CVE-2025-8215

The Responsive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-9850

The Evenium WordPress plugin (versions

WordPress BeyondCart Connector plugin <= 3.0.1 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by kr0d in WordPress Plugin BeyondCart Connector versions = 3.0.1...

WordPress plugin Salon Booking System 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exist...

WordPress plugin Publish approval 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

WordPress plugin Time Tracker 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2025-9463

The Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 1.117.5 due to insufficient escaping on the user supplied parameter and...

CVE-2025-10040

The CVE-2025-10040 entry concerns the WordPress plugin WP Import – Ultimate CSV XML Importer. Affected: plugin versions up to 7.27. Issue: missing capability check on the get_ftp_details AJAX action, enabling authenticated users with Subscriber-level access and above to disclose configured SFTP/F...

WordPress plugin PowerPack Elementor Addons (Free Widgets, Extensions and Templates) 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress...

WordPress WooCommerce Booking Bundle Hours Plugin <= 0.7.4 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin WooCommerce Booking Bundle Hours versions = 0.7.4...

CVE-2025-58975

CVE-2025-58975 describes a CSRF vulnerability in the WordPress plugin “Advanced Settings” (Helmut Wandl Advanced Settings). Affected versions are listed as n/a through 3.1.1. The CVE entry notes a CSRF flaw that could allow an attacker to perform actions on behalf of an authenticated user. The CV...

CVE-2025-58981 WordPress Accessibility Checker by Equalize Digital Plugin <= 1.31.0 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Equalize Digital Accessibility Checker by Equalize Digital allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Accessibility Checker by Equalize Digital: from n/a through 1.31.0...

CVE-2025-58980 WordPress Export WP Page to Static HTML/CSS Plugin <= 4.1.0 - Broken Access Control Vulnerability

Missing Authorization vulnerability in recorp Export WP Page to Static HTML/CSS export-wp-page-to-static-html allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Export WP Page to Static HTML/CSS: from n/a through = 4.1.0...

CVE-2025-58985

CVE-2025-58985 concerns the WordPress plugin Additional Custom Product Tabs for WooCommerce where versions up to and including 1.7.3 are affected by a Stored Cross-Site Scripting (XSS) vulnerability caused by improper input neutralization during web page generation. The issue is attributed to WPF...

CVE-2025-58987

CVE-2025-58987 maps to the WordPress Football Pool plugin vulnerability: stored Cross‑Site Scripting in AntoineH Football Pool up to version 2.12.6. The issue arises from improper input neutralization during web page generation, enabling stored XSS (authenticated attackers with at least Subscribe...

CVE-2025-58990 WordPress ShopLentor Plugin <= 3.2.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in HasTech ShopLentor allows Stored XSS. This issue affects ShopLentor: from n/a through 3.2.0...

CVE-2025-58993 WordPress Tutor LMS Plugin <= 3.7.4 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Themeum Tutor LMS tutor allows SQL Injection.This issue affects Tutor LMS: from n/a through = 3.7.4...

CVE-2025-58993

CVE-2025-58993 affects the WordPress Tutor LMS plugin (Themeum Tutor LMS) up to version 3.7.4. It is a SQL Injection vulnerability caused by improper neutralization of input in SQL queries. CVSS v3.1 base score 7.6 (HIGH) with network attack vector, no user interaction, and high confidentiality i...

CVE-2025-47695

CVE-2025-47695 affects WordPress Blog Designer PRO (plugin)

PT-2025-36773

Name of the Vulnerable Software and Affected Versions: Awesome Support versions through 6.3.4 Description: A missing authorization flaw exists in Awesome Support. The issue potentially exposes low-confidentiality data. Recommendations: Update Awesome Support to a version newer than 6.3.4, if...