CVE-2025-27337

CVE-2025-27337 is a WordPress Fontsampler plugin vulnerability: CSRF-enabled, leading to a reflected Cross-Site Scripting (XSS) in Fontsampler versions up to and including 0.4.14. The issue arises from improper input neutralization during web page generation, enabling an attacker to trigger XSS w...

CVE-2025-32545 WordPress WooCommerce Products without featured images Plugin <= 0.1 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability

Cross-Site Request Forgery CSRF vulnerability in SOFTAGON WooCommerce Products without featured images woocommerce-products-without-featured-images allows Reflected XSS.This issue affects WooCommerce Products without featured images: from n/a through = 0.1...

CVE-2025-32546 WordPress All push notification for WP Plugin <= 1.5.3 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability

Cross-Site Request Forgery CSRF vulnerability in gtlwpdev All push notification for WP all-push-notification allows Reflected XSS.This issue affects All push notification for WP: from n/a through = 1.5.3...

CVE-2025-32606 WordPress Listings for Buildium plugin <= 0.1.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Deepak Khokhar Listings for Buildium listings-for-buildium allows Stored XSS.This issue affects Listings for Buildium: from n/a through = 0.1.5...

CVE-2025-32655 WordPress Restrict User Registration plugin <= 1.0.1 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in DevriX Restrict User Registration allows Stored XSS. This issue affects Restrict User Registration: from n/a through 1.0.1...

CVE-2025-32655 WordPress Restrict User Registration plugin <= 1.0.1 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in DevriX Restrict User Registration restrict-user-registration allows Stored XSS.This issue affects Restrict User Registration: from n/a through = 1.0.1...

CVE-2025-39415 WordPress Social Media Links plugin <= 1.0.3 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Jayesh Parejiya Social Media Links social-media-links allows Stored XSS.This issue affects Social Media Links: from n/a through = 1.0.3...

CVE-2025-39414

CVE-2025-39414 concerns the WordPress spam-stopper plugin (versions n/a–3.1.3) with a CSRF leading to Stored XSS. The vulnerability is confirmed in connected sources (Patchstack/Red Hat/CVE listings) and Wordfence references; CVSSv3.1 base score 7.1 (HIGH) with network access, user interaction re...

CVE-2025-39415

Summary of CVE-2025-39415 (Social Media Links) A CSRF flaw in the WordPress plugin Social Media Links (by Jayesh Parejiya) enables Stored XSS in versions up to 1.0.3 (affected: 0.0 through 1.0.3). Public sources consistently describe the issue as a CSRF that permits injection of stored scripts, w...

CVE-2025-39416

CVE-2025-39416 : WordPress plugin translit it! (

CVE-2025-39416 WordPress translit it! plugin <= 1.6 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Ichi translit it! allows Stored XSS. This issue affects translit it!: from n/a through 1.6...

CVE-2025-39417 WordPress Redirect wordpress to welcome or landing page plugin <= 2.0 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Eslam Mahmoud Redirect wordpress to welcome or landing page redirect-to-welcome-or-landing-page allows Stored XSS.This issue affects Redirect wordpress to welcome or landing page: from n/a through = 2.0...

CVE-2025-39418 WordPress RSS Manager plugin <= 0.06 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in ajayver RSS Manager rss-manager allows Stored XSS.This issue affects RSS Manager: from n/a through = 0.06...

CVE-2025-39418

CVE-2025-39418 is a CSRF to Stored XSS vulnerability in WordPress RSS Manager plugin (versions 0.06 and earlier). The linked sources (NVD, Red Hat, Patchstack, CVE listings) confirm the issue and affected product, but none supply a specific patched version. The core impact is stored XSS triggered...

CVE-2025-39419 WordPress Revision Diet plugin <= 1.0.1 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in David Miller Revision Diet revision-diet allows Stored XSS.This issue affects Revision Diet: from n/a through = 1.0.1...

CVE-2025-39419 WordPress Revision Diet plugin <= 1.0.1 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in David Miller Revision Diet revision-diet allows Stored XSS.This issue affects Revision Diet: from n/a through = 1.0.1...

CVE-2025-39420

CVE-2025-39420 affects the WordPress WP Twitter Button plugin (versions

CVE-2025-39420 WordPress WP Twitter Button plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ruudkok WP Twitter Button allows Stored XSS. This issue affects WP Twitter Button: from n/a through 1.4.1...

CVE-2025-39421

CVE-2025-39421 describes a CSRF vulnerability in the WordPress plugin WP Sticky Side Buttons (Mustafa KUCUK) that enables stored XSS. The CVE entry states the vulnerability affects WP Sticky Side Buttons versions from n/a up to and including 2.1, with CVSSv3.1 metrics (AV:N/AC:L/PR:N/UI:R/S:C/C:L...

CVE-2025-39421 WordPress WP Sticky Side Buttons plugin <= 2.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Mustafa KUCUK WP Sticky Side Buttons allows Stored XSS. This issue affects WP Sticky Side Buttons: from n/a through 2.1...