CVE-2025-28897 WordPress Domain Theme plugin <= 1.3 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Steveorevo Domain Theme domain-theme allows Stored XSS.This issue affects Domain Theme: from n/a through = 1.3...

CVE-2025-28897

CVE-2025-28897 : CSRF to Stored XSS in the WordPress Domain Theme plugin, affecting versions up to 1.3. The issue is described as Domain Theme

zzskzy Warehouse Refinement Management System 安全漏洞

zzskzy Warehouse Refinement Management System is a Warehouse Refinement Management System from Zhengzhou Time and Space zzskzy Company in China. A security vulnerability exists in zzskzy Warehouse Refinement Management System version 1.3, which stems from an incorrect manipulation of the paramete...

WordPress plugin Simple Notification 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress Simple Notification plugin <= 1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting vulnerability discovered by Pham Van Tam in WordPress Plugin Simple Notification versions = 1.3...

CVE-2025-23670

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in montashov 4 author cheer up donate 4-author-cheer-up-donate allows Reflected XSS.This issue affects 4 author cheer up donate: from n/a through = 1.3...

CVE-2025-25113

CVE-2025-25113 concerns WordPress plugin “Implied Cookie Consent” (versions up to 1.3). Connected sources note a Reflected Cross‑Site Scripting (XSS) vulnerability arising from improper input neutralization in the plugin, enabling reflected XSS in affected pages. The initial entry identifies the ...

CVE-2025-23670 WordPress 4 author cheer up donate plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in montashov 4 author cheer up donate 4-author-cheer-up-donate allows Reflected XSS.This issue affects 4 author cheer up donate: from n/a through = 1.3...

CVE-2025-23484

CVE-2025-23484 affects the WordPress Predict When plugin (versions

WordPress plugin Predict When 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

WordPress plugin 4 author cheer up donate 跨站脚本漏洞

WordPress and the WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in...

CVE-2025-27357

Cross-Site Request Forgery CSRF vulnerability in Musa AVCI Önceki Yazı Link onceki-yazi-linki allows Cross Site Request Forgery.This issue affects Önceki Yazı Link: from n/a through = 1.3...

CVE-2025-27304

CVE-2025-27304 affects the WordPress plugin Contact Form 7 Star Rating with font Awesome. It is a Stored XSS vulnerability due to improper neutralization of input during web page generation, impacting versions 1.3 and earlier. The CVE entry notes this is an authenticated issue (Editor+) and, per ...

WordPress Theme File Duplicator Plugin <= 1.3 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by LVT-tholv2k in WordPress Plugin Theme File Duplicator versions = 1.3...

WordPress Theme File Duplicator Plugin <= 1.3 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by LVT-tholv2k in WordPress Plugin Theme File Duplicator versions = 1.3...

WordPress 3D Photo Gallery plugin <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Missing Authorization to Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin 3D Photo Gallery versions = 1.3...

PT-2025-6596 · WordPress · Team Builder – Meet The Team

Name of the Vulnerable Software and Affected Versions: Team Builder – Meet the Team plugin for WordPress versions prior to 1.3 Description: The issue allows authenticated attackers with Subscriber-level access and above to update the plugin's settings due to a missing capability check on the save...

WordPress Team Builder plugin <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update vulnerability

Missing Authorization to Authenticated Subscriber+ Settings Update vulnerability discovered by Peter Thaleikis in WordPress Plugin Team Builder versions = 1.3...

CVE-2025-24692

CVE-2025-24692 affects Bulk Menu Edit (WordPress plugin) up to version 1.3, with a Missing/Broken Authorization vulnerability that allows exploitation of configured access control to access or alter data. The CVSS 3.1 score is 7.1 (High) with network attack vector, low privileges required, no use...

WordPress plugin Aparat Responsive 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...