CVE-2025-8616

CVE-2025-8616 affects OpenText OpenText Advanced Authentication (versions up to and including 6.5.0). A malicious browser plugin can record and replay the user authentication process to bypass authentication, representing a replay attack against the login flow. The vulnerability’s root cause is t...

CVE-2025-7498

CVE-2025-7498 affects the WordPress plugin Exclusive Addons for Elementor . The vulnerability is a Stored Cross-Site Scripting (XSS) in the Countdown Widget, present in all versions up to and including 2.7.9.4, caused by insufficient input sanitization and output escaping. authenticated attackers...

CVE-2025-8100 Element Pack Elementor Addons and Templates <= 8.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map Widget Marker Content

The Element Pack Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'markercontent' parameter in versions up to, and including, 8.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

CVE-2025-8100

The CVE covers WordPress Element Pack Elementor Addons and Templates plugin (Element Pack) with a Stored Cross-Site Scripting vulnerability via the marker_content parameter in the Open Street Map widget, affected up to version 8.1.5. Root cause: insufficient input sanitization and output escaping...

CVE-2025-8420

Multiple plugins for WordPress by emarket-design with the 'emd-form-builder-lite' package are vulnerable to Remote Code Execution in various versions via the emdformbuilderlitepagenum function. This is due to the plugin not properly validating user input before using it as a function name. This...

CVE-2025-6256 Flex Guten <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via thumbnailHoverEffect Parameter

The Flex Guten plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘thumbnailHoverEffect’ parameter in all versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

WordPress plugin Betheme 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-32118 · WordPress · Gutenverse

Name of the Vulnerable Software and Affected Versions: Gutenverse versions up to and including 3.1.0 Description: The Gutenverse plugin for WordPress is susceptible to Stored Cross-Site Scripting through the plugin’s Animated Text and Fun Fact blocks. Insufficient input sanitization and output...

WordPress Element Pack Elementor Addons plugin <= 8.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map Widget Marker Content vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Open Street Map Widget Marker Content vulnerability discovered by zer0gh0st in WordPress Plugin Element Pack Elementor Addons versions = 8.1.5...

WordPress Request a Quote Form plugin <= 2.5.2 - Unauthenticated Limited Remote Code Execution vulnerability

Unauthenticated Limited Remote Code Execution vulnerability discovered by mikemyers in WordPress Plugin Request a Quote versions = 2.5.2...

WordPress Flex Guten plugin <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via thumbnailHoverEffect Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via thumbnailHoverEffect Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin Flex Guten versions = 1.2.5...

CVE-2012-10026 WordPress Plugin Asset-Manager <= 2.0 PHP File Upload

The WordPress plugin Asset-Manager version 2.0 and below contains an unauthenticated arbitrary file upload vulnerability in upload.php. The endpoint fails to properly validate and restrict uploaded file types, allowing remote attackers to upload malicious PHP scripts to a predictable temporary...

CVE-2013-10068 Foxit Reader <= 5.4.5.0114 Plugin URL Processing Buffer Overflow

Foxit Reader versions through 5.4.5.0114, including the bundled Foxit Reader Plugin 2.2.1.530, contains a stack-based buffer overflow vulnerability in the npFoxitReaderPlugin.dll module. When a PDF file is loaded from a remote host, an overly long query string in the URL can overflow a buffer,...

CVE-2025-5061

The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpieparseuploaddata' function in all versions up to, and including, 3.9.29. This makes it possible for authenticated attackers, with Subscriber-level access and above...

CVE-2025-8315

The WP Easy Contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccessmsg’ parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2025-7050

The Use-your-Drive | Google Drive plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in file metadata in all versions up to, and including, 3.3.1 due to insufficient input sanitization and output escaping. This makes it possible for...

WordPress plugin WP Import Export Lite 代码问题漏洞

WordPress WP Import Export Lite plugin is the official WordPress recommended import and export plugin that supports batch processing of site data, including posts, pages, taxonomies, comments and user data, etc. It supports a variety of file formats such as CSV, JSON, XML and so on. WordPress WP...

PT-2025-31979

Name of the Vulnerable Software and Affected Versions WP-Property versions prior to 1.36.0 Description The WP-Property plugin for WordPress through version 1.35.0 contains a file upload issue in the uploadify.php script. A remote attacker can upload arbitrary PHP files to a temporary directory...

PT-2025-31913 · WordPress · Wp Import Export Lite

Name of the Vulnerable Software and Affected Versions: WP Import Export Lite versions through 3.9.28 Description: The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wpie tempalte import function. This allows...

PT-2025-31909 · WordPress · Wp Easy Contact

Name of the Vulnerable Software and Affected Versions: WP Easy Contact versions up to and including 4.0.1 Description: The WP Easy Contact plugin for WordPress is susceptible to stored cross-site scripting through the noaccess msg parameter. Insufficient input sanitization and output escaping all...