WordPress plugin Video Url 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

API keys stored and displayed in plain text by asakusa-satellite-plugin

asakusa-satellite-plugin 0.1.1 and earlier stores AsakusaSatellite API keys unencrypted in job config.xml files on the Jenkins controller as part of its configuration. These API keys can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system...

CVE-2025-31619 WordPress Actionwear products sync plugin <= 2.3.3 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in marcoingraiti Actionwear products sync actionwear-products-sync allows SQL Injection.This issue affects Actionwear products sync: from n/a through = 2.3.3...

CVE-2025-31594 WordPress Auto scroll for reading plugin <= 1.1.4 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPglob Auto scroll for reading allows Reflected XSS. This issue affects Auto scroll for reading: from n/a through 1.1.4...

CVE-2025-31580 WordPress Ni WooCommerce Product Enquiry plugin <= 4.1.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in Anzar Ahmed Ni WooCommerce Product Enquiry ni-woocommerce-product-enquiry allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Ni WooCommerce Product Enquiry: from n/a through = 4.1.8...

CVE-2025-31580 WordPress Ni WooCommerce Product Enquiry plugin <= 4.1.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in Anzar Ahmed Ni WooCommerce Product Enquiry allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Ni WooCommerce Product Enquiry: from n/a through 4.1.8...

CVE-2025-31628

CVE-2025-31628 affects Sliced Invoices (WordPress Invoice Plugin) with a Missing Authorization flaw in versions up to 3.9.5; the WordFence entry indicates the patch status as Unpatched and does not provide exploit vectors or remediation details beyond noting the vulnerability type.

CVE-2025-31561 WordPress Ultimate Push Notifications plugin <= 1.2.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in CodeSolz Ultimate Push Notifications ultimate-push-notifications allows SQL Injection.This issue affects Ultimate Push Notifications: from n/a through = 1.2.0...

CVE-2025-31454 WordPress Delete Post Revision plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Arefly Delete Post Revision delete-post-revision allows Reflected XSS.This issue affects Delete Post Revision: from n/a through = 1.1...

CVE-2025-30825 WordPress WPC Smart Linked Products plugin <= 1.3.5 - Privilege Escalation vulnerability

Missing Authorization vulnerability in WPClever WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce wpc-smart-linked-products allows Privilege Escalation.This issue affects WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce: from n/a through = 1.3.5...

CVE-2025-30844

CVE-2025-30844 – Watu Quiz (WordPress) : The connected vulnerability record for Watu Quiz reports a reflected Cross-Site Scripting flaw caused by improper input neutralization during web page generation, affecting Watu Quiz versions from n/a through 3.4.2. The Wordfence entry confirms this CVE wi...

WordPress User Registration & Membership Pro plugin < 5.1.3 - Authentication Bypass vulnerability

Authentication Bypass vulnerability discovered by wesley wcraft in WordPress Plugin User Registration & Membership Pro versions 5.1.3...

WordPress Insert Headers and Footers Code – HT Script plugin <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update vulnerability

Missing Authorization to Authenticated Subscriber+ Limited Options Update vulnerability discovered by kr0d in WordPress Plugin Insert Headers and Footers Code – HT Script versions = 1.1.2...

WordPress SMS Alert Order Notifications – WooCommerce plugin <= 3.7.9 - Unauthenticated Account Takeover/Privilege Escalation vulnerability

Unauthenticated Account Takeover/Privilege Escalation vulnerability discovered by Lucio Sá in WordPress Plugin SMS Alert Order Notifications versions = 3.7.9...

WordPress Limit Max IPs Per User plugin <= 1.5 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by johska in WordPress Plugin Limit Max IPs Per User versions = 1.5...

WordPress News & Blog Designer Pack plugin <= 4.0 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin News & Blog Designer Pack versions = 4.0...

WordPress Enable Media Replace plugin <= 4.1.5 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Enable Media Replace versions = 4.1.5...

WordPress JSON Structuring Markup plugin <= 0.1 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by Abdi Pranata in WordPress Plugin JSON Structuring Markup versions = 0.1...

WordPress WP Profitshare Plugin <= 1.4.9 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by 0xd4rk5id3 in WordPress Plugin WP Profitshare versions = 1.4.9...

WordPress WP Crowdfunding plugin <= 2.1.15 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by theviper17 in WordPress Plugin WP Crowdfunding versions = 2.1.15...