CVE-2024-13665

The CVE CVE-2024-13665 affects the Admire Extra WordPress plugin (versions up to 1.6). It is a Stored XSS via the space shortcode due to insufficient input sanitization/output escaping for authenticated users with Contributor+ privileges. Impact: arbitrary script injection on pages viewed by user...

CVE-2025-0808 Houzez Property Feed <= 2.4.21 - Cross-Site Request Forgery to Property Feed Export Deletion

The Houzez Property Feed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.21. This is due to missing or incorrect nonce validation on the "deleteexport" action. This makes it possible for unauthenticated attackers to delete property feed...

WordPress plugin ShipEngine Shipping Quotes SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...

Multilang Contact Form Plugin for WordPress Cross-Site Scripting

The WordPress Multilang Contact Form Plugin installed on the remote host is affected by a Cross-Site Scripting XSS vulnerability. Note that the scanner has not tester for these issues but has instead relied only the application's self-reported version number. No source data...

PT-2025-6444 · WordPress · The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin

Name of the Vulnerable Software and Affected Versions: The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress versions up to, and including, 1.0.5 Description: The issue allows unauthenticated attackers to extract sensitive data stored insecurely in the...

WordPress plugin Admire Extra 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress ShipEngine Shipping Quotes plugin <= 1.0.7 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Colin Xu in WordPress Plugin ShipEngine Shipping Quotes versions = 1.0.7...

WordPress Admire Extra plugin <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by SOPROBRO in WordPress Plugin Admire Extra versions = 1.6...

WordPress Marketing Automation Plugin <= 1.2.6.8 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Marketing Automation versions = 1.2.6.8...

PT-2025-28690 · Irfanview · Irfanview +1

Name of the Vulnerable Software and Affected Versions: IrfanView CADImage Plugin affected versions not specified Description: The vulnerability resides within the DWG File Parser component of the CADImage plugin for IrfanView, a graphics, video, and audio file viewer and player. The issue is an...

WordPress plugin Stray Random Quotes 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin.... A security vulnerability...

PT-2025-28686 · Irfanview · Irfanview +1

Name of the Vulnerable Software and Affected Versions: IrfanView CADImage Plugin affected versions not specified Description: A memory corruption issue exists in the DWG File Parser component of the CADImage plugin for IrfanView, a graphics, video, and audio file viewer and player. The issue is d...

PT-2025-28674 · Irfanview · Irfanview +1

Name of the Vulnerable Software and Affected Versions: IrfanView CADImage Plugin affected versions not specified Description: The issue resides in the CADImage plugin for IrfanView, a graphics, video, and audio file viewer and player. The vulnerability is an out-of-bounds write in memory when...

PT-2025-28692 · Irfanview +1 · Irfanview +1

Name of the Vulnerable Software and Affected Versions: IrfanView CADImage Plugin affected versions not specified Description: The IrfanView CADImage Plugin contains a flaw in its DWG file parser component related to an out-of-bounds read memory error. Successful exploitation of this issue could...

PT-2025-28667 · Irfanview · Irfanview +1

Name of the Vulnerable Software and Affected Versions: IrfanView CADImage Plugin affected versions not specified Description: The IrfanView CADImage plugin contains a buffer overflow issue in memory when handling DXF files. Successful exploitation of this issue could allow an attacker to execute...

CVE-2024-13011

The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'uploadpublisherprofileimage' function in versions up to, and including, 4.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affect...

CVE-2024-13010

The WP Foodbakery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.8 due to insufficient input sanitization and output escaping on the 'searchtype' parameter. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

CVE-2024-13011 WP Foodbakery <= 4.7 - Unauthenticated Arbitrary File Upload

The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'uploadpublisherprofileimage' function in versions up to, and including, 4.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affect...

WordPress CMS Tree Page View Plugin < 1.4 Authorization Bypass Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:cmstreepageviewproject:cmstreepageview"; ifdescription...

WordPress File Manager Plugin < 7.2.6 Directory Traversal Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:webdesi9:filemanager"; if description...