WordPress Wishlist plugin <= 1.0.46 - SQL Injection vulnerability

SQL Injection vulnerability discovered by NAWardRox in WordPress Plugin Wishlist versions = 1.0.46...

WordPress WooCommerce Pickupp plugin <= 2.4.3 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by LVT-tholv2k in WordPress Plugin WooCommerce Pickupp versions = 2.4.3...

WordPress Ultimate Bootstrap Elements for Elementor plugin <= 1.4.9 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by LVT-tholv2k in WordPress Plugin Ultimate Bootstrap Elements for Elementor versions = 1.4.9...

CVE-2025-31008 WordPress YouTube Embed plugin <= 5.3.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Embeds For YouTube Plugin Support YouTube Embed youtube-embed allows Stored XSS.This issue affects YouTube Embed: from n/a through = 5.3.1...

CVE-2025-31390

CVE-2025-31390 is a CSRF-to-Stored XSS vulnerability in Social Crowd (WordPress plugin) affecting versions up to 0.9.6.1. The Wordfence vulnerability data (and referenced listing) confirm the issue and indicate the vulnerability remains Unpatched. Practical impact is stored XSS via CSRF, as descr...

CVE-2025-31399 WordPress CG Scroll To Top plugin <= 3.5 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Chandan Garg CG Scroll To Top cg-scroll-to-top allows Stored XSS.This issue affects CG Scroll To Top: from n/a through = 3.5...

CVE-2025-31401 WordPress MMX – Make Me Christmas plugin <= 1.0.0 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in mmetrodw MMX – Make Me Christmas mmx-make-me-christmas allows Stored XSS.This issue affects MMX – Make Me Christmas: from n/a through = 1.0.0...

CVE-2025-32481 WordPress Nino Social Connect plugin <= 2.0 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in ninotheme Nino Social Connect nino-social-connect allows Stored XSS.This issue affects Nino Social Connect: from n/a through = 2.0...

CVE-2025-32496

CVE-2025-32496 is an Unpatched CSRF to Remote Code Execution in the WordPress plugin Ultra Demo Importer (versions up to 1.0.5). The vulnerability allows an attacker to perform CSRF to execute a web shell on the server, as documented in the vulnerability listing. The CVSSv3.1 base score is 9.6 (C...

CVE-2025-32505 WordPress MultiMailer plugin <= 1.0.3 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in SCAND MultiMailer allows Stored XSS. This issue affects MultiMailer: from n/a through 1.0.3...

CVE-2025-32547 WordPress All push notification for WP Plugin <= 1.5.3 - CSRF to SQL Injection vulnerability

Cross-Site Request Forgery CSRF vulnerability in gtlwpdev All push notification for WP all-push-notification allows Blind SQL Injection.This issue affects All push notification for WP: from n/a through = 1.5.3...

CVE-2025-32597 WordPress WordPress Events Calendar Plugin – connectDaily plugin <= 1.4.8 - CSRF to Cross-Site Scripting vulnerability

Cross-Site Request Forgery CSRF vulnerability in George Sexton WordPress Events Calendar Plugin – connectDaily allows Cross-Site Scripting XSS. This issue affects WordPress Events Calendar Plugin – connectDaily: from n/a through 1.4.8...

CVE-2025-32617

CVE-2025-32617 affects the WordPress plugin Multiple Location Google Map. The vulnerability is described as a Cross-Site Request Forgery (CSRF) that enables Stored XSS in versions up to 1.1 (vulnerable range: unspecified from n/a to 1.1). The CVSS 3.1 base score is 7.1 (HIGH), with network attack...

CVE-2025-32641 WordPress Anant Addons for Elementor plugin <= 1.1.8 - CSRF to Arbitrary Plugin Installation vulnerability

Cross-Site Request Forgery CSRF vulnerability in anantaddons Anant Addons for Elementor anant-addons-for-elementor allows Cross Site Request Forgery.This issue affects Anant Addons for Elementor: from n/a through = 1.1.8...

CVE-2025-32640

CVE-2025-32640 is a stored XSS in the WordPress plugin Ally – Web Accessibility & Usability (One Click Accessibility). The issue affects the One Click Accessibility component up to version 3.1.0 and requires authenticated access (Administrator+) to exploit. The connected Wordfence disclosure list...

CVE-2025-32642

CVE-2025-32642 is a CSRF-to-Remote Code Execution vulnerability in Vite Coupon. Affected software: Vite Coupon, reportedly vulnerable up to 1.0.9 (initial says up to 1.0.7). CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H; base score 10.0. Patch status: Unpatched per the connected documents; no re...

WordPress Link Shield plugin <= 0.5.4 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

CSRF to Stored Cross Site Scripting XSS vulnerability discovered by SOPROBRO in WordPress Plugin Link Shield versions = 0.5.4...

WordPress Multiple Location Google Map plugin <= 1.1 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by Abdi Pranata in WordPress Plugin Multiple Location Google Map versions = 1.1...

WordPress Czater.pl – live chat i telefon plugin <= 1.0.5 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

CSRF to Stored Cross Site Scripting XSS vulnerability discovered by Abdi Pranata in WordPress Plugin Czater.pl – live chat i telefon versions = 1.0.5...

WordPress One Click Accessibility plugin <= 3.1.0 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability discovered by Ayato Shitomi @ Fore-Z co.ltd in WordPress Plugin Ally versions = 3.1.0...