CVE-2025-2011 Slider & Popup Builder by Depicter <= 3.6.1 - Unauthenticated SQL Injection via 's' Parameter

The Slider & Popup Builder by Depicter plugin for WordPress is vulnerable to generic SQL Injection via the ‘s' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...

CVE-2025-3610

CVE-2025-3610 — Reales WP STPT (WordPress) is a privilege-escalation vulnerability in all versions up to 2.1.2 caused by improper validation of a user’s identity before updating their details (e.g., password). An authenticated attacker with subscriber-level access or higher can change arbitrary u...

WordPress plugin Xavins List Subpages 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress...

WordPress plugin Reales WP STPT 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

WordPress plugin PGS Core 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

WordPress Captivate Sync Plugin <= 3.0.3 - PHP Object Injection Vulnerability

PHP Object Injection Vulnerability discovered by stealthcopter in WordPress Plugin Captivate Sync versions = 3.0.3...

WordPress Depicter Slider plugin <= 3.6.1 - Unauthenticated SQL Injection via 's' Parameter vulnerability

Unauthenticated SQL Injection via 's' Parameter vulnerability discovered by Muhamad Visat in WordPress Plugin Depicter Slider versions = 3.6.1...

WordPress User Registration plugin <= 4.2.1 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion vulnerability

Insecure Direct Object Reference to Unauthenticated Limited User Deletion vulnerability discovered by wesley wcraft in WordPress Plugin User Registration versions = 4.2.1...

WordPress AHAthat Plugin plugin <= 1.6 - Cross-Site Request Forgery to AHA Page Deletion vulnerability

Cross-Site Request Forgery to AHA Page Deletion vulnerability discovered by Régis SENET in WordPress Plugin AHAthat versions = 1.6...

CVE-2025-4279 External image replace <= 1.0.8 - Authenticated (Contributor+) Arbitrary File Upload

The External image replace plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'externalimagereplacegetposts::replacepost' function in all versions up to, and including, 1.0.8. This makes it possible for authenticated attackers, with...

CVE-2024-11615

The Envolve Plugin plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 1.0 via the 'zetradeleteLanguageFile' and 'zetradeleteFontsFile' functions. This is due to the plugin not properly validating a file or its path prior to deleting it. This makes ...

WordPress Newsletter plugin < 8.7.1 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Newsletter versions 8.7.1...

WordPress External image replace plugin <= 1.0.8 - Authenticated (Contributor+) Arbitrary File Upload vulnerability

Authenticated Contributor+ Arbitrary File Upload vulnerability discovered by István Márton in WordPress Plugin External image replace versions = 1.0.8...

CVE-2025-4198

The Alink Tap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.1. This is due to missing or incorrect nonce validation on the 'alink-tap' page. This makes it possible for unauthenticated attackers to update settings and inject malicious we...

CVE-2025-3918

The Job Listings plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization within the registeraction function in versions 0.1 to 0.1.1. The plugin’s registration handler reads the client-supplied $POST'userrole' and passes it directly to wpinsertuser without...

PT-2025-19342 · WordPress · Newsletters

Name of the Vulnerable Software and Affected Versions: The Newsletter WordPress plugin versions prior to 8.7.1 Description: The issue concerns the Newsletter WordPress plugin, which does not properly sanitize and escape some of its settings. This could allow high-privilege users, such as...

CVE-2025-3488

The WPML plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpmllanguageswitcher shortcode in versions 3.6.0 - 4.7.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...

CVE-2024-12023

The FULL – Cliente plugin for WordPress is vulnerable to SQL Injection via the 'formId' parameter in all versions 3.1.5 to 3.1.25 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated...

CVE-2025-2880

The Yame | Link In Bio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.9.0 through the publicly accessible phpinfo.php script. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in t...

CVE-2025-3746

The OTP-less one tap Sign in plugin for WordPress is vulnerable to privilege escalation via account takeover in versions 2.0.14 to 2.0.59. This is due to the plugin not properly validating a user's identity prior to updating their details, like email. This makes it possible for unauthenticated...