CVE-2025-24623

CVE-2025-24623 is a CSRF vulnerability in the WordPress plugin Really Simple Security (formerly Really Simple SSL) affecting versions n/a through 9.1.4. The CVSSv3.1 base score is 4.3 (Medium) with network attack vector, required user interaction, and no confidentiality/availability impact, and p...

WordPress Comment Edit Core – Simple Comment Editing Plugin <= 3.0.33 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Marek Mikita in WordPress Plugin Comment Edit Core – Simple Comment Editing versions = 3.0.33...

WordPress Patreon WordPress plugin <= 1.9.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mika in WordPress Plugin Patreon WordPress versions = 1.9.1...

WordPress People Lists plugin <= 1.3.10 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mika in WordPress Plugin People Lists versions = 1.3.10...

WordPress Simple Download Monitor plugin <= 3.9.25 - SQL Injection vulnerability

SQL Injection vulnerability discovered by shinobu in WordPress Plugin Simple Download Monitor versions = 3.9.25...

WordPress WooCommerce Product Table Lite plugin <= 3.8.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mika in WordPress Plugin WooCommerce Product Table Lite versions = 3.8.7...

WordPress Radius Blocks – WordPress Gutenberg Blocks Plugin <= 2.1.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Tran Nguyen Bao Khanh in WordPress Plugin Radius Blocks versions = 2.1.2...

WordPress Ultimate Coming Soon & Maintenance plugin <= 1.0.9 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Marek Mikita in WordPress Plugin Ultimate Coming Soon & Maintenance versions = 1.0.9...

WordPress Atarim plugin <= 4.0.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Mika in WordPress Plugin Atarim versions = 4.0.8...

WordPress Thim Elementor Kit Plugin <= 1.2.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Prissy in WordPress Plugin Thim Elementor Kit versions = 1.2.8...

WordPress LearnDash LMS Plugin <= 4.20.0.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by David Ojeda Guijarro in WordPress Plugin LearnDash LMS versions = 4.20.0.1...

WordPress Popup Box Plugin <= 3.2.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Khang Duong in WordPress Plugin Popup Box versions = 3.2.4...

WordPress Chained Quiz Plugin <= 1.3.2.9 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Marek Mikita in WordPress Plugin Chained Quiz versions = 1.3.2.9...

WordPress Blur Text Plugin <= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerability

Stored Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Blur Text versions = 1.0.0...

WordPress Gutenberg Blocks and Page Layouts Plugin <= 1.9.6 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Abdi Pranata Patchstack Alliance in WordPress Plugin Attire Blocks versions = 1.9.6...

WordPress Wishlist for WooCommerce plugin <=2.1.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by b4orvn in WordPress Plugin Wishlist for WooCommerce versions = 2.1.2...

CVE-2024-13594

The Simple Downloads List plugin for WordPress is vulnerable to SQL Injection via the 'category' attribute of the 'neofixsdl' shortcode in all versions up to, and including, 1.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2024-13408

The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.10 via the 'theme' attribute of the pgcu shortcode. This makes it possible for authenticated attacker...

CVE-2024-13354

The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML tags in several widgets in all versions up to, and including, 1.6.4 due to insufficient input sanitization and output escaping. Thi...

CVE-2025-23889 WordPress FooGallery Captions Plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in tormorten FooGallery Captions foogallery-captions allows Reflected XSS.This issue affects FooGallery Captions: from n/a through = 1.0.2...