WordPress HT Mega Plugin plugin <= 2.9.0 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Denver Jackson in WordPress Plugin HT Mega versions = 2.9.0...

WordPress Button Block Plugin plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Button Block versions = 1.2.0...

WordPress JetTabs Plugin plugin <= 2.2.9.1 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by stealthcopter in WordPress Plugin JetTabs versions = 2.2.9.1...

WordPress Integration for Contact Form 7 and Constant Contact Plugin plugin <= 1.1.7 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Nabil Irawan in WordPress Plugin Integration for Contact Form 7 and Constant Contact versions = 1.1.7...

WordPress Connector for Gravity Forms and Google Sheets Plugin plugin <= 1.2.4 - Open Redirection Vulnerability

Open Redirection Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Connector for Gravity Forms and Google Sheets versions = 1.2.4...

WordPress Photo Engine Plugin plugin <= 6.4.3 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Photo Engine versions = 6.4.3...

WordPress myCred plugin <= 2.9.4.3 - Race Condition Vulnerability

Race Condition Vulnerability discovered by Esteban Montes Morales in WordPress Plugin myCred versions = 2.9.4.3...

WordPress Realtyna Organic IDX plugin <= 5.0.0 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by LVT-tholv2k in WordPress Plugin Realtyna Organic IDX plugin versions = 5.0.0...

WordPress Content Egg plugin <= 7.0.0 - PHP Object Injection Vulnerability

PHP Object Injection Vulnerability discovered by timomangcut in WordPress Plugin Content Egg versions = 7.0.0...

CVE-2025-5684

The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the mf-template DOM Element in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it...

WordPress Paid Member Subscriptions <= 2.15.4 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by LVT-tholv2k in WordPress Plugin Paid Member Subscriptions versions = 2.15.4...

CVE-2025-8196

The Magical Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Custom Attributes in all versions up to, and including, 1.3.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-6730

The Bonanza – WooCommerce Free Gifts Lite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the xlooptincall function in all versions up to, and including, 1.0.0. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2025-6681

CVE-2025-6681 refers to a Stored Cross‑Site Scripting vulnerability in the WordPress plugin Fan Page (versions up to 1.0.1). The issue arises from insufficient input sanitization and output escaping on the width parameter, allowing authenticated users with Contributor-level access or higher to in...

CVE-2025-8196

CVE-2025-8196 concerns the WordPress plugin Magical Addons For Elementor (versions up to and including 1.3.8). The vulnerability is a Stored Cross-Site Scripting (Stored XSS) in the plugin’s Custom Attributes, caused by insufficient input sanitization and output escaping. Exploitation requires an...

CVE-2025-3075 Elementor <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'elementor-element' shortcode in all versions up to, and including, 3.29.0 due to insufficient input sanitization and output escaping on user supplied...

CVE-2025-3075 Elementor <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'elementor-element' shortcode in all versions up to, and including, 3.29.0 due to insufficient input sanitization and output escaping on user supplied...

CVE-2025-7810

The StreamWeasels Kick Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'data-uuid' attribute in all versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fo...

CVE-2025-7810

CVE-2025-7810 concerns the StreamWeasels Kick Integration plugin for WordPress (versions up to and including 1.1.4). The vulnerability is a Stored Cross-Site Scripting flaw via the plugin’s data-uuid attribute caused by insufficient input sanitization and output escaping. Exploitation requires au...

PT-2025-31185 · Automattic +1 · Woocommerce +1

Name of the Vulnerable Software and Affected Versions: Bonanza – WooCommerce Free Gifts Lite plugin versions up to and including 1.0.0 Description: The Bonanza – WooCommerce Free Gifts Lite plugin for WordPress is susceptible to unauthorized data modification because of a missing capability check...