CVE-2025-7059

CVE-2025-7059 : The Simple Featured Image WordPress plugin (versions

CVE-2025-7327

CVE-2025-7327 – Widget for Google Reviews (WordPress) is a directory traversal vulnerability in all versions up to and including 1.0.15. An authenticated attacker with Subscriber-level access or higher can abuse the layout parameter to include and execute arbitrary PHP files on the server, enabli...

CVE-2025-5570

The AI Engine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the mwaichatbot shortcode 'id' parameter in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-5570 AI Engine <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via `mwai_chatbot` Shortcode `id` Parameter

The AI Engine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the mwaichatbot shortcode 'id' parameter in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-5570

CVE-2025-5570 (AI Engine plugin for WordPress) is a stored Cross-Site Scripting vulnerability in versions up to 2.8.4, caused by insufficient input sanitization and output escaping in the mwai_chatbot shortcode with the parameter ‘id’. Exploitation requires authentication at Subscriber level or h...

CVE-2025-6244 Essential Addons for Elementor – Popular Elementor Templates and Widgets <= 6.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via `Calendar` And `Business Reviews` Widgets

The Essential Addons for Elementor – Popular Elementor Templates and Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the via Calendar And Business Reviews Widgets attributes in all versions up to, and including, 6.1.19 due to insufficient input sanitization and outpu...

CVE-2025-6244

CVE-2025-6244 affects the WordPress plugin “Essential Addons for Elementor” (Lite) up to version 6.1.19. The vulnerability is a Stored Cross‑Site Scripting (XSS) flaw in the Calendar and Business Reviews widgets caused by insufficient input sanitization and output escaping. Attacker capability re...

PT-2025-28334 · WordPress · Widgets For Google Reviews

Name of the Vulnerable Software and Affected Versions: The Widget for Google Reviews plugin for WordPress versions up to, and including, 1.0.15 Description: The issue allows authenticated attackers with Subscriber-level access and above to include and execute arbitrary PHP files on the server via...

CVE-2025-53375 Dokploy allows attackers to read any file that the Traefik process user can access

Dokploy is a self-hostable Platform as a Service PaaS that simplifies the deployment and management of applications and databases. An authenticated attacker can read any file that the Traefik process user can access e.g., /etc/passwd, application source, environment variable files containing...

CVE-2025-47228

In the Production Environment extension in Netmake ScriptCase through 9.12.006 23, shell injection in the SSH connection settings allows authenticated attackers to execute system commands via crafted HTTP requests...

CVE-2024-11937

The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's linkURL in the Mobile Menu element in all versions up to, and including, 4.10.69 due to insufficient input sanitization and output escaping on user supplied attributes. This makes i...

CVE-2025-7046

The Portfolio for Elementor & Image Gallery | PowerFolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS Attributes of Plugin's widgets in all versions up to, and including, 3.2.0 due to insufficient input sanitization and output escaping. This makes it possibl...

CVE-2025-6039

The ProcessingJS for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pjs4wp' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-47228

In the Production Environment extension in Netmake ScriptCase through 9.12.006 23, shell injection in the SSH connection settings allows authenticated attackers to execute system commands via crafted HTTP requests...

CVE-2025-47228

In the Production Environment extension in Netmake ScriptCase through 9.12.006 23, shell injection in the SSH connection settings allows authenticated attackers to execute system commands via crafted HTTP requests...

CVE-2025-6673

The Easy restaurant menu manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's nsceprmmenulink shortcode in versions up to, and including 2.0.1, due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-11937

The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's linkURL in the Mobile Menu element in all versions up to, and including, 4.10.69 due to insufficient input sanitization and output escaping on user supplied attributes. This makes i...

CVE-2025-6673 Easy restaurant menu manager <= 2.0.1 - Authenticated (Contributot+) Stored Cross-Site Scripting via `nsc_eprm_menu_link` Shortcode

The Easy restaurant menu manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's nsceprmmenulink shortcode in versions up to, and including 2.0.1, due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-11937

CVE-2024-11937 affects Premium Addons for Elementor (WordPress). A stored Cross-Site Scripting flaw exists via the Mobile Menu element’s linkURL in all versions up to 4.10.69. Exploitation requires at least contributor-level authentication; successful abuse injects scripts that run when users vie...

CVE-2025-6673

The CVE covers the WordPress plugin Easy Restaurant Menu Manager. A Stored Cross-Site Scripting (XSS) flaw exists in the nsc_eprm_menu_link shortcode (versions up to 2.0.1) caused by insufficient input sanitization and output escaping of user-supplied attributes. This enables authenticated attack...