WordPress plugin School Management System SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A SQL injection vulnerability exis...

CVE-2025-1672

The Notibar – Notification Bar for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-13897

The Moving Media Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the generatejsonpage function in all versions up to, and including, 1.22. This makes it possible for authenticated attackers, with Administrator-level access and abov...

WordPress Cookiebot plugin <= 4.4.1 - Missing Authorization to Authenticated (Subscriber+) Survey Submission vulnerability

Missing Authorization to Authenticated Subscriber+ Survey Submission vulnerability discovered by Peter Thaleikis in WordPress Plugin Cookiebot versions = 4.4.1...

CVE-2024-11153 Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More <= 2.5.0 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure

The Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5.0 via the WordPress core search feature. This makes it possible for...

CVE-2025-1702

CVE-2025-1702 affects the WordPress plugin Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin. It is a time-based SQL Injection via the search parameter in all versions up to 2.10.0 due to insufficient escaping and lack of proper query p...

CVE-2024-13471

CVE-2024-13471 affects DesignThemes Core Features for WordPress prior to patch/fix. The vulnerability arises from a missing capability check in dt_process_imported_file, allowing unauthenticated attackers to read arbitrary files on the server. Affected versions are DesignThemes Core Features

CVE-2025-1463 Spreadsheet Integration <= 3.8.2 - Cross-Site Request Forgery to Arbitrary Post Publish

The Spreadsheet Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.2. This is due to improper nonce validation within the class-wpgsi-show.php script. This makes it possible for unauthenticated attackers to publish arbitrary post...

CVE-2025-1463

CVE-2025-1463 affects Spreadsheet Integration (WordPress plugin) up to version 3.8.2. Root cause: improper nonce validation in class-wpgsi-show.php leading to Cross-Site Request Forgery. Impact: unauthenticated attackers can publish arbitrary posts (including private ones) if a site admin is tric...

CVE-2025-0956

The WooCommerce Recover Abandoned Cart plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 24.4.0 via deserialization of untrusted input from the 'raccookieguestemail' cookie. This makes it possible for unauthenticated attackers to inject a PHP Object...

CVE-2024-13787

The VEDA - MultiPurpose WordPress Theme theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.2 via deserialization of untrusted input in the 'vedabackupandrestoreaction' function. This makes it possible for authenticated attackers, with Subscriber-leve...

CVE-2024-13777

The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.91 via deserialization of untrusted input from the 'margs' parameter. This makes it possible for unauthenticated attackers to inject a PHP...

CVE-2024-13232

CVE-2024-13232 affects the WordPress plugin “WordPress Awesome Import & Export Plugin – Import & Export WordPress Data.” The vulnerability arises from a missing capability check in renderImport() across versions up to and including 4.1.1, enabling authenticated attackers with Subscriber-level acc...

CVE-2025-0954

CVE-2025-0954 affects the WordPress plugin “WP Online Contract”. The vulnerability is a missing capability check in json_import() and json_export() across all versions up to 5.1.4, allowing unauthenticated attackers to import/export the plugin’s settings. Public sources in the provided documents ...

CVE-2024-13780 Hero Mega Menu - Responsive WordPress Menu Plugin <= 1.16.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Directory Deletion

The Hero Mega Menu - Responsive WordPress Menu Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the hmenudeletemenu function in all versions up to, and including, 1.16.5. This makes it possible for unauthenticated attackers to delete...

CVE-2024-13777

The CVE-2024-13777 entry covers ZoomSounds – WordPress Wave Audio Player with Playlist (WordPress plugin) up to version 6.91. It is vulnerable to PHP Object Injection via deserialization of untrusted input in the margs parameter, allowing unauthenticated attackers to inject a PHP object. The base...

CVE-2025-0956 WooCommerce Recover Abandoned Cart <= 24.3.0 - Unauthenticated PHP Object Injection

The WooCommerce Recover Abandoned Cart plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 24.3.0 via deserialization of untrusted input from the 'raccookieguestemail' cookie. This makes it possible for unauthenticated attackers to inject a PHP Object...

CVE-2025-1008

The Recently Purchased Products For Woo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘view’ parameter in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-0990

The I Am Gloria plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.4. This is due to missing or incorrect nonce validation on the iamgloria23gloriasettingspage function. This makes it possible for unauthenticated attackers to reset the tenan...

CVE-2024-13350

The SearchIQ – The Search Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'siqsearchbox' shortcode in all versions up to, and including, 4.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible f...