CVE-2025-22645 WordPress Real Estate Manager plugin <= 7.3 - Captcha Bypass Vulnerability vulnerability

Improper Restriction of Excessive Authentication Attempts vulnerability in Rameez Iqbal Real Estate Manager real-estate-manager allows Password Brute Forcing.This issue affects Real Estate Manager: from n/a through = 7.3...

CVE-2024-13783

CVE-2024-13783 affects the FormCraft WordPress plugin (all versions up to 3.9.11). The issue is a missing capability check in formcraft-main.php that allows authenticated users with Subscriber-level access and above to export all plugin data from form submissions. This is an unauthorized data acc...

CVE-2025-0521

CVE-2025-0521 (Post SMTP – WordPress) The WordPress Post SMTP plugin is vulnerable to stored XSS via the from and subject parameters in all versions up to 3.0.2 due to insufficient input sanitization and output escaping. The issue is exploitable by unauthenticated attackers, who can inject web sc...

CVE-2024-13395

CVE-2024-13395 affects the Threepress WordPress plugin (Threepress shortcode) up to version 1.7.1. The vulnerability is stored XSS due to insufficient input sanitization and output escaping on user-supplied shortcode attributes, allowing authenticated contributors+ to inject scripts on pages that...

CVE-2024-13316

CVE-2024-13316 affects the Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more plugin for WordPress. The issue is an unauthorized access vulnerability caused by a missing capability check in the apmswn_create_discount() function, present in...

CVE-2024-11376

The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 241114...

CVE-2024-13795

CVE-2024-13795 affects Ecwid by Lightspeed Ecommerce Shopping Cart for WordPress. Vulnerability: Cross-Site Request Forgery due to missing/incorrect nonce validation in ecwid_deactivate_feedback(). Impact: unauthenticated attacker can trigger deactivation messages on behalf of the site owner by d...

CVE-2024-11376 s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions <= 241216 - Reflected Cross-Site Scripting

The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 241114...

CVE-2024-13315

The Shopwarden – Automated WooCommerce monitoring & testing plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.11. This is due to missing or incorrect nonce validation on the savesetting function. This makes it possible for unauthenticated...

CVE-2024-13438

The SpeedSize Image & Video AI-Optimizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.1. This is due to missing or incorrect nonce validation on the 'speedsizeclearcsscacheaction' function. This makes it possible for unauthenticated...

Regular Expression Denial Of Service (ReDoS)

@octokit/plugin-paginate-rest is vulnerable to Regular Expression Denial Of Service ReDoS. The vulnerability is due to improper handling of the link parameter in the headers section of the request, which allows a specially crafted input to exploit the regular expression logic and trigger a denial...

CVE-2024-13315

CVE-2024-13315 affects the Shopwarden plugin for WordPress (≤1.0.11). The issue is Cross-Site Forgery via missing nonce validation in save_setting(), enabling unauthenticated attackers to update arbitrary options and potentially escalate privileges by tricking an admin into performing actions. CV...

CVE-2025-0805

The Mortgage Calculator / Loan Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mlcalc' shortcode in all versions up to, and including, 1.5.20 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possib...

CVE-2024-13852

The Option Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing nonce validation on the pluginpage function. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site via a forged request, grant...

CVE-2024-13687

The Team Builder – Meet the Team plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveteambuilderoptions function in all versions up to, and including, 1.3. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2024-13573

The Zigaform – Form Builder Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'zgfmrfvar' shortcode in all versions up to, and including, 7.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-13578

The WP-BibTeX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'WpBibTeX' shortcode in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-13582 Simple Pricing Tables For WPBakery Page Builder(Formerly Visual Composer) <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Simple Pricing Tables For WPBakery Page BuilderFormerly Visual Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wdosimplepricingtablefree' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping...

CVE-2024-13609 1 Click WordPress Migration Plugin – 100% FREE for a limited time <= 2.2 - Unauthenticated Sensitive Information Exposure via Database Backup in class-ocm-backup.php

The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2 via the class-ocm-backup.php. This makes it possible for unauthenticated attackers to extract sensitive data includi...

CVE-2024-13555 1 Click WordPress Migration Plugin – 100% FREE for a limited time <= 2.2 - Cross-Site Request Forgery to Backup Process Cancellation

The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2. This is due to missing or incorrect nonce validation on the cancelactions function. This makes it possible for...