WordPress CarZine theme <= 1.4.6 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by justakazh Patchstack Alliance in WordPress Theme CarZine versions = 1.4.6...

WordPress EMI Calculator plugin <= 1.1 - Settings Change vulnerability

Settings Change vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin EMI Calculator versions = 1.1...

PT-2025-2149 · WordPress · The Rate Star Review Vote – Ajax Reviews

Name of the Vulnerable Software and Affected Versions: The Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings plugin for WordPress versions up to, and including, 1.6.3 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'videowhisper reviews' shortcode due to...

WordPress Weaver Themes Shortcode Compatibility Plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 Patchstack Alliance in WordPress Plugin Weaver Themes Shortcode Compatibility versions = 1.0.4...

WordPress Utilities for MTG plugin <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by SOPROBRO in WordPress Plugin Utilities for MTG versions = 1.4.1...

CVE-2025-23872

Cross-Site Request Forgery CSRF vulnerability in payform PayForm payform allows Stored XSS.This issue affects PayForm: from n/a through = 2.0...

CVE-2025-23802

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in SteveSoehl WP-Revive Adserver wp-revive-adserver allows Stored XSS.This issue affects WP-Revive Adserver: from n/a through = 2.2.1...

CVE-2025-23708

Cross-Site Request Forgery CSRF vulnerability in Dominic Fallows DF Draggable df-draggable allows Stored XSS.This issue affects DF Draggable: from n/a through = 1.13.2...

CVE-2025-23698

Cross-Site Request Forgery CSRF vulnerability in ivanra10 WP Custom Google Search wp-custom-google-search allows Stored XSS.This issue affects WP Custom Google Search: from n/a through = 1.0...

CVE-2025-23662

Cross-Site Request Forgery CSRF vulnerability in ryscript WP Panoramio wp-panoramio allows Stored XSS.This issue affects WP Panoramio: from n/a through = 1.5.0...

CVE-2025-23659

Cross-Site Request Forgery CSRF vulnerability in hernanjh MercadoLibre Integration mercadolibre-integration allows Stored XSS.This issue affects MercadoLibre Integration: from n/a through = 1.1...

CVE-2025-23627

Cross-Site Request Forgery CSRF vulnerability in frenchsquared Comment-Emailer comment-emailer allows Stored XSS.This issue affects Comment-Emailer: from n/a through = 1.0.5...

CVE-2025-23499

Cross-Site Request Forgery CSRF vulnerability in Pascal Casier Board Election board-election allows Stored XSS.This issue affects Board Election: from n/a through = 1.0.1...

CVE-2025-23911

CVE-2025-23911 refers to an SQL Injection vulnerability in Solidres – Hotel booking plugin for WordPress. The description (and the Red Hat entry) indicate the issue is caused by improper neutralization of input used in SQL commands, enabling injection. Affected versions are Solidres – Hotel booki...

CVE-2025-23880 WordPress amr personalise plugin <= 2.10 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in anmari amr personalise amr-personalise allows Cross Site Request Forgery.This issue affects amr personalise: from n/a through = 2.10...

CVE-2025-23833 WordPress Links/Problem Reporter plugin <= 2.6.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in RaminMT Links/Problem Reporter report-broken-links allows DOM-Based XSS.This issue affects Links/Problem Reporter: from n/a through = 2.6.0...

CVE-2025-23827

CVE-2025-23827 affects Strx Magic Floating Sidebar Maker (WordPress plugin). Description: Stored XSS due to improper neutralization of input during web page generation. Impact: stored Cross-Site Scripting via vulnerable input; affects Strx Magic Floating Sidebar Maker versions from n/a up to and ...

CVE-2025-23779 WordPress ResAds Plugin <= 2.0.5 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in web-mv ResAds resads allows SQL Injection.This issue affects ResAds: from n/a through = 2.0.5...

CVE-2025-23640

CVE-2025-23640 is a CSRF-enabled vulnerability in the WordPress plugin Rename Author Slug (affected versions: from n/a through 1.2.0) that allows Stored XSS. Public details confirm the plugin and vulnerability type; exact exploit method, affected environments beyond the plugin, and a patched vers...

CVE-2025-23547 WordPress LH Login Page plugin <= 2.14 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in shawfactor LH Login Page lh-login-page allows Reflected XSS.This issue affects LH Login Page: from n/a through = 2.14...