16116 matches found
CVE-2007-10003
A vulnerability, which was classified as critical, has been found in The Hackers Diet Plugin up to 0.9.6b on WordPress. This issue affects some unknown processing of the file ajaxblurb.php of the component HTTP POST Request Handler. The manipulation of the argument user leads to sql injection. Th...
WordPress MapSVG plugin <= 8.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Mo'men Saad in WordPress Plugin MapSVG versions = 8.6.4...
WordPress Hot Random Image plugin <= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via link Parameter vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via link Parameter vulnerability discovered by Kishan Vyas in WordPress Plugin Hot Random Image versions = 1.9.2...
CVE-2025-4221
The Animated Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'auto-downloader' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
CVE-2025-4105
The Splitit plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on several functions in the 'splitIt-flexfields-payment-gateway.php' file in all versions up to, and including, 4.2.8. This makes it possible for authenticated attackers, with...
CVE-2025-3750
The Network Posts Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘postheight’ parameter in all versions up to, and including, 7.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
WordPress miniOrange Discord Integration plugin <= 2.2.2 - Local File Inclusion Vulnerability
Local File Inclusion Vulnerability discovered by LVT-tholv2k in WordPress Plugin miniOrange Discord Integration versions = 2.2.2...
WordPress Essential Real Estate plugin <= 5.2.6 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by LVT-tholv2k in WordPress Plugin Essential Real Estate versions = 5.2.6...
WordPress KBx Pro Ultimate plugin < 8.0.5 - Arbitrary File Deletion Vulnerability
Arbitrary File Deletion Vulnerability discovered by Tran Nguyen Bao KhanhVCI - VNPT in WordPress Plugin KBx Pro Ultimate versions 8.0.5...
CVE-2025-4219 DPEPress <= 0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
The DPEPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dpe' shortcode in all versions up to, and including, 0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, wit...
CVE-2025-4221
CVE-2025-4221 affects the WordPress plugin Animated Buttons, with a stored cross-site scripting (XSS) vulnerability in the plugin’s ‘auto-downloader’ shortcode. It affects all versions up to 1.0.0 and stems from insufficient input sanitization and output escaping on user-supplied attributes. An a...
CVE-2025-4105
CVE-2025-4105 affects the WordPress Splitit plugin (versions up to 4.2.8). The issue is due to missing capability checks, enabling authenticated users with Subscriber+ privileges to modify plugin settings, including changing the environment between sandbox and production. The impact is unauthoriz...
CVE-2025-4803 Glossary by WPPedia <= 1.3.0 - Authenticated (Administrator+) PHP Object Injection
The Glossary by WPPedia – Best Glossary plugin for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.0 via deserialization of untrusted input from the 'posttypes' parameter. This makes it possible for authenticated attackers, with...
CVE-2025-1625
The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its Counter block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
PT-2025-22328 · WordPress · Affiliate Sales In Google Analytics/Other Tools
Name of the Vulnerable Software and Affected Versions: The Affiliate Sales in Google Analytics and other tools plugin for WordPress versions up to, and including, 1.4.9 Description: The issue is due to insufficient validation on the redirect url supplied via the afflink parameter. This makes it...
WordPress Slim SEO plugin <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via slim_seo_breadcrumbs Shortcode vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via slimseobreadcrumbs Shortcode vulnerability discovered by muhammad yudha in WordPress Plugin Slim SEO versions = 4.5.3...
WordPress Affiliate Sales in Google Analytics and other tools plugin <= 2.0.0 - Open Redirect vulnerability
Open Redirect vulnerability discovered by Jaap Marcus in WordPress Plugin Affiliate Sales in Google Analytics and other tools versions = 2.0.0...
WordPress Order Delivery Date Pro for WooCommerce plugin < 12.4.0 - Reflected XSS vulnerability
Reflected XSS vulnerability discovered by Erwan LR WPScan in WordPress Plugin Order Delivery Date for WP e-Commerce versions 12.4.0...
WordPress WP Post Modules for Elementor plugin <= 2.5.0 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao KhanhVCI - VNPT in WordPress Plugin WP Post Modules for Elementor versions = 2.5.0...