CVE-2025-5939 Telegram for WP <= 1.6.1 - Authenticated (Admin+) Stored Cross-Site Scripting

The Telegram for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions...

WordPress plugin Link Shield 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

PT-2025-25383

Name of the Vulnerable Software and Affected Versions The Traffic Monitor plugin for WordPress versions up to, and including, 3.2.2 Description The issue is related to unauthorized modification of data due to a missing capability check on the tfcm maybe set bot flags function. This allows...

WordPress plugin Game Review Block 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists i...

PT-2025-25377 · WordPress · Wp Sliding Login/Dashboard Panel

Name of the Vulnerable Software and Affected Versions: WP Sliding Login/Dashboard Panel plugin versions up to, and including, 2.1.1 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the wp sliding panel user options function. This allo...

PT-2025-25399 · WordPress · Auto Attachments

Name of the Vulnerable Software and Affected Versions: Auto Attachments plugin for WordPress versions up to, and including, 1.8.5 Description: The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This allows authenticat...

WordPress Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal Plugin <= 16.8 is vulnerable to Broken Access Control

Software Malcure Malware Scanner — 1 Toolset for WordPress Malware Removal Type Plugin Vulnerable versions = 16.8 Fixed in 16.9 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE N/A Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID...

PT-2025-25382 · WordPress · Wp Travel Engine

Name of the Vulnerable Software and Affected Versions: The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress versions up to, and including, 6.5.1 Description: The issue is related to a missing capability check on the delete package function, allowing...

WordPress plugin WP Travel Engine - Tour Booking Plugin - Tour Operator Software Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin WP Travel...

WordPress plugin IndieBlocks 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

The vulnerability of the File Upload plugin in the WordPress content management system allows a hacker to gain access to read, modify, or delete data.

The vulnerability of the File Upload plugin in the WordPress content management system is related to an incorrect restriction on the path to the restricted directory. Exploiting this vulnerability could allow a malicious actor to gain read, modify, or delete access to data...

WordPress CubeWP Framework plugin <= 1.1.23 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin CubeWP versions = 1.1.23...

WordPress CubeWP Forms plugin <= 1.1.5 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Mika in WordPress Plugin CubeWP Forms versions = 1.1.5...

WordPress If-So Dynamic Content Personalization plugin <= 1.9.3.1 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin If-So Dynamic Content Personalization versions = 1.9.3.1...

WordPress Automation By Autonami plugin <= 3.6.0 - Open Redirection Vulnerability

Open Redirection Vulnerability discovered by LVT-tholv2k in WordPress Plugin FunnelKit Automations versions = 3.6.0...

WordPress AFS Analytics plugin <= 4.21 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Nabil Irawan in WordPress Plugin AFS Analytics versions = 4.21...

WordPress Majestic Support plugin <= 1.1.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Fariq Fadillah Gusti Insani in WordPress Plugin Majestic Support versions = 1.1.0...

CVE-2025-4774

The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-countdown attribute of Countdown widget in all versions up to, and including, 4.11.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

WordPress WPGYM plugin <= 65.0 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by Aiden Thái An in WordPress Plugin WPGYM versions = 65.0...

CVE-2025-3076

The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘buttontext’ parameter in all versions up to, and including, 3.29.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...