114 matches found
CVE-2025-47653
CVE-2025-47653 refers to a PHP Local File Inclusion in the WordPress WP-Recall plugin (versions up to and including 16.26.14) caused by improper filename handling. The vulnerability is characterized in sources as a local file inclusion risk arising from PHP Remote File Inclusion concepts, with a ...
PT-2025-20207 · WordPress · Wp-Recall
Name of the Vulnerable Software and Affected Versions: WP-Recall versions through 16.26.14 Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion in...
Exploit for SQL Injection in Plechevandrey Wp-Recall
cve-2025-1323 WP-Recall Plugin SQL Injection ⚠️ Legal Dis...
CVE-2024-9771
The WP-Recall WordPress plugin before 16.26.12 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
WordPress WP-Recall plugin < 16.26.12 - Admin+ Stored XSS vulnerability
Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin WP-Recall versions 16.26.12...
CVE-2024-9771
The WP-Recall WordPress plugin before 16.26.12 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-9771 WP-Recall < 16.26.12 - Admin+ Stored XSS
The WP-Recall WordPress plugin before 16.26.12 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-9771
CVE-2024-9771 affects the WP-Recall WordPress plugin (versions prior to 16.26.12). It enables Stored XSS by privileged users (e.g., Admin) due to improper sanitisation/escaping of settings, even when unfiltered_html is disallowed. Impact per available sources is stored XSS with low CVSS base of ...
CVE-2024-9771 WP-Recall < 16.26.12 - Admin+ Stored XSS
The WP-Recall WordPress plugin before 16.26.12 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-9770
The WP-Recall WordPress plugin before 16.26.12 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks...
WordPress WP-Recall plugin < 16.26.12 - Admin+ SQL Injection vulnerability
Admin+ SQL Injection vulnerability discovered by y4ng0615 in WordPress Plugin WP-Recall versions 16.26.12...
CVE-2024-9770
The WP-Recall WordPress plugin before 16.26.12 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks...
CVE-2024-9770 WP-Recall < 16.26.12 - Admin+ SQL Injection
The WP-Recall WordPress plugin before 16.26.12 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks...
CVE-2024-9770 WP-Recall < 16.26.12 - Admin+ SQL Injection
The WP-Recall WordPress plugin before 16.26.12 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks...
CVE-2024-9770
CVE-2024-9770 concerns the WordPress plugin WP-Recall (before version 16.26.12). The issue stems from not sanitizing/escaping a parameter before using it in a SQL statement, enabling an admin-level SQL injection as described across multiple sources (NVD/Red Hat/CVE records). The vulnerability aff...
WordPress plugin WP-Recall 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...
CVE-2025-1325
The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to arbitrary shortcode execution due to a missing capability check on the 'rclpreviewpost' AJAX endpoint in all versions up to, and including, 16.26.10. This makes it possible for authenticated attackers, wi...
CVE-2025-1323
The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to SQL Injection via the 'databeat' parameter in all versions up to, and including, 16.26.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
CVE-2025-1322
The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 16.26.10 via the 'feed' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated...
CVE-2025-1323 WP-Recall – Registration, Profile, Commerce & More <= 16.26.10 - Unauthenticated SQL Injection
The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to SQL Injection via the 'databeat' parameter in all versions up to, and including, 16.26.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...