PT-2025-1961

Name of the Vulnerable Software and Affected Versions Custom Related Posts plugin for WordPress versions up to, and including, 1.7.3 Description The issue allows unauthorized access and modification of data due to a missing capability check on three AJAX actions. This makes it possible for...

WordPress plugin RapidLoad has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2025-4104

Name of the Vulnerable Software and Affected Versions MagicForm plugin for WordPress versions up to, and including, 1.6.2 Description The issue arises from a missing capability check on the plugin's AJAX actions, allowing authenticated attackers with Subscriber-level access and above to invoke...

CVE-2025-0939: Missing Authorization

The MagicForm plugin for WordPress is vulnerable to access and modification of data due to a missing capability check on the plugin's AJAX actions in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke tho...

CVE-2024-12825: Missing Authorization

The Custom Related Posts plugin for WordPress is vulnerable to unauthorized access & modification of data due to a missing capability check on three AJAX actions in all versions up to, and including, 1.7.3. This makes it possible for authenticated attackers, with Subscriber-level access and above...

CVE-2025-0934

A vulnerability was found in code-projects Job Recruitment 1.0. It has been classified as problematic. This affects an unknown part of the file /parse/calljobsearchajax.php. The manipulation of the argument n leads to sql injection. It is possible to initiate the attack remotely. The exploit has...

CVE-2024-13424

The Ni Sales Commission For WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'niwooscajax' AJAX endpoint in all versions up to, and including, 1.2.4. This makes it possible for authenticated attackers, with Subscriber-level access and...

PT-2025-2255 · Vcita · Contact Form/Calls To Action By Vcita

Name of the Vulnerable Software and Affected Versions: The Contact Form and Calls To Action by vcita plugin for WordPress versions up to, and including, 2.7.1 Description: The issue is related to a missing capability check on the vcita ajax toggle ae and vcita ajax toggle contact functions. This...

PT-2025-2165 · WordPress · Ni Sales Commission For Woocommerce

Name of the Vulnerable Software and Affected Versions: Ni Sales Commission For WooCommerce plugin for WordPress versions up to, and including, 1.2.4 Description: The issue is related to unauthorized access due to a missing capability check on the "niwoosc ajax" AJAX endpoint. This allows...

PT-2025-4102 · Unknown · Code-Projects Job Recruitment

Name of the Vulnerable Software and Affected Versions: code-projects Job Recruitment version 1.0 Description: A vulnerability has been found in the code, classified as problematic. It affects an unknown part of the file /parse/ call job search ajax.php. The manipulation of the n argument leads to...

WordPress plugin ECPay Ecommerce for WooCommerce has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2025-2236 · WordPress · Ecpay Ecommerce For Woocommerce

Name of the Vulnerable Software and Affected Versions: ECPay Ecommerce for WooCommerce plugin for WordPress versions up to, and including, 1.1.2411060 Description: The issue is related to a missing capability check on the 'clear ecpay debug log' AJAX action. This allows authenticated attackers wi...

PT-2025-4062 · Unknown · Code-Projects Job Recruitment

Name of the Vulnerable Software and Affected Versions: code-projects Job Recruitment version 1.0 Description: This issue affects some unknown processing of the file call job search ajax.php. The manipulation of the job type argument leads to cross-site scripting. The attack may be initiated...

org.apache.cocoon:cocoon-acegisecurity-sample (2.3.0), org.apache.cocoon:cocoon-ajax-impl (2.3.0) +116 more potentially affected by CVE-2025-24783 via org.apache.cocoon:cocoon-sitemap-impl (2.3.0)

org.apache.cocoon:cocoon-sitemap-impl MAVEN version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cocoon:cocoon-sitemap-impl and may be impacted: - org.apache.cocoon:cocoon-acegisecurity-sample 2.3.0 -...

CVE-2024-11913

The Activity Plus Reloaded for BuddyPress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.1.1 via the 'ajaxpreviewlink' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web...

CVE-2025-24733: Improper Control of Filename for Include/Require Statement in PHP Program

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Akhtarujjaman Shuvo Post Grid Master ajax-filter-posts allows PHP Local File Inclusion.This issue affects Post Grid Master: from n/a through = 3.4.12...

PT-2025-2162 · WordPress · Post Grid

Name of the Vulnerable Software and Affected Versions: Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress versions up to, and including, 1.6.10 Description: The issue allows authenticated attackers, with Contributor-level access and...

PT-2025-1712

Name of the Vulnerable Software and Affected Versions Activity Plus Reloaded for BuddyPress plugin for WordPress versions 1.1.1 and earlier Description The issue allows authenticated attackers with Subscriber-level access and above to make web requests to arbitrary locations originating from the...

CVE-2024-13584: Improper Neutralization of Input During Web Page Generation

The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisperpictures' shortcode in all versions up to, and including, 1.5.19 due to insufficient input sanitization and output escaping on user supplie...

CVE-2024-12696 Picture Gallery – Frontend Image Uploads, AJAX Photo List <= 1.5.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via videowhisper_picture_upload_guest Shortcode

The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's videowhisperpictureuploadguest shortcode in all versions up to, and including, 1.5.22 due to insufficient input sanitization and output escaping on user...