CVE-2025-1502: Missing Authorization

The IP2Location Redirection plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'downloadip2locationredirectionbackup' AJAX action in all versions up to, and including, 1.33.3. This makes it possible for unauthenticated attackers to download...

CVE-2025-1505

The Advanced AJAX Product Filters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nonce' parameter in all versions up to, and including, 1.6.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2025-1505 Advanced AJAX Product Filters <= 1.6.8.1 - Reflected Cross-Site Scripting

The Advanced AJAX Product Filters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nonce' parameter in all versions up to, and including, 1.6.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2025-1505 Advanced AJAX Product Filters <= 1.6.8.1 - Reflected Cross-Site Scripting

The Advanced AJAX Product Filters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nonce' parameter in all versions up to, and including, 1.6.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

PT-2025-9055

Name of the Vulnerable Software and Affected Versions Advanced AJAX Product Filters plugin for WordPress versions up to, and including, 1.6.8.1 Description The issue arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts...

CVE-2025-1505: Improper Neutralization of Input During Web Page Generation

The Advanced AJAX Product Filters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nonce' parameter in all versions up to, and including, 1.6.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

PT-2025-9069 · WordPress · Forex Calculators

Name of the Vulnerable Software and Affected Versions: Forex Calculators plugin for WordPress versions up to, and including, 1.3.5 Description: The issue allows authenticated attackers with Subscriber-level access and above to update the plugin's settings due to a missing capability check on the...

PT-2025-9076

Name of the Vulnerable Software and Affected Versions The WHMpress - WHMCS WordPress Integration Plugin versions up to, and including, 6.3-revision-0 Description The issue allows unauthenticated attackers to include and execute arbitrary files on the server via the whmpress domain search ajax...

CVE-2024-2297

The Bricks theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.9.6.1. This is due to insufficient validation checks placed on the createautosave AJAX function. This makes it possible for authenticated attackers, with contributor-level access and above...

PT-2025-8915

Name of the Vulnerable Software and Affected Versions The Bricks theme for WordPress versions up to, and including, 1.9.6.1 Description The issue is due to insufficient validation checks on the create autosave AJAX function, allowing authenticated attackers with contributor-level access and above...

VERM_AJAX_functions.php Code Execution

The vulnerability of the VERMAJAXfunctions.php software for the Vicidial call processing center is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

CVE-2024-13585

The Ajax Search Lite WordPress plugin before 4.12.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

PT-2025-7653

Name of the Vulnerable Software and Affected Versions code-projects Real Estate Property Management System version 1.0 Description A critical vulnerability was found in the code-projects Real Estate Property Management System. The issue affects an unknown functionality of the file /ajax state.php...

WordPress Ajax Search Lite plugin < 4.12.5 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Ajax Search Lite versions 4.12.5...

CVE-2024-13585

The Ajax Search Lite WordPress plugin before 4.12.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13585

The Ajax Search Lite WordPress plugin before 4.12.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13585 Ajax Search Lite < 4.12.5 - Admin+ Stored XSS

The Ajax Search Lite WordPress plugin before 4.12.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13585 Ajax Search Lite < 4.12.5 - Admin+ Stored XSS

The Ajax Search Lite WordPress plugin before 4.12.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13585

The Ajax Search Lite WordPress plugin, in versions prior to 4.12.5 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitize and escape certain plugin settings. This flaw allows high-privilege users, such as administrators, to execute XSS attacks, n...

PT-2025-7525

Name of the Vulnerable Software and Affected Versions dingfanzu CMS up to 20250210 Description A critical vulnerability was found in the file /ajax/loadShopInfo.php, where the manipulation of the shopId argument leads to SQL injection. This issue can be exploited remotely. The vendor was contacte...