CVE-2025-39517

Cross-Site Request Forgery CSRF vulnerability in WP Map Plugins Basic Interactive World Map basic-interactive-world-map allows Cross Site Request Forgery.This issue affects Basic Interactive World Map: from n/a through = 2.7...

CVE-2024-29502

An issue in Secure Lockdown Multi Application Edition v2.00.219 allows attackers to read arbitrary files via using UNC paths...

Xianqi Kindergarten Management System 安全漏洞

Xianqi Kindergarten Management System is a kindergarten management system from Xianqi. A security vulnerability exists in Xianqi Kindergarten Management System version 2.0 Bulid 20190808, which is caused by a SQL injection due to incorrect manipulation of the parameter sex in the file stulist.php...

CVE-2025-26958 WordPress JetBlog plugin <= 2.4.3 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Crocoblock JetBlog jet-blog allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JetBlog: from n/a through = 2.4.3...

GHSA-9GQV-WP59-FQ42 http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed

In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed...

WordPress plugin Sign-up Sheets 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A code injection vulnerability exis...

WordPress HTML5 Video Player with Playlist Plugin <= 2.50 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin HTML5 Video Player with Playlist versions = 2.50...

CVE-2025-3436

The coreActivity: Activity Logging for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'order' and 'orderby' parameters in all versions up to, and including, 2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQ...

CVE-2025-32165 WordPress Doppler Forms plugin <= 2.4.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in fromdoppler Doppler Forms allows Stored XSS. This issue affects Doppler Forms: from n/a through 2.4.5...

CVE-2025-32120 WordPress Easy Query – WP Query Builder plugin <= 2.0.4 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in edanzer Easy Query – WP Query Builder easy-query allows Blind SQL Injection.This issue affects Easy Query – WP Query Builder: from n/a through = 2.0.4...

CVE-2025-31819

CVE-2025-31819 is a Cross-Site Scripting (XSS) vulnerability in Nova Blocks by Pixelgrade. The issue affects Nova Blocks versions up to 2.1.8 (and possibly earlier n/a ranges per entry). Root cause is improper neutralization of user-controlled input during web page generation, enabling injection ...

CVE-2025-3096 Clinics Patient Management System SQL Injection

Clinic’s Patient Management System versions 2.0 suffers from a SQL injection vulnerability in the login page...

WordPress Perfect Font Awesome Integration Plugin <= 2.3 - Stored Cross Site Scripting (XSS) vulnerability

Stored Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Perfect Font Awesome Integration versions = 2.3...

WordPress Bulk NoIndex & NoFollow Toolkit plugin <= 2.16 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Dimas Maulana in WordPress Plugin Bulk NoIndex & NoFollow Toolkit versions = 2.16...

WordPress Uptime Robot Plugin for WordPress plugin <= 2.3 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Uptime Robot Plugin for WordPress versions = 2.3...

CVE-2025-31562

CVE-2025-31562 is a DOM-based Cross-Site Scripting in the Uptime Robot Plugin for WordPress (uptime-robot-monitor), affecting WordPress plugins versions up to 2.3. The issue arises from improper neutralization of input during web page generation. The Wordfence entry lists this vulnerability with ...

CVE-2025-31406 WordPress ELEX WooCommerce Request a Quote plugin <= 2.3.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in ELEXtensions ELEX WooCommerce Request a Quote elex-request-a-quote allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ELEX WooCommerce Request a Quote: from n/a through = 2.3.9...

CVE-2025-3014 Insecure direct object references (IDOR) in NightWolf Penetration Platform

Insecure Direct Object References IDOR in access control in Tracking 2.1.4 on NightWolf Penetration Testing allows an attacker to access via manipulating request parameters or object references...

CVE-2025-22360

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in promact WP Azure offload wp-azure-offload allows Reflected XSS.This issue affects WP Azure offload: from n/a through = 2.0...

CVE-2025-22360 WordPress WP Azure offload plugin <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NotFound WP Azure offload allows Reflected XSS. This issue affects WP Azure offload: from n/a through 2.0...