16125 matches found
WordPress Bulk Term Editor plugin <= 1.1.4 - Cross Site Request Forgery (CSRF) Vulnerability
Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Thi Huyen Trang - Skalucy in WordPress Plugin Bulk Term Editor versions = 1.1.4...
WordPress Checkout Files Upload for WooCommerce plugin <= 2.2.0 - Cross Site Scripting (XSS) Vulnerability
Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin Checkout Files Upload for WooCommerce versions = 2.2.0...
WordPress Site Search 360 plugin <= 2.1.8 - Cross Site Request Forgery (CSRF) to stored XSS vulnerability
Cross Site Request Forgery CSRF to stored XSS vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Site Search 360 versions = 2.1.8...
WordPress Zephyr Project Manager plugin <= 3.3.200 - Broken Access Control Vulnerability
Broken Access Control Vulnerability discovered by stealthcopter in WordPress Plugin Zephyr Project Manager versions = 3.3.200...
WordPress WowStore plugin <= 4.2.4 - Broken Access Control Vulnerability
Broken Access Control Vulnerability discovered by astra.r3verii in WordPress Plugin WowStore versions = 4.2.4...
WordPress WP Data Access plugin <= 5.5.36 - Cross Site Scripting (XSS) Vulnerability
Cross Site Scripting XSS Vulnerability discovered by Peter Thaleikis in WordPress Plugin WP Data Access versions = 5.5.36...
WordPress Fast eBay Listings plugin <= 2.12.15 - Open Redirection Vulnerability
Open Redirection Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Fast eBay Listings versions = 2.12.15...
WordPress WooCommerce Product Table Lite plugin <= 3.9.5 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Mika in WordPress Plugin WooCommerce Product Table Lite versions = 3.9.5...
CVE-2025-27936
Mattermost Plugin MSTeams versions 2.1.0 and Mattermost Server versions 10.5.x =10.5.1 with the MS Teams plugin enabled fail to perform constant time comparison on a MSTeams plugin webhook secret which allows an attacker to retrieve the webhook secret of the MSTeams plugin via a timing attack...
CVE-2025-3247
The Contact Form 7 plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 6.0.5 via the 'wpcf7stripeskipspamcheck' function due to insufficient validation on a user controlled key. This makes it possible for unauthenticated attackers to reuse a single Stripe...
WordPress plugin Zephyr Project Manager 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
WordPress plugin MelaPress Login Security 代码问题漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...
WordPress plugin WordPress REST API Authentication 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability...
WordPress plugin Rescue Shortcodes 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
CVE-2025-26996
CVE-2025-26996 describes an improper generation of code vulnerability ( shortcode/code injection ) in the WordPress Sign-up Sheets plugin. Affected versions are Sign-up Sheets up to 2.3.0.1; exploitation would enable unauthenticated shortcode execution leading to arbitrary code execution in affec...
CVE-2025-26746 WordPress Advanced Custom Fields: Link Picker Field plugin <= 1.2.8 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in caalami Advanced Custom Fields: Link Picker Field acf-link-picker-field allows Reflected XSS.This issue affects Advanced Custom Fields: Link Picker Field: from n/a through = 1.2.8...
CVE-2025-26749 WordPress Additional Custom Product Tabs for WooCommerce plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPFactory Additional Custom Product Tabs for WooCommerce product-tabs-for-woocommerce allows Stored XSS.This issue affects Additional Custom Product Tabs for WooCommerce: from n/a through = 1.7.0...
CVE-2025-22263 WordPress Global Gallery plugin <= 8.8.0 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NotFound Global Gallery allows Reflected XSS. This issue affects Global Gallery: from n/a through 8.8.0...
WordPress Tourmaster plugin < 5.4.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Bonds Patchstack Alliance in WordPress Plugin Tourmaster versions 5.4.1...