CVE-2025-32531

CVE-2025-32531 is described in the provided documents as a Reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Arconix FAQ (affecting versions from n/a through 1.9.5). The description attributes the issue to improper neutralization of input during web page generation . The ...

CVE-2025-39594 WordPress Arigato Autoresponder and Newsletter plugin <= 2.7.2.4 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Bob Arigato Autoresponder and Newsletter bft-autoresponder allows Reflected XSS.This issue affects Arigato Autoresponder and Newsletter: from n/a through = 2.7.2.4...

CVE-2025-39588 WordPress Ultimate Store Kit Elementor Addons plugin <= 2.4.0 - Deserialization of untrusted data Vulnerability

Deserialization of Untrusted Data vulnerability in bdthemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Object Injection.This issue affects Ultimate Store Kit Elementor Addons: from n/a through = 2.4.0...

CVE-2025-22796 WordPress WP-Asambleas Plugin <= 2.85.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in platcom WP-Asambleas allows Reflected XSS. This issue affects WP-Asambleas: from n/a through 2.85.0...

CVE-2025-32158

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Syed Balkhi aThemes Addons for Elementor athemes-addons-for-elementor-lite.This issue affects aThemes Addons for Elementor: from n/a through = 1.1.3...

CVE-2025-26888

Missing Authorization vulnerability in Amir Helzer WooCommerce Multilingual & Multicurrency woocommerce-multilingual allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Multilingual & Multicurrency: from n/a through = 5.3.8...

CVE-2025-3131 ECA: Event - Condition - Action - Critical - Cross site request forgery - SA-CONTRIB-2025-031

Cross-Site Request Forgery CSRF vulnerability in Drupal ECA: Event - Condition - Action allows Cross Site Request Forgery.This issue affects ECA: Event - Condition - Action: from 0.0.0 before 1.1.12, from 2.0.0 before 2.0.16, from 2.1.0 before 2.1.7, from 0.0.0 before 1.2...

CVE-2025-32563

Cross-Site Request Forgery CSRF vulnerability in dangrossman WP Calais Auto Tagger calais-auto-tagger allows Cross Site Request Forgery.This issue affects WP Calais Auto Tagger: from n/a through = 2.0...

CVE-2025-31036 WordPress WPSolr plugin <= 24.0 - CSRF to Privilege Escalation vulnerability

Cross-Site Request Forgery CSRF vulnerability in WPSOLR WPSolr wpsolr-free allows Privilege Escalation.This issue affects WPSolr: from n/a through = 24.0...

CVE-2025-32691 WordPress PowerPress Podcasting plugin <= 11.12.6 - Server Side Request Forgery (SSRF) Vulnerability

Server-Side Request Forgery SSRF vulnerability in blubrry PowerPress Podcasting powerpress allows Server Side Request Forgery.This issue affects PowerPress Podcasting: from n/a through = 11.12.6...

CVE-2025-32171

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Imtiaz Rayhan Table Block by Tableberg tableberg allows Stored XSS.This issue affects Table Block by Tableberg: from n/a through = 0.6.10...

CVE-2025-32249

CVE-2025-32249 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress DirectoryPress plugin, affecting versions up to 3.6.19 (per multiple sources). The CVE entry notes a CSRF issue; the NVD entry lists a CVSS v3.1 base score of 5.4 (Medium) with network attack vector, low integrit...

CVE-2025-32186

CVE-2025-32186 is a DOM-based XSS risk in Turbo Addons for Elementor (vulnerable up to 1.7.1; 1.7.2 reportedly affected per Wordfence) that remains unpatched according to the connected Wordfence vulnerability report. Affects Turbo Addons for Elementor; impact is Cross-site Scripting via input dur...

CVE-2025-31617

Cross-Site Request Forgery CSRF vulnerability in Gagan Deep Singh PostmarkApp Email Integrator postmarkapp-email-integrator allows Cross Site Request Forgery.This issue affects PostmarkApp Email Integrator: from n/a through = 2.4...

CVE-2025-31441 WordPress WordPress Galleria plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in S WordPress Galleria wp-galleria allows Reflected XSS.This issue affects WordPress Galleria: from n/a through = 1.4...

CVE-2025-31078 WordPress Small Package Quotes – Worldwide Express Edition plugin <= 5.2.18 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in enituretechnology Small Package Quotes – Worldwide Express Edition small-package-quotes-wwe-edition allows Reflected XSS.This issue affects Small Package Quotes – Worldwide Express Edition: from n/...

CVE-2025-30827 WordPress WP2LEADS plugin <= 3.4.5 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Saleswonder Team: Tobias WP2LEADS wp2leads allows Reflected XSS.This issue affects WP2LEADS: from n/a through = 3.4.5...

CVE-2025-31575 WordPress Flag Icons plugin <= 2.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Vasilis Triantafyllou Flag Icons language-icons-flags-switcher allows Stored XSS.This issue affects Flag Icons: from n/a through = 2.2...

WordPress Hostel plugin <= 1.1.5.5 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by johska in WordPress Plugin Hostel versions = 1.1.5.5...

CVE-2025-30567

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in WP01 WP01 wp01 allows Path Traversal.This issue affects WP01: from n/a through = 2.6.2...