WordPress Advanced Woo Labels plugin <= 2.15 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by savphill in WordPress Plugin Advanced Woo Labels versions = 2.15...

WordPress Turbo Addons for Elementor plugin <= 1.7.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Gab in WordPress Plugin Turbo Addons Elementor versions = 1.7.7...

WordPress Emma for WordPress plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Emma for WordPress versions = 1.3.3...

WordPress m1.DownloadList plugin <= 0.24 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin m1.DownloadList versions = 0.24...

WordPress Radius Blocks plugin <= 2.2.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro Soares de Alcântara Kinorth in WordPress Plugin Radius Blocks versions = 2.2.1...

WordPress BuddyForms Plugin <= 2.9.0 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by LVT-tholv2k in WordPress Plugin BuddyForms versions = 2.9.0...

WordPress Easy WP Optimizer Plugin <= 1.1.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by thiennv in WordPress Plugin Easy WP Optimizer versions = 1.1.0...

CVE-2025-2279

The Maps WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2025-2279 Maps - Google Maps <= 1.0.6 - Contributor+ Stored XSS

The Maps WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2025-2279 Maps - Google Maps <= 1.0.6 - Contributor+ Stored XSS

The Maps WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2024-9416

The Modula Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library versions = 5.0.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

WordPress Publitio plugin <= 2.2.0 - Arbitrary File Read vulnerability

Arbitrary File Read vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Publitio versions = 2.2.0...

CVE-2025-1663

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 1.5.142 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-2055

The MapPress Maps for WordPress plugin before 2.94.9 does not sanitise and escape some parameters when outputing them in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks...

CVE-2025-2055 MapPress Maps for WordPress < 2.94.9 - Contributor+ Stored XSS

The MapPress Maps for WordPress plugin before 2.94.9 does not sanitise and escape some parameters when outputing them in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks...

CVE-2025-2055

CVE-2025-2055 concerns the WordPress plugin MapPress Maps for WordPress. Connected sources confirm the vulnerability is a stored Cross-Site Scripting (XSS) issue in MapPress Maps for WordPress prior to version 2.94.9, caused by insufficient sanitisation/escaping of certain parameters when output ...

WordPress Wigi Theme <= 2.0.1 is vulnerable to Arbitrary File Upload

Software Wigi Type Theme Vulnerable versions = 2.0.1 Fixed in N/A OWASP Top 10 A5: Security Misconfiguration Classification Arbitrary File Upload CVE CVE-2025-30996 Patch priority Medium CVSS severity Medium 9.9 Developer Claim ownership PSID a3f5b750c9b1 Credits Tran Nguyen Bao Khanh VCI - VNPT...

WordPress mFolio Lite plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Gab in WordPress Plugin mFolio Lite versions = 1.2.3...

WordPress Boo Recipes plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by SOPROBRO in WordPress Plugin Boo Recipes versions = 2.4.1...

CVE-2025-2906

The CVE-2025-2906 entry is tied to Contempo Real Estate Core, a WordPress plugin. It describes a Stored Cross-Site Scripting vulnerability in versions up to 3.6.3 due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. An authenticated attacker with contr...