CVE-2024-25814

MyNET up to v26.05 was discovered to contain a reflected cross-site scripting XSS vulnerability via the msg parameter...

CVE-2025-14437

The Hummingbird Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.18.0 via the 'request' function. This makes it possible for unauthenticated attackers to extract sensitive data including Cloudflare API credentials...

CVE-2025-14455

CVE-2025-14455 affects Image Photo Gallery Final Tiles Grid for WordPress. Public details in Wordfence report show an authenticated-by-design authorization bypass (Contributor+ and above) for gallery management actions, enabling deletion/modification/cloning of any user galleries. A fix exists in...

CVE-2025-49362

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in AncoraThemes Gracioza gracioza allows PHP Local File Inclusion.This issue affects Gracioza: from n/a through = 1.0.15...

CVE-2025-49369

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in AncoraThemes Lettuce lettuce allows PHP Local File Inclusion.This issue affects Lettuce: from n/a through = 1.1.7...

CVE-2025-60174

Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Constant Contact Plugin gf-constant-contact allows Object Injection.This issue affects WP Gravity Forms Constant Contact Plugin: from n/a through = 1.1.2...

CVE-2025-59134

Incorrect Privilege Assignment vulnerability in Jthemes Sale! Immigration law, Visa services support, Migration Agent Consulting immiex allows Privilege Escalation.This issue affects Sale! Immigration law, Visa services support, Migration Agent Consulting: from n/a through = 1.5.8...

CVE-2025-66119

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Bob Hostel hostel allows Reflected XSS.This issue affects Hostel: from n/a through = 1.1.5.9...

CVE-2025-62998 WordPress WP AI CoPilot plugin <= 1.2.7 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in WP Messiah WP AI CoPilot ai-co-pilot-for-wp allows Retrieve Embedded Sensitive Data.This issue affects WP AI CoPilot: from n/a through = 1.2.7...

EUVD-2025-204263

The Hummingbird Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.18.0 via the 'request' function. This makes it possible for unauthenticated attackers to extract sensitive data including Cloudflare API credentials...

CVE-2025-58928

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in axiomthemes Heart heart allows PHP Local File Inclusion.This issue affects Heart: from n/a through = 1.8...

CVE-2025-53430

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in AncoraThemes Etta etta allows PHP Local File Inclusion.This issue affects Etta: from n/a through = 1.14.0...

CVE-2025-60088

CVE-2025-60088 concerns the WordPress plugin WebinarIgnition (≤ 4.06.04) and is described as a Missing Authorization / Broken Access Control vulnerability. Public records consistently identify the issue as a misconfiguration of access control in WebinarIgnition, potentially enabling unauthorized ...

CVE-2025-60053 WordPress MaxCube theme <= 1.3.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in AncoraThemes MaxCube maxcube allows PHP Local File Inclusion.This issue affects MaxCube: from n/a through = 1.3.1...

EUVD-2025-204136

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in axiomthemes Soleil soleil allows PHP Local File Inclusion.This issue affects Soleil: from n/a through = 1.17...

CVE-2025-60050

CVE-2025-60050 describes an improper control of filenames for include/require in the WordPress Panda theme (versions ≤ 1.21), causing a PHP Local File Inclusion vulnerability. The issue affects Panda and is described as a Local File Inclusion vulnerability in PHP, with no explicit remediation det...

CVE-2025-60042

The CVE-2025-60042 entry concerns the AncoraThemes/WordPress Chinchilla theme (versions up to 1.16). The vulnerability is described as an Improper Control of Filename for Include/Require Statement (PHP Local File Inclusion), enabling an attacker to include local files via PHP includes. Connected ...

CVE-2025-58933 WordPress Anubis theme <= 1.25 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in axiomthemes Anubis anubis allows PHP Local File Inclusion.This issue affects Anubis: from n/a through = 1.25...

CVE-2025-58932

CVE-2025-58932 corresponds to a Local File Inclusion vulnerability in WordPress Prisma theme versions &lt;= 1.10 (WordPress Prisma theme). The issue arises from Improper Control of Filename for Include/Require Statement in PHP, enabling PHP Local File Inclusion through Prisma’s PHP include/requir...

CVE-2025-58934 WordPress The Gig theme <= 1.18.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in axiomthemes The Gig thegig allows PHP Local File Inclusion.This issue affects The Gig: from n/a through = 1.18.0...