WordPress CozyStay theme <= 1.7.0 - Missing Authorization to Arbitrary Action Execution in ajax_handler vulnerability

Missing Authorization to Arbitrary Action Execution in ajaxhandler vulnerability discovered by Lucio Sá in WordPress Theme CozyStay versions = 1.7.0...

CVE-2025-26886 WordPress PublishPress Authors plugin <= 4.7.3 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in PublishPress PublishPress Authors publishpress-authors allows SQL Injection.This issue affects PublishPress Authors: from n/a through = 4.7.3...

WordPress PageLayer plugin <= 1.9.9 - Missing Authorization to Authenticated (Contributor+) Post Publication vulnerability

Missing Authorization to Authenticated Contributor+ Post Publication vulnerability discovered by Brian Sans-Souci liardom in WordPress Plugin PageLayer versions = 1.9.8...

WordPress Mobile Themes plugin <= 1.1.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Mobile Themes versions = 1.1.1...

CVE-2024-13864 Countdown Timer <= 1.0 - Reflected XSS

The Countdown Timer WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

libzvbi 输入验证错误漏洞

libzvbi is a VBI utility in the zapping-vbi open source. An input validation error vulnerability exists in libzvbi version 0.2.43 and earlier, which stems from an integer overflow and could lead to a remote attack...

WordPress FooGallery plugin <= 2.4.29 - Authenticated (Custom+) Stored Cross-Site Scripting via Album Title Size vulnerability

Authenticated Custom+ Stored Cross-Site Scripting via Album Title Size vulnerability discovered by Stiofan in WordPress Plugin FooGallery versions = 2.4.29...

WordPress School Management System for Wordpress plugin <= 93.0.0 - Missing Authorization to Unauthenticated Arbitrary Post Deletion vulnerability

Missing Authorization to Unauthenticated Arbitrary Post Deletion vulnerability discovered by Lucio Sá in WordPress Plugin School Management versions = 93.0.0...

CVE-2024-13778

CVE-2024-13778 concerns the WordPress plugin Hero Mega Menu - Responsive WordPress Menu Plugin . The vulnerability is a SQL Injection in multiple functions across all versions up to and including 1.16.5 , caused by insufficient escaping of user-supplied input and lack of proper SQL statement prep...

CVE-2025-0958

The Ultimate WordPress Auction Plugin plugin for WordPress is vulnerable to unauthorized access to functionality in all versions up to, and including, 4.2.9. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary auctions, posts as well as...

CVE-2025-1639

The Animation Addons for Elementor Pro plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the installelementorpluginhandler function in all versions up to, and including, 1.6. This makes it possible for authenticated attackers, wi...

WordPress WP Shortcodes Ultimate plugin <= 7.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via src Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via src Parameter vulnerability discovered by stealthcopter in WordPress Plugin Shortcodes Ultimate versions = 7.3.3...

CVE-2025-23881

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in littlejon LJ Custom Menu Links lj-custom-menu-links allows Reflected XSS.This issue affects LJ Custom Menu Links: from n/a through = 2.5...

CVE-2025-26989

CVE-2025-26989 describes an unauthenticated Stored XSS in Zigaform – Form Builder Lite (WordPress plugin) up to version 7.4.2. The vulnerability stems from improper input neutralization during web page generation, enabling stored cross-site scripting. Affected software is the Zigaform Form Builde...

CVE-2025-26994 WordPress Zigaform – Price Calculator & Cost Estimation Form Builder Lite plugin <= 7.4.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in softdiscover Zigaform – Price Calculator & Cost Estimation Form Builder Lite zigaform-calculator-cost-estimation-form-builder-lite allows Stored XSS.This issue affects Zigaform – Price Calculator &...

CVE-2025-23956

CVE-2025-23956 is a WordPress WordPress WP Easy Post Mailer plugin vulnerability described as an improper neutralization of input during web page generation, leading to a Reflected XSS . Affected software: WP Easy Post Mailer (versions up to 0.64). Root cause: improper input handling during page ...

CVE-2025-23616 WordPress Canalplan plugin <= 5.31 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Steve Canalplan canalplan-ac allows Reflected XSS.This issue affects Canalplan: from n/a through = 5.31...

CVE-2025-23555 WordPress Ui Slider Filter By Price plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NotFound Ui Slider Filter By Price allows Reflected XSS. This issue affects Ui Slider Filter By Price: from n/a through 1.1...

CVE-2025-23433 WordPress vcOS plugin <=1.4.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in jnwry vcOS vcos allows Reflected XSS.This issue affects vcOS: from n/a through = 1.4.0...

CVE-2025-1867 HTTP Response Smuggling Vulnerability in libhv

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in ithewei libhv allows HTTP Response Smuggling.This issue affects libhv: through 1.3.3...