CVE-2025-31534 WordPress Shopper plugin <= 3.2.5 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in shopperdotcom Shopper allows SQL Injection. This issue affects Shopper: from n/a through 3.2.5...

CVE-2025-31446 WordPress WP Cleaner plugin <= 1.1.5 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in jiangmiao WP Cleaner allows Reflected XSS. This issue affects WP Cleaner: from n/a through 1.1.5...

CVE-2025-30778 WordPress VForm plugin <= 3.1.9 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Vikas Ratudi VPSUForm v-form allows Reflected XSS.This issue affects VPSUForm: from n/a through = 3.1.9...

CVE-2025-31743

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpszaki Lightweight and Responsive Youtube Embed lightweight-and-responsive-youtube-embed allows Stored XSS.This issue affects Lightweight and Responsive Youtube Embed: from n/a through = 1.0.0...

CVE-2025-31828 WordPress Easy!Appointments plugin <= 1.4.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability

Cross-Site Request Forgery CSRF vulnerability in alextselegidis Easy!Appointments easyappointments allows Cross Site Request Forgery.This issue affects Easy!Appointments: from n/a through = 1.4.2...

CVE-2025-31788

CVE-2025-31788 affects the AIO Performance Profiler, Monitor, Optimize, Compress & Debug plugin family. The issue is an Insertion of Sensitive Information into Log File, enabling unauthenticated exposure of embedded data via log contents. Affected versions are reported as up to 1.2 (n/a to 1.2). ...

CVE-2025-31751 WordPress Breaking News WP Plugin <= 1.3 - CSRF to Settings Change vulnerability

Cross-Site Request Forgery CSRF vulnerability in doit Breaking News WP breaking-news-wp allows Cross Site Request Forgery.This issue affects Breaking News WP: from n/a through = 1.3...

PT-2025-14186 · Unknown · Follow Us Badges

Name of the Vulnerable Software and Affected Versions: Follow Us Badges versions n/a through 3.1.11 Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored XSS. This means that an attacker can inject malicious scripts into the...

CVE-2025-31434

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Adrian Tobey FormLift for Infusionsoft Web Forms formlift allows Stored XSS.This issue affects FormLift for Infusionsoft Web Forms: from n/a through = 7.5.19...

WordPress Subscribe to Download Lite plugin <= 1.2.9 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin Subscribe to Download Lite versions = 1.2.9...

CVE-2025-25686

semcms =5.0 is vulnerable to SQL Injection in SEMCMSFuction.php...

CVE-2025-22501

CVE-2025-22501: WordPress plugin Improve My City

WordPress WP Database Optimizer plugin <= 1.2.1.3 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Nabil Irawan in WordPress Plugin WP Database Optimizer versions = 1.2.1.3...

CVE-2025-26736

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in victortihai MorningTime Lite morningtime-lite allows Stored XSS.This issue affects MorningTime Lite: from n/a through = 1.3.2...

CVE-2025-30921

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This issue affects Newsletters: from n/a through = 4.9.9.7...

CVE-2025-30898

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Mahdi Yousefi MahdiY افزونه حمل و نقل ووکامرس پست پیشتاز و سفارشی، پیک موتوری persian-woocommerce-shipping allows Stored XSS.This issue affects افزونه حمل و نقل ووکامرس پست پیشتاز و سفارشی، پیک...

CVE-2025-30780

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in cubecolour Audio Album audio-album allows Stored XSS.This issue affects Audio Album: from n/a through = 1.5.0...

WordPress SNORDIAN's H5PxAPIkatchu plugin <= 0.4.14 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin SNORDIAN's H5PxAPIkatchu versions = 0.4.14...

CVE-2025-30806 WordPress Vimeotheque plugin <= 2.3.4.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Constantin Boiangiu Vimeotheque codeflavors-vimeo-video-post-lite allows SQL Injection.This issue affects Vimeotheque: from n/a through = 2.3.4.2...

CVE-2025-30791

CVE-2025-30791 is a SQL Injection vulnerability in the Cart tracking for WooCommerce plugin. The weakness affects Cart tracking for WooCommerce versions up to 1.0.16 (no asterisked newer versions indicated in the provided docs). The CVE entry notes Improper Neutralization of Special Elements used...