CVE-2025-31399 WordPress CG Scroll To Top plugin <= 3.5 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Chandan Garg CG Scroll To Top cg-scroll-to-top allows Stored XSS.This issue affects CG Scroll To Top: from n/a through = 3.5...

CVE-2025-31401 WordPress MMX – Make Me Christmas plugin <= 1.0.0 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in mmetrodw MMX – Make Me Christmas mmx-make-me-christmas allows Stored XSS.This issue affects MMX – Make Me Christmas: from n/a through = 1.0.0...

CVE-2025-32481 WordPress Nino Social Connect plugin <= 2.0 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in ninotheme Nino Social Connect nino-social-connect allows Stored XSS.This issue affects Nino Social Connect: from n/a through = 2.0...

CVE-2025-32496

CVE-2025-32496 is an Unpatched CSRF to Remote Code Execution in the WordPress plugin Ultra Demo Importer (versions up to 1.0.5). The vulnerability allows an attacker to perform CSRF to execute a web shell on the server, as documented in the vulnerability listing. The CVSSv3.1 base score is 9.6 (C...

CVE-2025-32505 WordPress MultiMailer plugin <= 1.0.3 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in SCAND MultiMailer allows Stored XSS. This issue affects MultiMailer: from n/a through 1.0.3...

CVE-2025-32547 WordPress All push notification for WP Plugin <= 1.5.3 - CSRF to SQL Injection vulnerability

Cross-Site Request Forgery CSRF vulnerability in gtlwpdev All push notification for WP all-push-notification allows Blind SQL Injection.This issue affects All push notification for WP: from n/a through = 1.5.3...

CVE-2025-32597 WordPress WordPress Events Calendar Plugin – connectDaily plugin <= 1.4.8 - CSRF to Cross-Site Scripting vulnerability

Cross-Site Request Forgery CSRF vulnerability in George Sexton WordPress Events Calendar Plugin – connectDaily allows Cross-Site Scripting XSS. This issue affects WordPress Events Calendar Plugin – connectDaily: from n/a through 1.4.8...

CVE-2025-32617

CVE-2025-32617 affects the WordPress plugin Multiple Location Google Map. The vulnerability is described as a Cross-Site Request Forgery (CSRF) that enables Stored XSS in versions up to 1.1 (vulnerable range: unspecified from n/a to 1.1). The CVSS 3.1 base score is 7.1 (HIGH), with network attack...

CVE-2025-32641 WordPress Anant Addons for Elementor plugin <= 1.1.8 - CSRF to Arbitrary Plugin Installation vulnerability

Cross-Site Request Forgery CSRF vulnerability in anantaddons Anant Addons for Elementor anant-addons-for-elementor allows Cross Site Request Forgery.This issue affects Anant Addons for Elementor: from n/a through = 1.1.8...

CVE-2025-32640

CVE-2025-32640 is a stored XSS in the WordPress plugin Ally – Web Accessibility & Usability (One Click Accessibility). The issue affects the One Click Accessibility component up to version 3.1.0 and requires authenticated access (Administrator+) to exploit. The connected Wordfence disclosure list...

CVE-2025-32642

CVE-2025-32642 is a CSRF-to-Remote Code Execution vulnerability in Vite Coupon. Affected software: Vite Coupon, reportedly vulnerable up to 1.0.9 (initial says up to 1.0.7). CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H; base score 10.0. Patch status: Unpatched per the connected documents; no re...

WordPress Link Shield plugin <= 0.5.4 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

CSRF to Stored Cross Site Scripting XSS vulnerability discovered by SOPROBRO in WordPress Plugin Link Shield versions = 0.5.4...

WordPress Multiple Location Google Map plugin <= 1.1 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by Abdi Pranata in WordPress Plugin Multiple Location Google Map versions = 1.1...

WordPress Czater.pl – live chat i telefon plugin <= 1.0.5 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

CSRF to Stored Cross Site Scripting XSS vulnerability discovered by Abdi Pranata in WordPress Plugin Czater.pl – live chat i telefon versions = 1.0.5...

WordPress One Click Accessibility plugin <= 3.1.0 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability discovered by Ayato Shitomi @ Fore-Z co.ltd in WordPress Plugin Ally versions = 3.1.0...

WordPress FraudLabs Pro for WooCommerce plugin <= 2.22.8 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by Nguyen Thi Huyen Trang - Skalucy in WordPress Plugin FraudLabs Pro for WooCommerce versions = 2.22.8...

WordPress Nepali Date Utilities plugin <= 1.0.15 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by Nguyen Thi Huyen Trang - Skalucy in WordPress Plugin Nepali Date Utilities versions = 1.0.15...

WordPress Epeken All Kurir plugin <= 2.0.6 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Epeken All Kurir versions = 2.0.6...

WordPress WP Show Stats plugin <= 1.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nabil Irawan in WordPress Plugin WP Show Stats versions = 1.5...

WordPress Accessibility Suite by Ability, Inc plugin <= 4.18 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Aiden Thái An in WordPress Plugin Accessibility Suite versions = 4.18...