CVE-2025-6064 WP URL Shortener <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The WP URL Shortener plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing or incorrect nonce validation on the 'urlshortenersettings' page. This makes it possible for unauthenticated attackers to update settings and...

WordPress AI Image Lab plugin <= 1.0.6 - Cross-Site Request Forgery to API Key Update vulnerability

Cross-Site Request Forgery to API Key Update vulnerability discovered by Kishan Vyas in WordPress Plugin AI Image Lab versions = 1.0.6...

CVE-2025-4973

The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to authentication bypass in all versions up to, and including, 3.3.1. This is due to the plugin not properly verifying a user's identity prior to logging them in when verifying an accoun...

CVE-2025-6059

The Seraphinite Accelerator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.27.21. This is due to missing or incorrect nonce validation on the 'OnAdminApiCacheOpBegin' function. This makes it possible for unauthenticated attackers to perfor...

WordPress plugin kk Youtube Video 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-25479 · WordPress · Yougler Blogger Profile Page

Name of the Vulnerable Software and Affected Versions: Yougler Blogger Profile Page plugin for WordPress versions up to, and including, v1.01 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the 'yougler-plugin.php' page. This allows...

WordPress plugin Restrict File Access 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A path traversal vulnerability exis...

WordPress plugin Seraphinite Accelerator 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

CVE-2025-5144

The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-date-’ parameters in all versions up to, and including, 6.13.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-4315

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.23. This is due to the plugin allowing a user to update arbitrary user meta through the updateusermeta function. This makes it possible for...

CVE-2025-6012

The Auto Attachments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.8.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permission...

WordPress WP Travel Engine plugin <= 6.5.1 - Missing Authorization to Unauthenticated Arbitrary Post Deletion vulnerability

Missing Authorization to Unauthenticated Arbitrary Post Deletion vulnerability discovered by mikemyers in WordPress Plugin WP Travel Engine versions = 6.5.1...

WordPress Contact Us Page – Contact People plugin <= 3.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via style Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via style Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin Contact Us page - Contact people LITE versions = 3.7.4...

CVE-2025-4799

The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file deletion due to lack of restriction on the directory a file can be deleted from in all versions up to, and including, 1.68.10. This makes it possible for authenticated attackers, with Administrator-level access and above,...

CVE-2025-4666

The Zotpress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘nickname’ parameter in all versions up to, and including, 7.3.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and...

CVE-2025-5815

The Traffic Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tfcmmaybesetbotflags function in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to disabled bot logging...

CVE-2025-5950

The IndieBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘kind’ parameter in all versions up to, and including, 0.13.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2025-5938

The Digital Marketing and Agency Templates Addons for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1. This is due to missing or incorrect nonce validation on the importtemplates function. This makes it possible for...

CVE-2025-4586

The IRM Newsroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'irmcalendarview' shortcode in all versions up to, and including, 1.2.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-5123

CVE-2025-5123 : The WordPress plugin “Contact Us Page – Contact People” is vulnerable to stored XSS via the style parameter in all versions up to 3.7.4. The issue arises from insufficient input sanitization and output escaping, enabling authenticated attackers with Contributor-level access and hi...