WordPress plugin AM LottiePlayer 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress List Children plugin <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by muhammad yudha in WordPress Plugin List Children versions = 2.1...

WordPress Projectopia plugin <= 5.1.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Option Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Option Deletion vulnerability discovered by Chuck in WordPress Plugin Projectopia versions = 5.1.16...

WordPress NewsBlogger plugin <= 0.2.5.1 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by CVEhunter in WordPress Theme NewsBlogger versions = 0.2.5.1...

CVE-2025-39413

CVE-2025-39413 describes a Missing Authorization vulnerability in the WordPress plugin Simple Sitemap – Create a Responsive HTML Sitemap (versions up to 3.5.14). The issue, categorized as a Broken Access Control/Missing Authorization, could allow unauthorized access to sitemap data. Connected sou...

WordPress SureForms plugin < 1.4.4 - Contributor+ Settings Update vulnerability

Contributor+ Settings Update vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin SureForms versions 1.4.4...

CVE-2025-3471 SureForms < 1.4.4 - Contributor+ Settings Update

The SureForms WordPress plugin before 1.4.4 does not have proper authorisation check when updating its settings via the REST API, which could allow Contributor and above roles to perform such action...

CVE-2025-3471 SureForms < 1.4.4 - Contributor+ Settings Update

The SureForms WordPress plugin before 1.4.4 does not have proper authorisation check when updating its settings via the REST API, which could allow Contributor and above roles to perform such action...

CVE-2025-3953

CVE-2025-3953 affects WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin for WordPress (versions up to 14.13.3). The flaw is a missing capability check in optionUpdater, enabling authenticated attackers with Subscriber-level access and above to modify arbitrary plugin settings. Th...

WordPress Plugin Aeropage Sync for Airtable File Upload Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A file upload vulnerability...

PT-2025-18243 · WordPress · Tagdiv Opt-In Builder

Name of the Vulnerable Software and Affected Versions: tagDiv Opt-In Builder plugin for WordPress versions up to, and including, 1.7 Description: The issue is related to time-based SQL Injection via the subscriptionCouponId parameter due to insufficient escaping on the user-supplied parameter and...

360 View <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The 360 View plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject...

WordPress WP Statistics plugin <= 14.13.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary plugin Settings Update vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary plugin Settings Update vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin WP Statistics versions = 14.13.3...

WordPress Total Donations <= 3.0.8 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Nguyen Xuan Chien Patchstack Alliance in WordPress Plugin Total Donations versions = 3.0.8...

CVE-2025-3452

The SecuPress Free — WordPress Security plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'secupressreinstallpluginsadminajaxcb' function in all versions up to, and including, 2.3.9. This makes it possible for authenticated attackers,...

CVE-2025-3452

CVE-2025-3452 concerns the WordPress plugin SecuPress Free (versions up to and including 2.3.9). A missing capability check in the secupress_reinstall_plugins_admin_ajax_cb function allows authenticated attackers with Subscriber-level access and above to install arbitrary plugins, enabling unauth...

CVE-2025-2893 Gutenverse <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via countdown Block

The Gutenverse – Ultimate Block Addons and Page Builder for Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's countdown Block in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping on user supplied...

CVE-2025-2893 Gutenverse <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via countdown Block

The Gutenverse – Ultimate Block Addons and Page Builder for Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's countdown Block in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping on user supplied...

WordPress Separator Shortcode and Widget plugin <= 5.9.10 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao KhanhVCI - VNPT in WordPress Plugin Separator Shortcode and Widget versions = 5.9.10...

CVE-2024-12273

The Calculated Fields Form WordPress plugin before 5.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...