CVE-2025-28950

CVE-2025-28950: The WordPress plugin Post Author (David Shabtai) is affected by a CSRF vulnerability that can lead to Stored XSS. The vulnerability is reported for Post Author versions up to 1.1.1 (no details on patch status are provided in the connected documents). Public sources in the Connecte...

CVE-2025-28948 WordPress Mediabay - WordPress Media Library Folders plugin <= 1.4 - CSRF to Reflected XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in codedraft Mediabay - WordPress Media Library Folders allows Reflected XSS. This issue affects Mediabay - WordPress Media Library Folders: from n/a through 1.4...

CVE-2025-28948 WordPress Mediabay - WordPress Media Library Folders plugin <= 1.4 - CSRF to Reflected XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in codedraft Mediabay - WordPress Media Library Folders allows Reflected XSS. This issue affects Mediabay - WordPress Media Library Folders: from n/a through 1.4...

CVE-2025-27360 WordPress Quick Event Calendar plugin <= 1.4.9 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in WP Corner Quick Event Calendar quick-event-calendar allows Cross Site Request Forgery.This issue affects Quick Event Calendar: from n/a through = 1.4.9...

CVE-2025-27360 WordPress Quick Event Calendar plugin <= 1.4.9 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in WP Corner Quick Event Calendar quick-event-calendar allows Cross Site Request Forgery.This issue affects Quick Event Calendar: from n/a through = 1.4.9...

CVE-2025-28952 WordPress CubePoints plugin <= 3.2.1 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in Jonathan Lau CubePoints cubepoints allows Cross Site Request Forgery.This issue affects CubePoints: from n/a through = 3.2.1...

CVE-2025-28954 WordPress Backwp plugin <= 2.0.2 - CSRF to Arbitrary File Deletion vulnerability

Cross-Site Request Forgery CSRF vulnerability in wphobby Backwp backwp allows Path Traversal.This issue affects Backwp: from n/a through = 2.0.2...

CVE-2025-28954

CVE-2025-28954 (Backwp) is a CSRF vulnerability in the Backwp plugin for WordPress, affecting versions up to 2.0.2. The CVSS 3.1 base score is 7.4 (HIGH) with network access, require user interaction, and impact limited to availability (C) with availability impact HIGH. Root cause and exact explo...

CVE-2025-28954 WordPress Backwp plugin <= 2.0.2 - CSRF to Arbitrary File Deletion vulnerability

Cross-Site Request Forgery CSRF vulnerability in wphobby Backwp backwp allows Path Traversal.This issue affects Backwp: from n/a through = 2.0.2...

CVE-2025-28964 WordPress Personal Favicon plugin <= 2.0 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in mangup Personal Favicon personal-favicon allows Stored XSS.This issue affects Personal Favicon: from n/a through = 2.0...

CVE-2025-28958 WordPress Bg Orthodox Calendar plugin <= 0.13.10 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Vadim Bogaiskov Bg Orthodox Calendar bg-orthodox-calendar allows Stored XSS.This issue affects Bg Orthodox Calendar: from n/a through = 0.13.10...

CVE-2025-28981 WordPress WP Mail Options plugin <= 0.2.3 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Soli WP Mail Options wp-mail-options allows Stored XSS.This issue affects WP Mail Options: from n/a through = 0.2.3...

CVE-2025-28986 WordPress Epicwin Plugin plugin <= 1.5 - CSRF to SQL Injection vulnerability

Cross-Site Request Forgery CSRF vulnerability in Webaholicson Epicwin Plugin epicwin-subscribers allows SQL Injection.This issue affects Epicwin Plugin: from n/a through = 1.5...

CVE-2025-30629 WordPress Bitly URL Shortener plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Codehaveli Bitly URL Shortener codehaveli-bitly-url-shortener allows Cross Site Request Forgery.This issue affects Bitly URL Shortener: from n/a through = 1.4.1...

CVE-2025-30632

CVE-2025-30632 describes a Cross-Site Request Forgery (CSRF) vulnerability in the pozzad Global Translator WordPress plugin. Affected software: Global Translator (versions up to 2.0.2). Root cause: CSRF vulnerability that could enable an attacker to induce authenticated users to perform unwanted ...

CVE-2025-30946 WordPress Custom Bulk/Quick Edit plugin <= 1.6.10 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in Michael Cannon Custom Bulk/Quick Edit custom-bulkquick-edit allows Cross Site Request Forgery.This issue affects Custom Bulk/Quick Edit: from n/a through = 1.6.10...

CVE-2025-30946

CVE-2025-30946 describes a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Custom Bulk/Quick Edit (custom-bulkquick-edit). The issue affects Custom Bulk/Quick Edit versions from n/a through 1.6.10. Public data includes CVSSv3.1 metrics with base score 4.3 (Medium), and the...

CVE-2025-30968 WordPress Advanced Post List plugin <= 0.5.6.2 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in jokerbr313 Advanced Post List advanced-post-list allows Cross Site Request Forgery.This issue affects Advanced Post List: from n/a through = 0.5.6.2...

CVE-2025-30980 WordPress Simple Keyword to Link plugin <= 1.5 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in Alessandro Piconi Simple Keyword to Link simple-keyword-to-link allows Cross Site Request Forgery.This issue affects Simple Keyword to Link: from n/a through = 1.5...

CVE-2025-30986 WordPress Elite Video Player plugin <= 10.0.5 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in CreativeMedia Elite Video Player elite-video-player allows Cross Site Request Forgery.This issue affects Elite Video Player: from n/a through = 10.0.5...