CVE-2025-32921 WordPress Arrival theme <= 1.4.5 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in wpoperations Arrival arrival allows PHP Local File Inclusion.This issue affects Arrival: from n/a through = 1.4.5...

CVE-2025-46242

CVE-2025-46242 — WordPress Watu Quiz plugin &lt;= 3.4.3 SQL Injection Root cause: Improper neutralization of special elements used in SQL commands in Watu Quiz (WordPress plugin). The vulnerability enables SQL Injection in versions up to 3.4.3. Impact: Potential unauthorized access or data manipu...

CVE-2025-27295 WordPress Live css plugin <= 1.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpion Live css css-live allows Stored XSS.This issue affects Live css: from n/a through = 1.3...

CVE-2025-27354 WordPress Simple Email Subscriber plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in phil88530 Simple Email Subscriber simple-email-subscriber allows Reflected XSS.This issue affects Simple Email Subscriber: from n/a through = 2.3...

CVE-2025-32506 WordPress AT Internet SmartTag plugin <= 0.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BenDlz AT Internet SmartTag at-internet allows Reflected XSS.This issue affects AT Internet SmartTag: from n/a through = 0.2...

CVE-2025-39519 WordPress Bulk Page Stub Creator plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in rtpHarry Bulk Page Stub Creator allows Reflected XSS. This issue affects Bulk Page Stub Creator: from n/a through 1.1...

CVE-2025-39431 WordPress Amazon Showcase WordPress Plugin plugin <= 2.2 - CSRF to XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Aaron Forgue Amazon Showcase WordPress Plugin amazon-showcase-wordpress-widget allows Stored XSS.This issue affects Amazon Showcase WordPress Plugin: from n/a through = 2.2...

WordPress plugin ProfileGrid SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection...

CVE-2025-39513

CVE-2025-39513 – ActiveDEMAND WordPress plugin : The connected docs identify a Missing Authorization / Broken Access Control vulnerability in the ActiveDEMAND WordPress plugin, affecting versions from n/a up to and including 0.2.46. The root cause is failure to constrain access to certain functio...

CVE-2025-31011 WordPress SimplyRETS Real Estate IDX plugin <= 3.2.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ReichertBrothers SimplyRETS Real Estate IDX simply-rets allows Reflected XSS.This issue affects SimplyRETS Real Estate IDX: from n/a through = 3.2.2...

CVE-2025-26741 WordPress Email Notifications for Updates <= 1.1.6 - Privilege Escalation Vulnerability

Missing Authorization vulnerability in AWEOS GmbH Email Notifications for Updates wp-update-mail-notification allows Privilege Escalation.This issue affects Email Notifications for Updates: from n/a through = 1.1.6...

CVE-2025-32479

Cross-Site Request Forgery CSRF vulnerability in ab-tools Flags Widget flags-widget allows Stored XSS.This issue affects Flags Widget: from n/a through = 1.0.7...

CVE-2025-32567 WordPress Easy Post Duplicator Plugin <= 1.0.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in dev02ali Easy Post Duplicator allows SQL Injection. This issue affects Easy Post Duplicator: from n/a through 1.0.1...

CVE-2025-32565 WordPress Neon Product Designer Plugin <= 2.2.0 - Unauthenticated SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in vertim Neon Product Designer neon-product-designer-for-woocommerce allows SQL Injection.This issue affects Neon Product Designer: from n/a through = 2.2.0...

CVE-2025-31565 WordPress WPSmartContracts plugin <= 2.0.12 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Lisandro Martinez WPSmartContracts wp-smart-contracts allows Blind SQL Injection.This issue affects WPSmartContracts: from n/a through = 2.0.12...

WordPress Industrial Lite theme <= 1.0.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mika Patchstack Alliance in WordPress Theme Industrial Lite versions = 1.0.8...

CVE-2025-32199

CVE-2025-32199 describes an XSS vulnerability in the WordPress plugin Contact Form Builder by vcita (eyale-vc Contact Form Builder) affecting versions from n/a up to 4.10.2. The described issue is due to improper input neutralization during web page generation, enabling cross-site scripting. Publ...

CVE-2025-31903

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Xavi Ivars XV Random Quotes xv-random-quotes allows Reflected XSS.This issue affects XV Random Quotes: from n/a through = 2.0.0...

CVE-2025-31855

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in softnwords SMM API smm-api allows Stored XSS.This issue affects SMM API: from n/a through = 6.0.31...

CVE-2025-3163 InternLM LMDeploy conf.py open code injection

A vulnerability was found in InternLM LMDeploy up to 0.7.1. It has been declared as critical. Affected by this vulnerability is the function Open of the file lmdeploy/docs/en/conf.py. The manipulation leads to code injection. It is possible to launch the attack on the local host. The exploit has...