WordPress WP-Members plugin <= 3.5.4 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by zaim Patchstack Alliance in WordPress Plugin WP-Members versions = 3.5.4...

WordPress Logo Manager For Samandehi plugin <= 0.5 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Thi Huyen Trang - Skalucy in WordPress Plugin Logo Manager For Samandehi versions = 0.5...

WordPress Esselink.nu Settings plugin <= 3.6 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Esselink.nu Settings versions = 3.6...

WordPress Classified Listing plugin <= 4.2.0 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by LVT-tholv2k in WordPress Plugin Classified Listing versions = 4.2.0...

CVE-2025-3515

The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 1.3.8.9. This makes it possible for unauthenticated attackers to bypass the plugin's blacklist and...

CVE-2025-5071

The CVE-2025-5071 entry concerns the WordPress AI Engine plugin (versions 2.8.0–2.8.3) with a missing capability check in Meow_MWAI_Labs_MCP::can_access_mcp. This allows authenticated users with subscriber-level access and above to gain full MCP control and execute commands (e.g., wp_create_user,...

WordPress Football Pool plugin <= 2.12.4 - Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Football Pool versions = 2.12.4...

WordPress Download Manager plugin <= 3.3.18 - Authenticated (Author+) Stored Cross-site Scripting via wpdm_user_dashboard Shortcode vulnerability

Authenticated Author+ Stored Cross-site Scripting via wpdmuserdashboard Shortcode vulnerability discovered by Brian Sans-Souci liardom in WordPress Plugin Download Manager versions = 3.3.18...

CVE-2025-4571 GiveWP – Donation Plugin and Fundraising Platform <= 4.3.0 - Missing Authorization To Authenticated (Contributor+) Campaign Data View And Modification

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized view and modification of data due to an insufficient capability check on the permissionsCheck functions in all versions up to, and including, 4.3.0. This makes it possible for authenticated...

CVE-2025-4571

The CVE-2025-4571 entry concerns the WordPress plugin GiveWP – Donation Plugin and Fundraising Platform. Affected versions are up to and including 4.3.0, with an insufficient permissions check in the permissionsCheck functions allowing authenticated attackers with Contributor-level access and abo...

CVE-2025-5490

The Football Pool plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.12.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions...

CVE-2025-4479

The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin image comparison widget's before/after labels in all versions up to, and including, 3.5.2 due to insufficient input sanitization and output escaping on user supplied...

WordPress plugin OceanWP 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-26211 · WordPress · Ai Engine Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: WordPress AI Engine plugin affected versions not specified Description: A critical flaw in WordPress's AI Engine plugin allows subscribers to escalate privileges and take over websites with Dev Tools/MCP enabled. Recommendations: Update the...

WordPress plugin ElementsKit Elementor Addons and Templates 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. The WordPress ElementsKit Elementor Addons and Templates plugin suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering a...

CVE-2025-5237 Target Video Easy Publish <= 3.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter

The Target Video Easy Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions up to, and including, 3.8.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-6086 CSV Me <= 2.0 - Authenticated (Administrator+) Arbitrary File Upload

The CSV Me plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'csvmeoptionspage' function in all versions up to, and including, 2.0. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload...

WordPress Target Video Easy Publish plugin <= 3.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via width Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin Target Video Easy Publish versions = 3.8.5...

WordPress Pixabay Images plugin <= 3.4 - Authenticated (Author+) Arbitrary File Upload vulnerability

Authenticated Author+ Arbitrary File Upload vulnerability discovered by siavashvafshar in WordPress Plugin Pixabay Images versions = 3.4...

PT-2025-26159 · WordPress · Ultimate Addons For Contact Form 7

Name of the Vulnerable Software and Affected Versions: Ultra Addons for Contact Form 7 versions up to and including 3.5.12 Description: The Ultra Addons for Contact Form 7 plugin for WordPress is susceptible to arbitrary file uploads due to the absence of file type validation within the save...