WordPress SPAM-BYBYE Plugin <= 2.2.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Spam Byebye versions = 2.2.4...

WordPress ThemeEgg ToolKit plugin <= 1.2.9 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Nabil Irawan in WordPress Plugin ThemeEgg ToolKit versions = 1.2.9...

WordPress WP Last Modified plugin <= 0.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nabil Irawan in WordPress Plugin WP Last Modified versions = 0.1...

WordPress AS English Admin plugin <= 1.0.0 - Open Redirection vulnerability

Open Redirection vulnerability discovered by Abdi Pranata in WordPress Plugin AS English Admin versions = 1.0.0...

WordPress W3Counter Free Real-Time Web Stats plugin <= 4.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nguyen Thi Huyen Trang - Skalucy in WordPress Plugin W3Counter Free Real-Time Web Stats versions = 4.1...

CVE-2025-28938 WordPress WP Performance Pack plugin <= 2.5.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Bjoern WP Performance Pack wp-performance-pack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Performance Pack: from n/a through = 2.5.3...

CVE-2025-28914 WordPress wordpress login form to anywhere plugin <= 0.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ajay Sharma wordpress login form to anywhere wp-show-login-form allows Stored XSS.This issue affects wordpress login form to anywhere: from n/a through = 0.2...

CVE-2025-28894

CVE-2025-28894 : A CSRF to Stored XSS vulnerability exists in the WordPress plugin “List of Posts from each Category” (WordPress). Affected: plugin versions n/a through 2.0. Root cause: Cross-Site Request Forgery enabling stored XSS. Impact/visibility: stored XSS via CSRF could affect site visito...

CVE-2025-28884 WordPress WP Bulk Post Duplicator plugin <= 1.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Rajesh Kumar WP Bulk Post Duplicator wp-bulk-post-duplicator allows Cross Site Request Forgery.This issue affects WP Bulk Post Duplicator: from n/a through = 1.2...

CVE-2025-28872 WordPress Block Spam By Math Reloaded plugin <= 2.2.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in jwpegram Block Spam By Math Reloaded block-spam-by-math-reloaded allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Block Spam By Math Reloaded: from n/a through = 2.2.4...

CVE-2025-28871 WordPress Block Spam By Math Reloaded plugin <= 2.2.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in jwpegram Block Spam By Math Reloaded block-spam-by-math-reloaded allows Stored XSS.This issue affects Block Spam By Math Reloaded: from n/a through = 2.2.4...

CVE-2025-28862 WordPress Comment Date and Gravatar remover plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Venugopal Comment Date and Gravatar remover remove-date-and-gravatar-under-comment allows Cross Site Request Forgery.This issue affects Comment Date and Gravatar remover: from n/a through = 1.0...

WordPress GNUCommerce Plugin <= 1.5.4 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin GNUCommerce versions = 1.5.4...

WordPress S3Bubble Media Streaming plugin <= 8.0 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Hassan Khan Yusufzai - Splint3r7 in WordPress Plugin S3Bubble Media Streaming versions = 8.0...

WordPress XV Random Quotes plugin <= 2.6.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Hassan Khan Yusufzai - Splint3r7 in WordPress Plugin XV Random Quotes versions = 2.6.0...

CVE-2024-13228 Qubely – Advanced Gutenberg Blocks <= 1.8.13 - Authenticated (Contributor+) Sensitive Information Exposure via qubely_get_content

The Qubely – Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.13 via the 'qubelygetcontent'. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive...

CVE-2024-13228

CVE-2024-13228 affects the WordPress plugin “Qubely – Advanced Gutenberg Blocks” up to version 1.8.13. The issue is a Sensitive Information Exposure via the qubely_get_content function, allowing authenticated attackers with Contributor-level access or higher to extract sensitive post data (privat...

CVE-2024-13574 XV Random Quotes <= 1.40 - Reflected XSS

The XV Random Quotes WordPress plugin through 1.40 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2025-2169

CVE-2025-2169 affects WPCS – WordPress Currency Switcher Professional (WordPress plugin) up to version 1.2.0.4. The issue arises from unvalidated input feeding do_shortcode, enabling unauthenticated attackers to execute arbitrary shortcodes. Connected sources confirm the vulnerability and indicat...

WordPress plugin Delete Original Image 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...