WordPress LambertGroup - AllInOne - Banner with Thumbnails Plugin <= 3.8 - SQL Injection Vulnerability

WordPress LambertGroup - AllInOne - Banner with Thumbnails Plugin = 3.8 - SQL Injection Vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin LambertGroup - AllInOne - Banner with Thumbnails versions = 3.8...

WordPress Ditty Plugin <= 3.1.58 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by zaim in WordPress Plugin Ditty versions = 3.1.58...

WordPress Embed Any Document Plugin <= 2.7.7 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by 63n0 in WordPress Plugin Embed Any Document versions = 2.7.7...

WordPress Theme My Login Plugin <= 7.1.12 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Psai in WordPress Plugin Theme My Login versions = 7.1.12...

WordPress Stackable Plugin <= 3.18.1 - Sensitive Data Exposure Vulnerability

Sensitive Data Exposure Vulnerability discovered by Abu Hurayra in WordPress Plugin Stackable versions = 3.18.1...

WordPress Stackable Plugin <= 3.18.1 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Abu Hurayra in WordPress Plugin Stackable versions = 3.18.1...

WordPress Download Manager Plugin <= 3.3.24 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Download Manager versions = 3.3.24...

WordPress TweetThis Shortcode plugin <= 1.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin TweetThis Shortcode versions = 1.8.0...

WordPress Backuply plugin <= 1.4.8 - Authenticated (Admin+) Arbitrary File Deletion vulnerability

Authenticated Admin+ Arbitrary File Deletion vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Backuply – Backup, Restore, Migrate and Clone versions = 1.4.8...

WordPress TheGem (Elementor) Theme <= 5.10.5 is vulnerable to Broken Access Control

Software TheGem Elementor Type Theme Vulnerable versions = 5.10.5 Fixed in 5.10.5.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2025-60096 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 2ce2db30c88d Credits Rafie Muhammad Patchstack...

WordPress XStore Theme <= 9.5.3 is vulnerable to Content Injection

Software XStore Type Theme Vulnerable versions = 9.5.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2025-60100 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 55131c12c2eb Credits Rafie Muhammad Patchstack Required privilege...

WordPress TheGem Theme <= 5.10.5 is vulnerable to Broken Access Control

Software TheGem Type Theme Vulnerable versions = 5.10.5 Fixed in 5.10.5.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2025-60097 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID f811c174fae7 Credits Rafie Muhammad Patchstack Required...

PT-2025-39686

🟠 https://t.co/K1gep42ZWg spmrc, Prototype Pollution, CVE-2025-45628 Low...

WordPress Mapster WP Maps plugin <= 1.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zer0gh0st in WordPress Plugin Mapster WP Maps versions = 1.20.0...

WordPress CM Business Directory plugin <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin CM Business Directory versions = 1.5.2...

WordPress Download After Email Plugin 2.1.5-2.1.6 - Other Vulnerability Type Vulnerability

Other Vulnerability Type Vulnerability discovered by Marcin 'maskopatol' Nowak in WordPress Plugin Download After Email versions 2.1.5-2.1.6...

BIT-WORDPRESS-MULTISITE-2025-58674 WordPress <= 6.8.2 - (Author+) Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WordPress allows Stored XSS. WordPress core security team is aware of the issue and working on a fix. This is low severity vulnerability that requires an attacker to have Author or higher user...

BIT-WORDPRESS-2025-58674 WordPress <= 6.8.2 - (Author+) Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WordPress allows Stored XSS. WordPress core security team is aware of the issue and working on a fix. This is low severity vulnerability that requires an attacker to have Author or higher user...

BIT-WORDPRESS-2025-58246 WordPress <= 6.8.2 - (Contributor+) Sensitive Data Exposure Vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in WordPress allows Retrieve Embedded Sensitive Data. The WordPress Core security team is aware of the issue and is already working on a fix. This is a low-severity vulnerability. Contributor-level privileges required in order to...

BIT-WORDPRESS-MULTISITE-2025-58246 WordPress <= 6.8.2 - (Contributor+) Sensitive Data Exposure Vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in WordPress allows Retrieve Embedded Sensitive Data. The WordPress Core security team is aware of the issue and is already working on a fix. This is a low-severity vulnerability. Contributor-level privileges required in order to...