CVE-2025-4689

The CVE-2025-4689 entry concerns Ads Pro Plugin for WordPress (Advertising Manager). The connected sources confirm a vulnerability chain: an unauthenticated Local File Inclusion (LFI) that can lead to Remote Code Execution (RCE), triggered by a prior SQL Injection, within all versions up to 4.89....

PT-2025-27588 · WordPress · Soumettre.Fr

Name of the Vulnerable Software and Affected Versions: Soumettre.fr plugin for WordPress versions up to, and including, 2.1.5 Description: The issue is related to improper authorization checks on the make signature function, allowing unauthorized access and modification of data. This enables...

WordPress plugin Ads Pro SQL注入漏洞

WordPress Ads Pro is a multi-purpose ad management plugin, mainly used for flexible management of ad space in WordPress websites, supporting banner ad display, billing mode settings and user-friendly ad placement solutions. WordPress ads pro suffers from a SQL injection vulnerability that stems...

PT-2025-27592 · WordPress · Drag/Drop Multiple File Upload

Name of the Vulnerable Software and Affected Versions: Drag and Drop Multiple File Upload Pro - WooCommerce plugin for WordPress versions 1.7.1 and earlier Drag and Drop Multiple File Upload Pro - WooCommerce plugin for WordPress versions 5.0 through 5.0.5 when bundled with the PrintSpace theme...

PT-2025-27586 · WordPress · The Ads Pro Plugin

Name of the Vulnerable Software and Affected Versions: The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager versions up to, and including, 4.89 Description: The issue allows unauthenticated attackers to include and execute arbitrary files on the server via the bsa template parameter o...

PT-2025-27597 · WordPress · Magic Buttons For Elementor

Name of the Vulnerable Software and Affected Versions: Magic Buttons for Elementor plugin for WordPress versions up to, and including, 1.0 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on user-supplied attributes in the...

WordPress Forminator plugin <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion vulnerability

Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin Forminator versions = 1.44.2...

WordPress Soumettre.fr plugin <= 2.1.5 - Improper Authorization to Unauthenticated Soumettre Posts Creation/Modification/Deletion vulnerability

Improper Authorization to Unauthenticated Soumettre Posts Creation/Modification/Deletion vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Soumettre.fr versions = 2.1.5...

WordPress CSS3 Vertical Web Pricing Tables plugin <= 1.9 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin CSS3 Vertical Web Pricing Tables versions = 1.9...

CVE-2025-49029 WordPress Custom Login And Signup Widget plugin <= 1.0 - Arbitrary Code Execution vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in bitto.kazi Custom Login And Signup Widget custom-login-and-signup-widget allows Code Injection.This issue affects Custom Login And Signup Widget: from n/a through = 1.0...

WordPress Custom Login And Signup Widget plugin <= 1.0 - Arbitrary Code Execution vulnerability

Arbitrary Code Execution vulnerability discovered by Bao Patchstack Alliance in WordPress Plugin Custom Login And Signup Widget versions = 1.0...

WordPress SureForms plugin <= 1.7.3 - Unauthenticated Arbitrary File Deletion

Unauthenticated Arbitrary File Deletion vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin SureForms versions = 1.7.3...

WordPress Case Theme User < 1.0.4 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by Bonds Patchstack Alliance in WordPress Plugin Case Theme User versions 1.0.4...

WordPress Leyka plugin <= 3.32 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Leyka versions = 3.32...

WordPress Beautiful Cookie Consent Banner plugin <= 4.6.1 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Martin Herancourt in WordPress Plugin Beautiful Cookie Consent Banner versions = 4.6.1...

WordPress WooCommerce Product Multi-Action plugin <= 1.3 - Deserialization of untrusted data Vulnerability

Deserialization of untrusted data Vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin WooCommerce Product Multi-Action versions = 1.3...

WordPress WP Travel Gutenberg Blocks plugin <= 3.9.0 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by LVT-tholv2k in WordPress Plugin WP Travel Gutenberg Blocks versions = 3.9.0...

WordPress NGG Smart Image Search plugin <= 3.4.1 - SQL Injection Vulnerability

SQL Injection Vulnerability discovered by ch4r0n in WordPress Plugin NGG Smart Image Search versions = 3.4.1...

CVE-2025-6462

The EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's SQLREPORT shortcode in all versions up to, and including, 5.25.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes...

PT-2025-27522 · WordPress · The Dear Flipbook – Pdf Flipbook

Name of the Vulnerable Software and Affected Versions: The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress versions up to, and including, 2.3.65 Description: The issue is related to DOM-Based Reflected Cross-Site Scripting due to insufficient input sanitizati...