CVE-2025-4590

CVE-2025-4590 affects the Daisycon prijsvergelijkers WordPress plugin (versions up to and including 4.8.4). The issue is a Stored Cross-Site Scripting vulnerability in the plugin’s daisycon_uitvaart shortcode caused by insufficient input sanitization and output escaping on user-supplied attribute...

CVE-2025-4583

The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-plugin attribute in all versions up to, and including, 6.9.0 Free and 6.8.0 Pro due to insufficient input sanitization and output escaping. This makes it...

WordPress plugin eaSYNC Booking 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2025-23380 · WordPress · The Borderless – Elementor Addons/Templates

Name of the Vulnerable Software and Affected Versions: The Borderless – Elementor Addons and Templates plugin for WordPress versions up to, and including, 1.7.1 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, allowing...

PT-2025-23400 · WordPress · The Newsletter Plugin

Name of the Vulnerable Software and Affected Versions: The Newsletters plugin for WordPress versions up to, and including, 4.9.9.9 Description: The issue allows authenticated attackers with Administrator-level access and above to include and execute arbitrary files on the server via the file...

PT-2025-23379 · WordPress · The Royal Elementor Addons/Templates

Name of the Vulnerable Software and Affected Versions: The Royal Elementor Addons and Templates plugin for WordPress versions up to, and including, 1.7.1020 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows...

WordPress Borderless – Elementor Addons and Templates plugin <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Robert DeVore in WordPress Plugin Borderless versions = 1.7.1...

WordPress WP-GeoMeta plugin 0.3.4-0.3.5 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via wp_ajax_wpgm_start_geojson_import Function vulnerability

Missing Authorization to Authenticated Subscriber+ Privilege Escalation via wpajaxwpgmstartgeojsonimport Function vulnerability discovered by kr0d in WordPress Plugin WP-GeoMeta versions 0.3.4-0.3.5...

WordPress Wishlist plugin <= 1.0.43 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin Wishlist versions = 1.0.43...

WordPress WooCommerce Orders & Customers Exporter <= 5.0 - Sensitive Data Exposure Vulnerability

Sensitive Data Exposure Vulnerability discovered by 0xd4rk5id3 Patchstack Alliance in WordPress Plugin WooCommerce Orders & Customers Exporter versions = 5.0...

CVE-2025-5142

The Simple Page Access Restriction plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.31. This is due to missing nonce validation and capability checks in the settings save handler in the settings.php script. This makes it possible for...

CVE-2025-5142

The Simple Page Access Restriction plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.31. This is due to missing nonce validation and capability checks in the settings save handler in the settings.php script. This makes it possible for...

WordPress Real Time Validation for Gravity Forms plugin <= 1.7.0 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability

Cross Site Request Forgery CSRF to Settings Change vulnerability discovered by Nguyen Xuan Chien Patchstack Alliance in WordPress Plugin Real Time Validation for Gravity Forms versions = 1.7.0...

CVE-2025-5287

The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

CVE-2025-5236

The NinjaTeam Chat for Telegram plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘username’ parameter in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

WordPress Woo Slider Pro <= 1.12 - Arbitrary Content Deletion Vulnerability

Arbitrary Content Deletion Vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin Woo Slider Pro versions = 1.12...

WordPress Woo Slider Pro - Drag Drop Slider Builder For WooCommerce plugin <= 1.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via woo_slide_pro_delete_draft_preview vulnerability

WordPress Woo Slider Pro - Drag Drop Slider Builder For WooCommerce plugin = 1.12 - Missing Authorization to Authenticated Subscriber+ Arbitrary Post Deletion via wooslideprodeletedraftpreview vulnerability discovered by Chuck in WordPress Plugin Woo Slider Pro versions = 1.12...

WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin <= 2.4.37 - Arbitrary File Download Vulnerability

Arbitrary File Download Vulnerability discovered by ch4r0n in WordPress Plugin Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light versions = 2.4.37...

CVE-2025-5259

CVE-2025-5259: Minimal Share Buttons for WordPress is affected by a Stored Cross-Site Scripting (XSS) via the align parameter in all versions up to 1.7.3. The issue allows authenticated attackers with Contributor-level access and above to inject scripts that run when users visit injected pages. R...

PT-2025-23268 · WordPress · The Featured Image Plus – Quick & Bulk Edit With Unsplash

Name of the Vulnerable Software and Affected Versions: The Featured Image Plus – Quick & Bulk Edit with Unsplash plugin for WordPress versions up to, and including, 1.6.3 Description: The issue allows authenticated attackers with Subscriber-level access and above to update the featured image of a...