product Stickers for Woocommerce versions = 1.9.0...

WordPress GP Back To Top plugin <= 3.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nguyen Thi Huyen Trang - Skalucy in WordPress Plugin GP Back To Top versions = 3.0...

WordPress Advanced Dewplayer - plugin <= 1.6 Broken Access Control Vulnerability

plugin = 1.6 Broken Access Control Vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Advanced Dewplayer versions = 1.6...

WordPress Flipdish Ordering System plugin <= 1.5.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability

Cross Site Request Forgery CSRF to Settings Change vulnerability discovered by Nabil Irawan in WordPress Plugin Flipdish Ordering System versions = 1.5.2...

WordPress Music Press Pro plugin <= 1.4.6 Broken Access Control Vulnerability

WordPress Music Press Pro plugin = 1.4.6 Broken Access Control Vulnerability discovered by 0xd4rk5id3 Patchstack Alliance in WordPress Plugin Music Press Pro versions = 1.4.6...

CVE-2025-1972

The Export and Import Users and Customers plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the adminlogpage function in all versions up to, and including, 2.6.2. This makes it possible for authenticated attackers, with Administrator-level...

WordPress Fancybox Plus plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by johska in WordPress Plugin Fancybox Plus versions = 1.0.1...

CVE-2024-13558

The NP Quote Request for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.179 due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read the content of quote requests...

WordPress Infugrator plugin <= 1.0.3 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara Kinorth in WordPress Plugin Infugrator versions = 1.0.3...

PT-2025-12016

Name of the Vulnerable Software and Affected Versions: Age Gate plugin for WordPress versions up to, and including, 3.5.3 Description: The Age Gate plugin for WordPress is vulnerable to Local PHP File Inclusion via the lang parameter. This allows unauthenticated attackers to include and execute...

CVE-2025-2512

The File Away plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check and missing file type validation in the upload function in all versions up to, and including, 3.9.9.0.1. This makes it possible for unauthenticated attackers to upload arbitrary files on t...

WordPress CozyStay theme <= 1.7.0 - Missing Authorization to Arbitrary Action Execution in ajax_handler vulnerability

Missing Authorization to Arbitrary Action Execution in ajaxhandler vulnerability discovered by Lucio Sá in WordPress Theme CozyStay versions = 1.7.0...

WordPress CozyStay theme <= 1.7.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Lucio Sá in WordPress Theme CozyStay versions = 1.7.0...

WordPress RWS Enquiry And Lead Follow-up plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Mika in WordPress Plugin RWS Enquiry And Lead Follow-up versions = 1.0...