WordPress Pagopar – WooCommerce Gateway plugin <= 2.7.1 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Pagopar – WooCommerce Gateway versions = 2.7.1...

WordPress Customize Login Page plugin <= 1.1 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability

Cross Site Request Forgery CSRF to Settings Change vulnerability discovered by Nguyen Thi Huyen Trang - Skalucy in WordPress Plugin Customize Login Page versions = 1.1...

WordPress Smart Product Gallery Slider plugin <= 1.0.4 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Smart Product Gallery Slider versions = 1.0.4...

WordPress Social Bookmarking RELOADED plugin <= 3.18 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Social Bookmarking RELOADED versions = 3.18...

WordPress WS Audio Player plugin <= 1.1.8 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by johska in WordPress Plugin WS Audio Player versions = 1.1.8...

WordPress NewsBoard Post and RSS Scroller plugin <= 1.2.12 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by johska in WordPress Plugin NewsBoard Post and RSS Scroller versions = 1.2.12...

WordPress WP-Easy Menu plugin <= 0.41 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by johska in WordPress Plugin WP-Easy Menu versions = 0.41...

WordPress WP SexyLightBox plugin <= 0.5.3 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by johska in WordPress Plugin WP SexyLightBox versions = 0.5.3...

WordPress Windows Live Writer plugin <= 0.1 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by johska in WordPress Plugin Windows Live Writer versions = 0.1...

WordPress WP Performance Pack plugin <= 2.5.4 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nabil Irawan in WordPress Plugin WP Performance Pack versions = 2.5.4...

WordPress Easy Post Duplicator Plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Le Ngoc Anh in WordPress Plugin Easy Post Duplicator versions = 1.0.1...

WordPress HTML5 Video Player with Playlist Plugin <= 2.50 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin HTML5 Video Player with Playlist versions = 2.50...

WordPress Workbox Video from Vimeo & Youtube Plugin Plugin <= 3.2.2 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Workbox Video from Vimeo & Youtube versions = 3.2.2...

WordPress Shop Products Filter Plugin <= 1.2 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by LVT-tholv2k in WordPress Plugin Shop Products Filter versions = 1.2...

WordPress MultiMailer plugin <= 1.0.3 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by thiennv in WordPress Plugin MultiMailer versions = 1.0.3...

WordPress Wishlist plugin <= 1.0.46 - SQL Injection vulnerability

SQL Injection vulnerability discovered by NAWardRox in WordPress Plugin Wishlist versions = 1.0.46...

WordPress WooCommerce Pickupp plugin <= 2.4.3 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by LVT-tholv2k in WordPress Plugin WooCommerce Pickupp versions = 2.4.3...

WordPress Ultimate Bootstrap Elements for Elementor plugin <= 1.4.9 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by LVT-tholv2k in WordPress Plugin Ultimate Bootstrap Elements for Elementor versions = 1.4.9...

CVE-2025-31008 WordPress YouTube Embed plugin <= 5.3.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Embeds For YouTube Plugin Support YouTube Embed youtube-embed allows Stored XSS.This issue affects YouTube Embed: from n/a through = 5.3.1...

CVE-2025-31390

CVE-2025-31390 is a CSRF-to-Stored XSS vulnerability in Social Crowd (WordPress plugin) affecting versions up to 0.9.6.1. The Wordfence vulnerability data (and referenced listing) confirm the issue and indicate the vulnerability remains Unpatched. Practical impact is stored XSS via CSRF, as descr...