CVE-2024-13866

CVE-2024-13866 : The WordPress plugin Simple Notification (versions ≤ 1.3) is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. Exploitation requires at least authenticated administrator-level access and can affect pages on multisite installatio...

CVE-2025-1008 Recently Purchased Products For Woo <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via view Parameter

The Recently Purchased Products For Woo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘view’ parameter in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-13350

CVE-2024-13350 affects the WordPress plugin SearchIQ – The Search Solution, specifically the siq_searchbox shortcode. The vulnerability is stored Cross-Site Scripting caused by insufficient input sanitization and output escaping on user-supplied attributes in versions up to and including 4.7. Exp...

WordPress plugin Content Control 信息泄露漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An information disclosure...

WordPress plugin WP Real Estate Manager 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

WordPress ACF City Selector 1.14.0 Shell Upload

WordPress ACF City Selector plugin version 1.14.0 suffers from a remote shell upload vulnerability. ============================================================================================================================================= | Title : WordPress ACF City Selector plugin versions...

WordPress Homey plugin <= 2.4.2 - Unauthenticated Privilege Escalation in homey_save_profile vulnerability

Unauthenticated Privilege Escalation in homeysaveprofile vulnerability discovered by Tonn in WordPress Theme Homey versions = 2.4.2...

Important: Red Hat Security Advisory: Red Hat Product OCP Tools 4.17 Openshift Jenkins security update

An update for Openshift Jenkins is now available for Red Hat Product OCP Tools 4.17. Red Hat Product Security has rated this update as having a security impact of important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2024-13685 Admin and Site Enhancements (ASE) < 7.6.10 - Limit Login Attempt Bypass via IP Spoofing

The Admin and Site Enhancements ASE WordPress plugin before 7.6.10 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate their value to bypass the login limit feature in the Admin and Site Enhancements ASE WordPress plugin before 7.6.10...

CVE-2025-1639

The CVE-2025-1639 issue affects the WordPress plugin Animation Addons for Elementor Pro (versions up to 1.6). A missing capability check in install_elementor_plugin_handler() allows authenticated users with Subscriber-level access and above to install and activate arbitrary plugins, potentially c...

WordPress Ultimate Auction plugin <= 4.2.9 - Missing Authorization to Arbitrary Post Deletion vulnerability

Missing Authorization to Arbitrary Post Deletion vulnerability discovered by Brian Sans-Souci liardom in WordPress Plugin Ultimate Auction versions = 4.2.9...

WordPress plugin VW Storefront 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

WordPress plugin teachPress SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin...

PT-2025-9590

Name of the Vulnerable Software and Affected Versions Donations Widget plugin for WordPress versions up to, and including, 3.19.4 Description The issue arises from improper handling of user-supplied data within the donation form, particularly in the card address parameter. This flaw allows...

CVE-2025-27268 WordPress Small Package Quotes – Worldwide Express Edition Plugin <= 5.2.18 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in enituretechnology Small Package Quotes – Worldwide Express Edition small-package-quotes-wwe-edition allows SQL Injection.This issue affects Small Package Quotes – Worldwide Express Edition: from n/...

CVE-2025-26540 WordPress Helloprint Plugin <= 2.0.7 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in NotFound Helloprint allows Path Traversal. This issue affects Helloprint: from n/a through 2.0.7...

CVE-2025-26586 WordPress Events Planner Plugin <= 1.3.10 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in abelony Events Planner events-planner allows Reflected XSS.This issue affects Events Planner: from n/a through = 1.3.10...

CVE-2025-25130 WordPress Delete Comments By Status plugin <= 1.5.3 - Local File Inclusion vulnerability

Relative Path Traversal vulnerability in NotFound Delete Comments By Status allows PHP Local File Inclusion. This issue affects Delete Comments By Status: from n/a through 2.1.1...

CVE-2025-25118 WordPress WPOptin plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Danish Ali Malik Top Bar – PopUps – by WPOptin wpoptin allows Reflected XSS.This issue affects Top Bar – PopUps – by WPOptin: from n/a through = 2.0.8...

CVE-2025-25113 WordPress Implied Cookie Consent plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Senktec Implied Cookie Consent implied-cookie-consent allows Reflected XSS.This issue affects Implied Cookie Consent: from n/a through = 1.3...