CVE-2025-48353

CVE-2025-48353 : A CSRF to Stored XSS vulnerability exists in the dactum Clickbank WordPress Plugin (Niche Storefront). Affected component: Clickbank WordPress Plugin (Niche Storefront) versions up to and including 1.3.5. Root cause: CSRF enables stored XSS in the plugin; exploitation details are...

WordPress plugin Clickbank WordPress Plugin (Niche Storefront) 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

PT-2025-35022

Name of the Vulnerable Software and Affected Versions: dactum Clickbank WordPress Plugin Niche Storefront versions through 1.3.5 Description: A Cross-Site Request Forgery CSRF vulnerability exists in dactum Clickbank WordPress Plugin Niche Storefront, which also allows Stored Cross-Site Scripting...

WordPress UiCore Elements Plugin <= 1.3.4 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Abu Hurayra in WordPress Plugin UiCore Elements versions = 1.3.4...

WordPress plugin National Weather Service Alerts 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2025-50019 WordPress Simple Sticky Footer plugin <= 1.3.5 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Sandor Kovacs Simple Sticky Footer simple-sticky-footer allows Stored XSS.This issue affects Simple Sticky Footer : from n/a through = 1.3.5...

WordPress plugin Simple Sticky Footer 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2025-49288

CVE-2025-49288 – A Missing Authorization vulnerability in the WordPress plugin Ultimate WP Mail (ultimate-wp-mail) allows Authentication Bypass in versions

WordPress plugin Ultimate WP Mail 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2025-24137 · Unknown · Phpslideshow

Name of the Vulnerable Software and Affected Versions: GPP Slideshow versions 1.3.5 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For GPP Slideshow versions...

WordPress plugin GPP Slideshow 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-52420

Cross-Site Request Forgery CSRF vulnerability in Themeisle Disable Admin Notices individually disable-admin-notices allows Cross Site Request Forgery.This issue affects Disable Admin Notices individually: from n/a through = 1.4.0...

CVE-2024-9223

The WPDash Notes plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'wpajaxpostitlistcomment' function in all versions up to, and including, 1.3.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, t...

CVE-2024-31305

Cross-Site Request Forgery CSRF vulnerability in rtCamp Transcoder.This issue affects Transcoder: from n/a through 1.3.5...

CVE-2023-22686

Cross-Site Request Forgery CSRF vulnerability in TriniTronic Nice PayPal Button Lite plugin = 1.3.5 versions...

CVE-2021-30071

A cross-site scripting XSS vulnerability in /admin/listkey.html of HestiaCP before v1.3.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

CVE-2025-48288 WordPress ElementInvader Addons for Elementor plugin <= 1.3.5 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows Stored XSS.This issue affects ElementInvader Addons for Elementor: from n/a through = 1.3.5...

CVE-2025-47602

CVE-2025-47602 : WordPress plugin Calculate Prices based on Distance For WooCommerce has a Missing Authorization (Broken Access Control) vulnerability in versions up to and including 1.3.5. The initial & connected sources confirm the issue stems from improper access control, enabling exploitation...

Postorius < 1.3.5 Unsubscribe Vulnerability

Postorius is prone to an unsubscribe vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:postoriusproject:postorius";...

WordPress plugin Spark GF Failed Submissions 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...