PT-2025-1933 · WordPress · Rsvp/Event Management Plugin For Wordpress

Name of the Vulnerable Software and Affected Versions: RSVP and Event Management plugin for WordPress versions up to, and including, 2.7.13 Description: The issue allows unauthorized access due to a missing capability check on several AJAX functions, such as bulk delete attendees and bulk delete...

PT-2025-4546 · Unknown · Smoothness Slider Shortcode

Name of the Vulnerable Software and Affected Versions: Smoothness Slider Shortcode versions n/a through v1.2.2 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. This means an attacker can trick a user into performing unintended...

PT-2025-4434 · Unknown · Social Media Share Buttons | Mashshare

Name of the Vulnerable Software and Affected Versions: Social Media Share Buttons | MashShare versions n/a through 4.0.47 Description: The issue is related to a Missing Authorization vulnerability in Social Media Share Buttons | MashShare. This vulnerability affects the authorization process,...

PT-2025-1795 · Payu · Payu Commercepro Plugin For Wordpress

Name of the Vulnerable Software and Affected Versions: PayU CommercePro Plugin for WordPress versions up to, and including, 3.8.3 Description: The issue is due to the /wp-json/payu/v1/generate-user-token and /wp-json/payu/v1/get-shipping-cost REST API endpoints not properly verifying a user's...

PT-2025-1710 · WordPress · Slider Pro Lite

Name of the Vulnerable Software and Affected Versions: Slider Pro Lite plugin for WordPress versions up to, and including, 1.4.1 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's sliderpro shortcode. This allows...

WordPress plugin Passster 信息泄露漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An information...

PT-2025-1769 · WordPress · Viewmedica

Name of the Vulnerable Software and Affected Versions: ViewMedica 9 plugin for WordPress versions up to, and including, 1.4.15 Description: The issue is due to missing or incorrect nonce validation on the 'Viewmedica-Admin' page, making it possible for unauthenticated attackers to inject arbitrar...

PT-2025-1811 · WordPress · Compare Products For Woocommerce

Name of the Vulnerable Software and Affected Versions: Compare Products for WooCommerce plugin for WordPress versions up to, and including, 3.2.1 Description: The issue concerns a PHP Object Injection vulnerability in the Compare Products for WooCommerce plugin for WordPress. This vulnerability...

WordPress WordLift plugin <= 3.54.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update vulnerability

Missing Authorization to Authenticated Subscriber+ Settings Update vulnerability discovered by Tieu Pham Trong Nhan in WordPress Plugin WordLift versions = 3.54.2...

WordPress ARS Affiliate Page Plugin plugin <= 2.0.2 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Le Ngoc Anh in WordPress Plugin ARS Affiliate Page Plugin versions = 2.0.2...

WordPress SMSA Shipping plugin <= 2.3 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin SMSA Shipping versions = 2.3...

WordPress Sellsy plugin <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by SOPROBRO in WordPress Plugin Sellsy versions = 2.3.3...

WordPress CF7 WOW Styler plugin <= 1.7.1 - Unauthenticated Arbitrary Shortcode Execution and Reflected Cross-Site Scripting vulnerability

Unauthenticated Arbitrary Shortcode Execution and Reflected Cross-Site Scripting vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin CF7 WOW Styler versions = 1.7.1...

WordPress Hash Elements plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Khalid Patchstack Alliance in WordPress Plugin Hash Elements versions = 1.5.0...

WordPress WP Wand plugin <= 1.2.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin WP Wand versions = 1.2.5...

WordPress Food Store plugin <= 1.5.4 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Dimas Maulana in WordPress Plugin Food Store – Online Food Delivery & Pickup versions = 1.5.4...

WordPress WPBITS Addons For Elementor Page Builder plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Michael Patchstack Alliance in WordPress Plugin WPBITS Addons For Elementor Page Builder versions = 1.5.1...

PT-2025-1785 · Weavertheme · Turnkey Bbpress

Name of the Vulnerable Software and Affected Versions: Turnkey bbPress by WeaverTheme plugin for WordPress versions up to, and including, 1.6.3 Description: The issue is related to Reflected Cross-Site Scripting via the wpnonce parameter due to insufficient input sanitization and output escaping...

WordPress Autocompleter plugin <= 1.3.5.2 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Autocompleter versions = 1.3.5.2...

WordPress EO4WP plugin <= 1.0.8.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin EO4WP versions = 1.0.8.1...