WordPress Simple Keyword to Link plugin <= 1.5 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Simple Keyword to Link versions = 1.5...

WordPress WP-Recall plugin <= 16.26.14 - CSRF to Privilege Escalation vulnerability

CSRF to Privilege Escalation vulnerability discovered by 0xd4rk5id3 in WordPress Plugin WP-Recall versions = 16.26.14...

WordPress Elite Video Player plugin <= 10.0.5 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Anhchangmutrang in WordPress Plugin Elite Video Player versions = 10.0.5...

WordPress Persian Woocommerce SMS plugin <= 7.0.10 - SQL Injection Vulnerability

SQL Injection Vulnerability discovered by astra.r3verii in WordPress Plugin Persian Woocommerce SMS versions = 7.0.10...

WordPress The Events Calendar Countdown Addon plugin <= 1.4.9 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin The Events Calendar Countdown Addon versions = 1.4.9...

WordPress Search with Typesense plugin <= 2.0.10 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin Search with Typesense versions = 2.0.10...

WordPress Ultimate WP Mail plugin <= 1.3.5 - Account Takeover via Email Log Leak Vulnerability

Account Takeover via Email Log Leak Vulnerability discovered by domiee13 in WordPress Plugin Ultimate WP Mail versions = 1.3.5...

WordPress WP Table Builder plugin <= 2.0.6 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by domiee13 in WordPress Plugin WP Table Builder versions = 2.0.6...

WordPress WP Tools plugin <= 5.24 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin WP Tools versions = 5.24...

WordPress WP-CRM System plugin <= 3.4.2 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Mika in WordPress Plugin WP-CRM System versions = 3.4.2...

WordPress Team Showcase plugin < 25.05.13 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Tran Nguyen Bao KhanhVCI - VNPT in WordPress Plugin Team Showcase versions 25.05.13...

WordPress oik plugin <= 4.15.1 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Aiden in WordPress Plugin oik versions = 4.15.1...

WordPress Print Invoice & Delivery Notes for WooCommerce plugin <= 5.5.0 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by domiee13 in WordPress Plugin Print Invoice & Delivery Notes for WooCommerce versions = 5.5.0...

WordPress Everest Backup plugin <= 2.3.3 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by domiee13 in WordPress Plugin Everest Backup versions = 2.3.3...

WordPress Raychat plugin <= 2.1.0 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Raychat versions = 2.1.0...

WordPress File Provider plugin <= 1.2.3 - Item Deletion via CSRF vulnerability

Item Deletion via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin File Provider versions = 1.2.3...

WordPress Stock Locations for WooCommerce plugin <= 2.8.6 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by LVT-tholv2k in WordPress Plugin Stock Locations for WooCommerce versions = 2.8.6...

CVE-2025-4580

The File Provider WordPress plugin (versions 1.2.3 and earlier ) is vulnerable to a Cross-Site Request Forgery (CSRF) attack due to a lack of CSRF checks when updating settings. An attacker could exploit this to force a logged-in administrator to modify plugin settings or delete items. As a worka...

CVE-2025-5539

The Simple Contact Form Plugin for WordPress – WP Easy Contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emdmbmeta' shortcode in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping on user supplied attribute...

CVE-2025-5532

The Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emdmbmeta' shortcode in all versions up to, and including, 1.9.0 due to insufficient input sanitization and output escaping on user...