CVE-2025-13493

The Latest Registered Users plugin for WordPress is vulnerable to unauthorized user data export in all versions up to, and including, 1.4. This is due to missing authorization and nonce validation in the rndhandleformsubmit function hooked to both adminpostmysimpleform and...

PT-2026-1588

Name of the Vulnerable Software and Affected Versions The Latest Registered Users plugin for WordPress versions prior to 1.5 Description The Latest Registered Users plugin for WordPress is susceptible to unauthorized user data export. This is a result of a lack of authorization and nonce validati...

PT-2025-47258

Name of the Vulnerable Software and Affected Versions Premmerce Wholesale Pricing for WooCommerce plugin for WordPress versions up to and including 1.1.10 Description The software contains a SQL Injection issue due to insufficient escaping of user-supplied parameters and inadequate preparation of...

Open redirect

The Nested Pages WordPress plugin = 3.1.15 was vulnerable to an Open Redirect via the page POST parameter in the npBulkActions, npBulkEdit, npListingSort, and npCategoryFilter adminpost actions...

PT-2021-22063 · WordPress · Nested Pages

Name of the Vulnerable Software and Affected Versions: Nested Pages WordPress plugin versions 3.1.15 and earlier Description: The issue concerns an Open Redirect vulnerability via the page POST parameter in the npBulkActions, npBulkEdit, npListingSort, and npCategoryFilter admin post actions...

Nested Pages < 3.1.16 - Open Redirect

The plugin was vulnerable to an Open Redirect via the page POST parameter in the npBulkActions, npBulkEdit, npListingSort, and npCategoryFilter adminpost actions...

CVE-2020-10195

The popup-builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading to in-scope privilege escalation via admin-post actions to com/classes/Actions.php. By sending a POST request to wp-admin/admin-post.php, an authenticated attacker with minimal...

Information disclosure

The popup-builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading to in-scope privilege escalation via admin-post actions to com/classes/Actions.php. By sending a POST request to wp-admin/admin-post.php, an authenticated attacker with minimal...