WordPress SurveyJS plugin <= 1.12.20 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by theviper17 in WordPress Plugin SurveyJS versions = 1.12.20...

WordPress Doppler Forms plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Doppler Forms versions = 2.5.1...

WordPress Beds24 Online Booking plugin <= 2.0.28 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro Soares de Alcântara Kinorth in WordPress Plugin Beds24 Online Booking versions = 2.0.28...

WordPress VG WooCarousel plugin <= 1.3 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by muhammad yudha in WordPress Plugin VG WooCarousel versions = 1.3...

WordPress Daisycon prijsvergelijkers plugin <= 4.8.4 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Daisycon prijsvergelijkers versions = 4.8.4...

WordPress MasterStudy LMS plugin <= 3.5.28 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by LVT-tholv2k in WordPress Plugin MasterStudy LMS versions = 3.5.28...

WordPress URL Shortify Plugin <= 1.10.5.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Malvin Valerian Gultom in WordPress Plugin URL Shortify versions = 1.10.5.1...

WordPress Posts Footer Manager plugin <= 2.2.0 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by timomangcut in WordPress Plugin Posts Footer Manager versions = 2.2.0...

WordPress Behance Portfolio Manager plugin <= 1.7.5 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Tri Doan in WordPress Plugin Behance Portfolio Manager versions = 1.7.5...

WordPress Easy Query – WP Query Builder plugin <= 2.0.4 - SQL Injection Vulnerability

SQL Injection Vulnerability discovered by Le Ngoc Anh in WordPress Plugin Easy Query – WP Query Builder versions = 2.0.4...

CVE-2025-22282 WordPress ez Form Calculator Premouium plugin <= 2.14.1.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in keksdieb ez Form Calculator Premium ez-form-calculator-premium allows Reflected XSS.This issue affects ez Form Calculator Premium: from n/a through = 2.14.1.2...

CVE-2024-12410

The Front End Users plugin for WordPress is vulnerable to SQL Injection via the 'UserSearchField' parameter in all versions up to, and including, 3.2.32 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVE-2025-3063

The Shopper Approved Reviews plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the ajaxcallbackupdatesaoption function in versions 2.0 to 2.1. This makes it possible for authenticated attackers, with...

CVE-2025-2005

The Front End Users plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the file uploads field of the registration form in all versions up to, and including, 3.2.32. This makes it possible for unauthenticated attackers to upload arbitrary files on t...

CVE-2025-3105

The Vehica Core plugin for WordPress, used by the Vehica - Car Dealer & Listing WordPress Theme, is vulnerable to privilege escalation in all versions up to, and including, 1.0.97. This is due to the plugin not properly validating user meta fields prior to updating them in the database. This make...

CVE-2025-2836

The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘paymentmethod’ parameter in all versions up to, and including, 6.0.4.3 due to insufficient input sanitization and output escapin...

CVE-2024-13645

The tagDiv Composer plugin for WordPress is vulnerable to PHP Object Instantiation in all versions up to, and including, 5.3 via module parameter. This makes it possible for unauthenticated attackers to Instantiate a PHP Object. No known POP chain is present in the vulnerable software, which mean...

CVE-2025-2270

CVE-2025-2270 affects the Countdown, Coming Soon, Maintenance – Countdown & Clock WordPress plugin (all versions up to 2.8.9.1). Root cause: Local File Inclusion via createCdObj, enabling unauthenticated file inclusion and potential PHP code execution. Impact reported as code execution and data a...

CVE-2025-2270 Countdown, Coming Soon, Maintenance – Countdown & Clock <= 2.8.9.1 - Unauthenticated Limited Local File Inclusion

The Countdown, Coming Soon, Maintenance – Countdown & Clock plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.9.1 via the createCdObj function. This makes it possible for unauthenticated attackers to include and execute files with the specific...

CVE-2024-13898

CVE-2024-13898 concerns the WordPress plugin “Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website.” The connected documents confirm a Stored Cross-Site Scripting vulnerability caused by insufficient input sanitization and output escapi...