92973 matches found
CVE-2025-15485 Auto x LINE <= 1.0.0 – Unauthenticated REST API Endpoints Call
The Auto x LINE WordPress plugin through 1.0.0 does not have authorization checks in some of its REST endpoints, allowing unauthenticated users to call them and update the plugin settings, clear logs etc...
CVE-2025-15485
CVE-2025-15485 affects the Auto x LINE WordPress plugin through version 1.0.0 . The plugin lacks authorization checks on certain REST API endpoints , enabling unauthenticated users to invoke them and update plugin settings or clear logs . The vulnerability carries a CVSS v3.1 score of 8.2 (HIGH) ...
CVE-2025-15481 Notification Bar for WordPress <= 1.1.8 – Unauthenticated Subscriber Data Disclosure
The Notification Bar for WordPress plugin through 1.1.8 exposes an unauthenticated CSV export script that discloses all stored subscriber emails...
CVE-2025-15485 Auto x LINE <= 1.0.0 – Unauthenticated REST API Endpoints Call
The Auto x LINE WordPress plugin through 1.0.0 does not have authorization checks in some of its REST endpoints, allowing unauthenticated users to call them and update the plugin settings, clear logs etc...
EUVD-2025-210829
The Notification Bar for WordPress plugin through 1.1.8 exposes an unauthenticated CSV export script that discloses all stored subscriber emails...
CVE-2024-3773 LiveJournal Shortcode <= 1.1.1 - Contributor+ Stored XSS via Shortcode
The LiveJournal Shortcode WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attack...
CVE-2024-3773 LiveJournal Shortcode <= 1.1.1 - Contributor+ Stored XSS via Shortcode
The LiveJournal Shortcode WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attack...
EUVD-2024-55747
The LiveJournal Shortcode WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attack...
CVE-2023-3360 Weaver Show Posts < 1.8.1 - Admin+ PHP Object Injection
The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present on the blog...
CVE-2023-3360 Weaver Show Posts < 1.8.1 - Admin+ PHP Object Injection
The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present on the blog...
CVE-2023-3360
The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, enabling PHP object injection when a high-privilege user imports a malicious file and a suitable gadget chain exists on the blog. The vulnerability is rated CVSS 3.3 (LOW) with high attack complexity...
EUVD-2023-60614
The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present on the blog...
EUVD-2026-70047
The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of its widgets' settings before outputting them within HTML attributes, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...
CVE-2026-83547 Xpro Elementor Addons 1.6.0 - 1.7.3 - Contributor+ Stored XSS via Multiple Widgets
The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of its widgets' settings before outputting them within HTML attributes, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...
EUVD-2026-70046
The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying...
CVE-2026-83533 WP Express Checkout < 2.4.9 - Unauthenticated Payment Bypass via wpec_process_payment
The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying...
CVE-2026-83533 WP Express Checkout < 2.4.9 - Unauthenticated Payment Bypass via wpec_process_payment
The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying...
CVE-2026-83547
Xpro Addons (WordPress plugin) versions 1.6.0 through 1.7.3 are vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is that certain widget settings are not properly escaped before being rendered within HTML attributes . An attacker with the Contributor role or higher can inject malic...
CVE-2026-83547 Xpro Elementor Addons 1.6.0 - 1.7.3 - Contributor+ Stored XSS via Multiple Widgets
The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of its widgets' settings before outputting them within HTML attributes, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...
CVE-2026-82884
The All in One SEO WordPress plugin before 5.0.0.1 fails to sanitise and escape content stored in the ai-assistant Block within posts before rendering it in the post editor. This allows users with the contributor role or higher to inject a Stored Cross-Site Scripting (XSS) payload that executes w...