16087 matches found
CVE-2025-58849 WordPress Hide Real Download Path Plugin <= 1.6 - Cross Site Request Forgery (CSRF) Vulnerability
Cross-Site Request Forgery CSRF vulnerability in Deepak S Hide Real Download Path hide-real-download-path allows Stored XSS.This issue affects Hide Real Download Path: from n/a through = 1.6...
CVE-2025-58840 WordPress Custom Team Manager Plugin <= 2.4.2 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ibnul H. Custom Team Manager custom-team-manager allows Stored XSS.This issue affects Custom Team Manager: from n/a through = 2.4.2...
CVE-2025-58838
CVE-2025-58838 affects the WordPress plugin Smooth Accordion, vulnerable through a stored cross-site scripting (XSS) flaw caused by improper input neutralization during web page generation. Affected versions are up to 2.1; the available connected sources indicate no explicit exploitation details ...
CVE-2025-58834 WordPress short.io Plugin <= 2.4.2 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in gugu short.io wp-shortcm allows DOM-Based XSS.This issue affects short.io: from n/a through = 2.4.2...
CVE-2025-58832
CVE-2025-58832 corresponds to a stored XSS in the WordPress plugin Search by Google (versions
CVE-2025-58826
CVE-2025-58826 concerns the WordPress plugin WP Publication Archive (versions up to 3.0.1). The vulnerability is an XSS (Stored) due to improper input neutralization during web page generation, allowing injected script to persist in pages generated by the plugin. The entry explicitly notes the af...
CVE-2025-58822
CVE-2025-58822 is a DOM-based XSS vulnerability in the WordPress WP Mail plugin, affecting versions from n/a up to and including 1.3. The root cause is improper neutralization of input during web page generation. The CVE details come from multiple sources (NVD/CVE listings) and are reinforced by ...
CVE-2025-58820
CVE-2025-58820 affects the WordPress plugin Themepoints Carousel Ultimate (versions up to 1.8). It is a Stored XSS due to improper input neutralization during web page generation. The vulnerability is documented with a Medium severity (CVSS 3.1 base 5.9) and currently listed as Unpatched; no expl...
CVE-2025-58818
CVE-2025-58818 is a CSRF vulnerability in the WordPress plugin Developer Tools Blocker (SwiftNinjaPro) affecting versions up to 3.2.1. Technical details across sources confirm CSRF as the root cause and that exploitation could enable actions on behalf of authenticated users. Mitigation: update to...
CVE-2025-58811 WordPress Ultimate Client Dash Plugin <= 4.7 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP CodeUs Ultimate Client Dash ulimate-client-dash allows Stored XSS.This issue affects Ultimate Client Dash: from n/a through = 4.7...
CVE-2025-58808 WordPress prettyPhoto Plugin <= 1.2.5 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Babar prettyPhoto prettyphoto allows Stored XSS.This issue affects prettyPhoto: from n/a through = 1.2.5...
CVE-2025-58804 WordPress WooCommerce Single Page Checkout Plugin <= 1.2.7 - Cross Site Request Forgery (CSRF) Vulnerability
Cross-Site Request Forgery CSRF vulnerability in brijrajs WooCommerce Single Page Checkout woo-single-page-checkout allows Cross Site Request Forgery.This issue affects WooCommerce Single Page Checkout: from n/a through = 1.2.7...
CVE-2025-58799
CVE-2025-58799 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the WordPress plugin Custom WooCommerce Checkout Fields Editor (themelocation) up to version 1.3.4. The issue is confirmed by multiple sources in the connected documents (Patchstack, CVE records, Red Hat advisory refere...
CVE-2025-58798
CVE-2025-58798 describes a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin BCM Duplicate Menu by Bjorn Manintveld. Public details indicate the flaw affects BCM Duplicate Menu versions up to 1.1.2, enabling CSRF for authenticated users. The issue is corroborated across mult...
CVE-2025-58797 WordPress Ninja Charts plugin <= 3.3.5 - Sensitive Data Exposure vulnerability
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Mahmudul Hasan Arif Ninja Charts ninja-charts allows Retrieve Embedded Sensitive Data.This issue affects Ninja Charts: from n/a through = 3.3.5...
CVE-2025-58793 WordPress WPB Elementor Addons plugin <= 1.7 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPBean WPB Elementor Addons wpb-elementor-addons allows Stored XSS.This issue affects WPB Elementor Addons: from n/a through = 1.7...
CVE-2025-58794 WordPress Notification for Telegram plugin <= 3.5 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in rainafarai Notification for Telegram notification-for-telegram allows Cross Site Request Forgery.This issue affects Notification for Telegram: from n/a through = 3.5...
CVE-2025-58791
CVE-2025-58791 : WordPress SEO Auto Linker plugin (
CVE-2025-58790 WordPress Kiwi Plugin <= 2.1.8 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPKube Kiwi kiwi-social-share allows Stored XSS.This issue affects Kiwi: from n/a through = 2.1.8...