CVE-2025-28982

CVE-2025-28982 concerns WordPress plugin WP Pipes (ThimPress WP Pipes). The vulnerability is an SQL Injection caused by improper neutralization of special elements in SQL commands, affecting WP Pipes versions up to 1.4.3. The CVSS data in the primary record indicates a CRITICAL impact with high c...

CVE-2025-47652 WordPress Infility Global plugin <= 2.13.4 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Infility Infility Global infility-global allows Reflected XSS.This issue affects Infility Global: from n/a through = 2.13.4...

CVE-2025-49031 WordPress SMu Manual DoFollow plugin <= 1.8.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Stefan M. SMu Manual DoFollow manuall-dofollow allows Reflected XSS.This issue affects SMu Manual DoFollow: from n/a through = 1.8.1...

CVE-2025-49884 WordPress Internal Linking of Related Contents plugin <= 1.1.8 - Broken Access Control Vulnerability

Missing Authorization vulnerability in alexvtn Internal Linking of Related Contents internal-linking-of-related-contents allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Internal Linking of Related Contents: from n/a through = 1.1.8...

CVE-2025-50028 WordPress Ultimate Push Notifications plugin <= 1.2.0 - Broken Access Control Vulnerability

Missing Authorization vulnerability in CodeSolz Ultimate Push Notifications ultimate-push-notifications allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Push Notifications: from n/a through = 1.2.0...

CVE-2025-49888 WordPress PW WooCommerce On Sale! plugin <= 1.39 - Broken Access Control Vulnerability

Missing Authorization vulnerability in pimwick PW WooCommerce On Sale! allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PW WooCommerce On Sale!: from n/a through 1.39...

CVE-2025-50028 WordPress Ultimate Push Notifications plugin <= 1.2.0 - Broken Access Control Vulnerability

Missing Authorization vulnerability in CodeSolz Ultimate Push Notifications ultimate-push-notifications allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Push Notifications: from n/a through = 1.2.0...

CVE-2025-49888 WordPress PW WooCommerce On Sale! plugin <= 1.39 - Broken Access Control Vulnerability

Missing Authorization vulnerability in pimwick PW WooCommerce On Sale! pw-woocommerce-on-sale allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PW WooCommerce On Sale!: from n/a through = 1.39...

WordPress Formality <= 1.5.9 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by astra.r3verii in WordPress Plugin Formality versions = 1.5.9...

WordPress JetSmartFilters <= 3.6.7 - Sensitive Data Exposure Vulnerability

Sensitive Data Exposure Vulnerability discovered by stealthcopter in WordPress Plugin JetSmartFilters versions = 3.6.7...

WordPress JetWooBuilder <= 2.1.20 - Sensitive Data Exposure Vulnerability

Sensitive Data Exposure Vulnerability discovered by stealthcopter in WordPress Plugin JetWooBuilder versions = 2.1.20...

WordPress JetEngine <= 3.7.0 - Sensitive Data Exposure Vulnerability

Sensitive Data Exposure Vulnerability discovered by stealthcopter in WordPress Plugin JetEngine versions = 3.7.0...

CVE-2025-48150

CVE-2025-48150 is a Missing Authorization / Broken Access Control vulnerability affecting the WordPress plugin “Real Estate Property 2024 Create Your Own Fields and Search Bar” (versions through 4.48). Multiple connected sources confirm that improper access control configuration can be exploited ...

CVE-2025-48155

CVE-2025-48155 concerns the WordPress plugin “Residential Address Detection” by enituretechnology. The issue is a Missing Authorization vulnerability that allows accessing functionality not properly constrained by ACLs, affecting versions through 2.5.9. The CVSS v3.1 base score is 5.3 (Medium), w...

CVE-2025-54047 WordPress Cost Calculator plugin <= 7.4 - Broken Access Control Vulnerability

Missing Authorization vulnerability in QuanticaLabs Cost Calculator ql-cost-calculator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cost Calculator: from n/a through = 7.4...

CVE-2025-54047 WordPress Cost Calculator plugin <= 7.4 - Broken Access Control Vulnerability

Missing Authorization vulnerability in QuanticaLabs Cost Calculator allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Cost Calculator: from n/a through 7.4...

CVE-2025-54035 WordPress Newsletters plugin <= 4.10 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in Tribulant Software Newsletters newsletters-lite allows Cross Site Request Forgery.This issue affects Newsletters: from n/a through = 4.10...

CVE-2025-54015 WordPress HT Contact Form 7 plugin <= 2.0.0 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in HT Plugins HT Contact Form 7 ht-contactform allows PHP Local File Inclusion.This issue affects HT Contact Form 7: from n/a through = 2.0.0...

CVE-2025-54013 WordPress Welcart e-Commerce plugin <= 2.11.16 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Stored XSS.This issue affects Welcart e-Commerce: from n/a through = 2.11.16...

CVE-2025-53994 WordPress JetPopup plugin <= 2.0.15 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetPopup jet-popup allows DOM-Based XSS.This issue affects JetPopup: from n/a through = 2.0.15...