CVE-2025-68030

Server-Side Request Forgery SSRF vulnerability in WP Messiah Frontis Blocks frontis-blocks allows Server Side Request Forgery.This issue affects Frontis Blocks: from n/a through = 1.1.5...

CVE-2026-22406

Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Overton overton allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Overton: from n/a through = 1.3...

CVE-2026-24624

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in saeros1984 Neoforum neoforum allows Blind SQL Injection.This issue affects Neoforum: from n/a through = 1.0...

CVE-2026-24631

Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Rosebud rosebud allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rosebud: from n/a through = 1.4...

CVE-2026-24632 WordPress Delay Redirects plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in jagdish1o1 Delay Redirects delay-redirects allows DOM-Based XSS.This issue affects Delay Redirects: from n/a through = 1.0.0...

CVE-2026-24601

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PenciDesign Penci Pay Writer penci-pay-writer allows Stored XSS.This issue affects Penci Pay Writer: from n/a through = 1.5...

CVE-2026-24579 WordPress Ai Image Alt Text Generator for WP plugin <= 1.1.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP Messiah Ai Image Alt Text Generator for WP ai-image-alt-text-generator-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ai Image Alt Text Generator for WP: from n/a through = 1.1.9...

PT-2026-4430

Name of the Vulnerable Software and Affected Versions Zoho CRM Lead Magnet versions through 1.8.1.5 Description An authorization issue exists in Zoho CRM Lead Magnet zoho-crm-forms, allowing exploitation of incorrectly configured access control security levels. Recommendations Update Zoho CRM Lea...

CVE-2025-52762

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in flexostudio flexo-posts-manager flexo-posts-manager allows Reflected XSS.This issue affects flexo-posts-manager: from n/a through = 1.0001...

CVE-2026-24374

Cross-Site Request Forgery CSRF vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Cross Site Request Forgery.This issue affects RegistrationMagic: from n/a through = 6.0.6.9...

CVE-2026-22468

CVE-2026-22468 is a Missing Authorization vulnerability in Absolute Addons For Elementor. Affected product: Absolute Addons For Elementor; vulnerable versions are

CVE-2025-69186 WordPress Hospital Doctor Directory plugin <= 1.3.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in e-plugins Hospital Doctor Directory hospital-doctor-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hospital Doctor Directory: from n/a through = 1.3.9...

CVE-2025-69187

Missing Authorization vulnerability in e-plugins Final User final-user allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Final User: from n/a through = 1.2.5...

CVE-2025-69079

CVE-2025-69079 describes a Deserialization of Untrusted Data vulnerability in ThemeREX Sound | Musicplace WordPress theme (Sound | Musical Instruments Online Store) that allows Object Injection. Affected software: Theme musicplace WordPress theme versions from n/a up to and including 1.6.9. Root ...

CVE-2025-69060

CVE-2025-69060 describes an Unrestricted Local File Inclusion in AncoraThemes uReach (WordPress theme/plugin: ureach). The root cause is Improper Control of Filename for Include/Require in a PHP program, enabling a PHP Local File Inclusion condition. Affected: uReach versions up to and including ...

CVE-2025-69051 WordPress ListingPro Reviews theme <= 1.7 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CridioStudio ListingPro Reviews listingpro-reviews allows Reflected XSS.This issue affects ListingPro Reviews: from n/a through 2.9.11...

CVE-2025-69039

CVE-2025-69039 is an unauthenticated Local File Inclusion vulnerability in the WordPress theme Bailly (DesignThemes Bailly/Bailly) affecting versions up to and including 1.3.4. The issue arises from improper control of the filename used in PHP include/require statements, enabling an attacker to p...

CVE-2025-69036

Deserialization of Untrusted Data vulnerability in strongholdthemes Tech Life CPT techlife-cpt allows Object Injection.This issue affects Tech Life CPT: from n/a through = 16.4...

CVE-2025-66139

CVE-2025-66139 describes a Missing Authorization vulnerability in the WordPress plugin Audier For Elementor (Audier Element or Audier For Elementor) that allows exploitation due to incorrectly configured access control security levels. Affected: Audier For Elementor versions up to and including 1...

CVE-2025-66143 WordPress Crumber plugin <= 1.0.10 - Broken Access Control vulnerability

Missing Authorization vulnerability in merkulove Crumber crumber-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Crumber: from n/a through = 1.0.10...