PT-2025-25377 · WordPress · Wp Sliding Login/Dashboard Panel

Name of the Vulnerable Software and Affected Versions: WP Sliding Login/Dashboard Panel plugin versions up to, and including, 2.1.1 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the wp sliding panel user options function. This allo...

WordPress plugin Game Review Block 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists i...

PT-2025-25383

Name of the Vulnerable Software and Affected Versions The Traffic Monitor plugin for WordPress versions up to, and including, 3.2.2 Description The issue is related to unauthorized modification of data due to a missing capability check on the tfcm maybe set bot flags function. This allows...

The vulnerability of the File Upload plugin in the WordPress content management system allows a hacker to gain access to read, modify, or delete data.

The vulnerability of the File Upload plugin in the WordPress content management system is related to an incorrect restriction on the path to the restricted directory. Exploiting this vulnerability could allow a malicious actor to gain read, modify, or delete access to data...

WordPress Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal Plugin <= 16.8 is vulnerable to Broken Access Control

Software Malcure Malware Scanner — 1 Toolset for WordPress Malware Removal Type Plugin Vulnerable versions = 16.8 Fixed in 16.9 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE N/A Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID...

PT-2025-25382 · WordPress · Wp Travel Engine

Name of the Vulnerable Software and Affected Versions: The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress versions up to, and including, 6.5.1 Description: The issue is related to a missing capability check on the delete package function, allowing...

WordPress plugin WP Travel Engine - Tour Booking Plugin - Tour Operator Software Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin WP Travel...

WordPress plugin IndieBlocks 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress CubeWP Framework plugin <= 1.1.23 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin CubeWP versions = 1.1.23...

WordPress CubeWP Forms plugin <= 1.1.5 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Mika in WordPress Plugin CubeWP Forms versions = 1.1.5...

WordPress If-So Dynamic Content Personalization plugin <= 1.9.3.1 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin If-So Dynamic Content Personalization versions = 1.9.3.1...

WordPress Automation By Autonami plugin <= 3.6.0 - Open Redirection Vulnerability

Open Redirection Vulnerability discovered by LVT-tholv2k in WordPress Plugin FunnelKit Automations versions = 3.6.0...

WordPress AFS Analytics plugin <= 4.21 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Nabil Irawan in WordPress Plugin AFS Analytics versions = 4.21...

WordPress Majestic Support plugin <= 1.1.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Fariq Fadillah Gusti Insani in WordPress Plugin Majestic Support versions = 1.1.0...

CVE-2025-4774

The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-countdown attribute of Countdown widget in all versions up to, and including, 4.11.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

WordPress WPGYM plugin <= 65.0 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by Aiden Thái An in WordPress Plugin WPGYM versions = 65.0...

CVE-2025-3076

The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘buttontext’ parameter in all versions up to, and including, 3.29.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2025-25280 · WordPress · Workreap

Name of the Vulnerable Software and Affected Versions: Workreap plugin for WordPress versions up to, and including, 3.3.1 Description: The issue arises from the plugin's failure to properly verify a user's identity before logging them in when verifying an account with an email address. This allow...

CVE-2025-5144

The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-date-’ parameters in all versions up to, and including, 6.13.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

WordPress Woocommerce Partial Shipment plugin <= 3.2 - SQL Injection Vulnerability

SQL Injection Vulnerability discovered by timomangcut in WordPress Plugin Woocommerce Partial Shipment versions = 3.2...