CVE-2025-32576

CVE-2025-32576 affects WordPress plugin WPshop (WP shop) up to version 2.6.0. The connected Wordfence details describe a Cross-Site Request Forgery leading to Arbitrary File Upload, enabling an attacker to upload a Web Shell to the server. The CVSS score listed is 9.8 (CRITICAL) with NETWORK atta...

CVE-2025-32580

CVE-2025-32580 involves the DeBounce Email Validator WordPress plugin. It describes a Stored XSS via improper input handling during web page generation in DeBounce Email Validator, affecting versions from n/a through 5.7.1. The connected Wordfence/WordPress vulnerability listing indicates the pat...

CVE-2025-32581

CVE-2025-32581 is a stored XSS vulnerability in WordPress Spam Blocker (WordPress plugin). The issue is described as a Cross-Site Request Forgery to Stored XSS affecting WordPress Spam Blocker versions up to and including 2.0.4. Public references (Wordfence vulnerability detail and related WordPr...

CVE-2025-32584 WordPress Chat2 plugin <= 4.0 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Chat2 Chat2 chat2 allows Cross Site Request Forgery.This issue affects Chat2: from n/a through = 4.0...

CVE-2025-32584 WordPress Chat2 plugin <= 3.6.3 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Chat2 Chat2 allows Cross Site Request Forgery. This issue affects Chat2: from n/a through 3.6.3...

CVE-2025-32591 WordPress WP Abstracts Plugin <= 2.7.4 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Kevon Adonis WP Abstracts allows Cross Site Request Forgery. This issue affects WP Abstracts: from n/a through 2.7.4...

CVE-2025-32610

CVE-2025-32610 affects Foliopress WYSIWYG in FolioPress WYSIWYG (up to 2.6.18); described as CSRF leading to stored XSS. Public documentation shows a base CVSS v3.1 score of 7.1 (HIGH) with network attack vector, no privileges, and user interaction required. Connected sources indicate the patch s...

CVE-2025-32610 WordPress Foliopress WYSIWYG plugin <= 2.6.18 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Foliovision: Making the web work for you Foliopress WYSIWYG allows Cross Site Request Forgery. This issue affects Foliopress WYSIWYG: from n/a through 2.6.18...

CVE-2025-32610 WordPress Foliopress WYSIWYG plugin <= 2.6.18 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in FolioVision Foliopress WYSIWYG foliopress-wysiwyg allows Cross Site Request Forgery.This issue affects Foliopress WYSIWYG: from n/a through = 2.6.18...

CVE-2025-32612

CVE-2025-32612 concerns the WordPress plugin User Session Synchronizer. Connected documentation confirms a CSRF to Stored XSS scenario affecting User Session Synchronizer versions up to 1.4.0, with the CVE rated as HIGH (CVSS 3.1: 7.1 base score: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The Wordfenc...

CVE-2025-32612 WordPress User Session Synchronizer plugin <= 1.4.0 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in rafasashi User Session Synchronizer user-session-synchronizer allows Stored XSS.This issue affects User Session Synchronizer: from n/a through = 1.4.0...

CVE-2025-32616 WordPress Nimbata Call Tracking plugin <= 1.7.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in nimbata Nimbata Call Tracking nimbata-call-tracking allows Stored XSS.This issue affects Nimbata Call Tracking: from n/a through = 1.7.4...

CVE-2025-32617 WordPress Multiple Location Google Map plugin <= 1.1 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Ydesignservices Multiple Location Google Map multiple-location-google-map allows Stored XSS.This issue affects Multiple Location Google Map: from n/a through = 1.1...

CVE-2025-32621

CVE-2025-32621 (WP Map Route Planner) describes a Cross-Site Request Forgery leading to Stored Cross-Site Scripting in WP Map Route Planner versions

CVE-2025-32621 WordPress WP Map Route Planner plugin <= 1.0.0 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Vsourz Digital WP Map Route Planner allows Cross Site Request Forgery. This issue affects WP Map Route Planner: from n/a through 1.0.0...

CVE-2025-32621 WordPress WP Map Route Planner plugin <= 1.0.0 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Vsourz Digital WP Map Route Planner wp-map-route-planner allows Cross Site Request Forgery.This issue affects WP Map Route Planner: from n/a through = 1.0.0...

CVE-2025-32623 WordPress PlainInventory plugin <= 3.1.9 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in plainware PlainInventory z-inventory-manager allows Stored XSS.This issue affects PlainInventory: from n/a through = 3.1.9...

CVE-2025-32624

CVE-2025-32624 (CZATER.pl – live chat i telefon) is a missing authorization vulnerability that enables Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) in Czater.pl – live chat i telefon. The Wordfence vulnerability entry explicitly associates CVE-2025-32624 with Cza...

CVE-2025-32641 WordPress Anant Addons for Elementor plugin <= 1.1.5 - CSRF to Arbitrary Plugin Installation vulnerability

Cross-Site Request Forgery CSRF vulnerability in anantaddons Anant Addons for Elementor allows Cross Site Request Forgery. This issue affects Anant Addons for Elementor: from n/a through 1.1.5...

CVE-2025-32644

IP2Location World Clock (WordPress plugin) contains a CSRF to Stored XSS vulnerability, affecting versions up to 1.1.9. The CVE entry lists CVE-2025-32644 with a CVSSv3.1 base score of 7.1 (HIGH) and a Network attack vector, requiring user interaction. The vulnerability affects the plugin as depl...