CVE-2025-2524

The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2025-1626

The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its Countdown block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2025-4389

The Crawlomatic Multipage Scraper Post Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the crawlomaticgeneratefeaturedimage function in all versions up to, and including, 2.6.8.1. This makes it possible for unauthenticated attackers to...

WordPress Spiritual Gifts Survey plugin <= 0.9.10 - Unauthenticated CSRF to XSS vulnerability

Unauthenticated CSRF to XSS vulnerability discovered by Hassan Khan Yusufzai - Splint3r7 in WordPress Plugin Spiritual Gifts Survey versions = 0.9.10...

WordPress Auto Affiliate Links plugin < 6.4.7 - Admin+ SQL Injection vulnerability

Admin+ SQL Injection vulnerability discovered by y4ng0615 in WordPress Plugin Auto Affiliate Links versions 6.4.7...

WordPress EKC Tournament Manager plugin < 2.2.2 - Admin+ Arbitrary File Download vulnerability

Admin+ Arbitrary File Download vulnerability discovered by Vuln Seeker Cybersecurity Team in WordPress Plugin EKC Tournament Manager versions 2.2.2...

WordPress Team Members Showcase plugin < 4.4.2 - Editor+ Stored XSS vulnerability

Editor+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin Team versions 4.4.2...

WordPress Wordpress Clicksold IDX Plugin plugin <= 1.90 - Admin+ XSS vulnerability

Admin+ XSS vulnerability discovered by Amandeep Singh Banga in WordPress Plugin Clicksold IDX versions = 1.90...

WordPress PWA For WP & AMP plugin < 1.7.72 Administrator+ Stored XSS vulnerability

WordPress PWA For WP & AMP plugin 1.7.72 Administrator+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin PWA for WP & AMP versions 1.7.72...

WordPress DL Verification plugin <= 1.2 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin DL Verification versions = 1.2...

WordPress CTT Expresso para WooCommerce plugin < 3.2.13 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin CTT Expresso para WooCommerce versions 3.2.13...

WordPress DL Yandex Metrika plugin <= 1.2 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin DL Yandex Metrika versions = 1.2...

WordPress Responsive Gallery Grid plugin < 2.3.15 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin Responsive Gallery Grid versions 2.3.15...

WordPress Advanced Cron Manager plugin < 2.5.7 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin Advanced Cron Manager – debug & control versions 2.5.7...

WordPress Post Grid, Post Carousel, & List Category Posts plugin < 2.4.28 - Editor+ Stored XSS vulnerability

Editor+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Post Grid, Post Carousel, & List Category Posts – by Smart Post Show versions 2.4.28...

WordPress Competition Form plugin <= 2.0 - Competition Deletion via CSRF vulnerability

Competition Deletion via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin Competition Form versions = 2.0...

WordPress Advance Post Prefix plugin <= 1.1.1 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Hassan Khan Yusufzai - Splint3r7 in WordPress Plugin Advance Post Prefix versions = 1.1.1...

WordPress Plugin Name Directory Security Vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress plugin BP Messages Tool has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress plugin – WordPress Video Robot: The Ultimate Video Importer; Cross-site scripting vulnerabilities

WordPress and WordPress plugin are products of the WordPress Foundation, a blogging platform developed in PHP. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. WordPress plugin WordPress Video Robot - The Ultimate Video Importer A cross-site...