62 matches found
CVE-2025-49872
CVE-2025-49872 is a Missing Authorization (Broken Access Control) vulnerability affecting the WordPress plugin myCred (versions up to and including 2.9.4.2). The advisory states that functionality is accessible without proper ACL enforcement, enabling access to restricted features. The CVSS v3.1 ...
CVE-2025-48118: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WpExperts Hub Woocommerce Partial Shipment wc-partial-shipment allows SQL Injection.This issue affects Woocommerce Partial Shipment: from n/a through = 3.2...
PT-2025-25684 · WordPress · Wpexperts Hub Woocommerce Partial Shipment
Name of the Vulnerable Software and Affected Versions: WpExperts Hub Woocommerce Partial Shipment versions n/a through 3.2 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection...
CVE-2023-32580
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WPExperts Password Protected plugin = 2.6.2 versions...
CVE-2024-13713
The WPExperts Square For GiveWP plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...
CVE-2024-13713 WPExperts Square For GiveWP <= 1.3.1 - Authenticated (Subscriber+) SQL Injection
The WPExperts Square For GiveWP plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...
CVE-2024-13713
CVE-2024-13713 : WPExperts Square For GiveWP plugin for WordPress has an SQL Injection via the post parameter in all versions up to 1.3.1. Exploitation requires Subscriber+ or higher authentication; attacker can append SQL to existing queries to access data. The connected Wordfence entry lists th...
CVE-2024-13713: Improper Neutralization of Special Elements used in an SQL Command
The WPExperts Square For GiveWP plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...
WordPress plugin WPExperts Square For GiveWP SQL注入漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A SQL injection vulnerability exists in WordPress...
CVE-2025-22736
Incorrect Privilege Assignment vulnerability in Saad Iqbal User Management user-management allows Privilege Escalation.This issue affects User Management: from n/a through = 1.2...
CVE-2024-52403
Unrestricted Upload of File with Dangerous Type vulnerability in Saad Iqbal User Management user-management allows Upload a Web Shell to a Web Server.This issue affects User Management: from n/a through = 1.1...
CVE-2024-31297
Missing Authorization vulnerability in WPExperts Wholesale For WooCommerce.This issue affects Wholesale For WooCommerce: from n/a through 2.3.0...
CVE-2025-22736
Incorrect Privilege Assignment vulnerability in Saad Iqbal User Management user-management allows Privilege Escalation.This issue affects User Management: from n/a through = 1.2...
CVE-2025-22736 WordPress User Management plugin <= 1.2 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in Saad Iqbal User Management user-management allows Privilege Escalation.This issue affects User Management: from n/a through = 1.2...
CVE-2025-22736 WordPress User Management plugin <= 1.2 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in WPExperts User Management allows Privilege Escalation.This issue affects User Management: from n/a through 1.2...
WordPress Post SMTP Plugin <= 2.9.9 is vulnerable to SQL Injection
Software Post SMTP Type Plugin Vulnerable versions = 2.9.9 Fixed in 2.9.10 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-52436 Patch priority Low CVSS severity Low 7.6 Developer WPExperts PSID d90cd284edab Credits Hakiduck Required privilege Administrator Published 15...
CVE-2024-47338
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Saad Iqbal WPExperts Square For GiveWP wpexperts-square-for-give allows SQL Injection.This issue affects WPExperts Square For GiveWP: from n/a through = 1.3...
CVE-2024-47338 WordPress WPExperts Square For GiveWP plugin <= 1.3 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Saad Iqbal WPExperts Square For GiveWP wpexperts-square-for-give allows SQL Injection.This issue affects WPExperts Square For GiveWP: from n/a through = 1.3...
CVE-2024-47338 WordPress WPExperts Square For GiveWP plugin <= 1.3 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WPExpertsio WPExperts Square For GiveWP allows SQL Injection.This issue affects WPExperts Square For GiveWP: from n/a through 1.3...