CVE-2025-2685

The CVE-2025-2685 entry concerns the WordPress plugin TablePress (Tables in WordPress made easy). The connected document confirms a Stored Cross-Site Scripting vulnerability via the table-name parameter in all versions up to 3.0.4, caused by insufficient input sanitization and output escaping. Ex...

CVE-2025-30093

HTCondor versions 23.0.x before 23.0.22 , 23.10.x before 23.10.22 , 24.0.x before 24.0.6 , and 24.6.x before 24.6.1 are affected by CVE-2025-30093 . This vulnerability allows authenticated attackers to bypass authorization restrictions , potentially leading to unauthorized access or actions withi...

CVE-2025-2228

CVE-2025-2228 affects the Responsive Addons for Elementor plugin (Free Elementor Addons and Elementor Templates) for WordPress, with the flaw in the register_user function present in versions up to 1.6.8. The vulnerability allows an attacker with Contributor-level access (authenticated) to exfilt...

CVE-2025-2228 Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates <= 1.6.8 - Authenticated (Contributor+) Sensitive Information Exposure

The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.8 the 'registeruser' function. This makes it possible for authenticated attackers, with...

CVE-2025-1912

The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5.0 via the validatefile Function. This makes it possible for authenticated attackers, with Administrator-level...

CVE-2025-1913

The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.5.0 via deserialization of untrusted input from the 'formdata' parameter This makes it possible for authenticated attacker...

CVE-2025-1312

The Ultimate Blocks – WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buttonTextColor’ parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2025-1913

CVE-2025-1913 affects the WordPress plugin Product Import Export for WooCommerce – Import Export Product CSV Suite. The issue is a PHP Object Injection via deserialization of untrusted input in the form_data parameter, exploitable by authenticated administrators and higher. A POP chain is not pre...

CVE-2025-1911

CVE-2025-1911 (Product Import Export for WooCommerce – Import Export Product CSV Suite, WordPress) . The vulnerability arises from insufficient file path validation in the admin_log_page() function, allowing a directory traversal to occur. This enables an authenticated attacker with Administrator...

CVE-2024-13411

CVE-2024-13411 pertains to the Zapier for WordPress plugin for WordPress, with SSRF vulnerability in all versions up to 1.5.1 via the updated_user() function. The issue allows authenticated attackers with Subscriber-level access or higher to cause the WordPress application to perform web requests...

CVE-2025-1312 Ultimate Blocks – WordPress Blocks Plugin <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Ultimate Blocks – WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buttonTextColor’ parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2025-1312 Ultimate Blocks – WordPress Blocks Plugin <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Ultimate Blocks – WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buttonTextColor’ parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2024-13889

CVE-2024-13889 affects WordPress Importer (WordPress Importer plugin) up to version 0.8.3 via PHP Object Injection in maybe_unserialize. Exploitation requires Administrator+ access and, crucially, a POP chain present from another plugin/theme; without a POP chain, impact is limited. The vulnerabi...

CVE-2025-2110 WP Compress <= 6.30.15 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to missing capability checks on its on its AJAX functions in all versions up to, and including, 6.30.15. This makes it possible for authenticate...

CVE-2025-1703

The Ultimate Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘content’ parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level acce...

CVE-2025-1703 Ultimate Blocks <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via content Parameter

The Ultimate Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘content’ parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level acce...

CVE-2025-1439 Advanced iFrame <= 2024.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Host Header

The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advancediframe' shortcode in all versions up to, and including, 2024.5 due to insufficient input sanitization and output escaping on user supplied attributes through the 'src' attribute when th...

CVE-2025-1439

CVE-2025-1439 — The WordPress plugin Advanced iFrame is vulnerable to a Stored Cross-Site Scripting (XSS) condition through the host header and the plugin’s advanced_iframe/src attributes in versions up to and including 2024.5. Exploitation requires authentication at contributor level or higher, ...

CVE-2025-1437

CVE-2025-1437 affects the WordPress plugin Advanced iFrame . The vulnerability is a Stored Cross-Site Scripting (XSS) via the plugin’s advanced_iframe shortcode in all versions up to 2025.2, caused by insufficient input sanitization and output escaping on user-supplied attributes. Impact: authent...

CVE-2025-1310

CVE-2025-1310 affects the WordPress plugin Job Postings (Jobs for WordPress) up to version 2.7.11. Affected component: directory traversal via the job_postings_get_file parameter. Exploitation requires authenticated access at Subscriber level or higher, enabling reading of arbitrary server files ...