EUVD-2025-32267

Malicious code in bioql PyPI...

CVE-2025-9206

The Meks Easy Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title field in all version up to, and including, 2.1.4. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-9206

CVE-2025-9206 (Meks Easy Maps for WordPress) : A stored Cross-Site Scripting (XSS) vulnerability affects Meks Easy Maps plugin up to version 2.1.4. The issue arises from insufficient input sanitization and output escaping in the post title field, allowing authenticated users with contributor-leve...

CVE-2025-2942

The Order Delivery Date WordPress plugin before 12.6.0 discloses arbitrary post title such as from draft and private posts via an unauthenticated AJAX action, allowing attackers to retrieve such information...

CVE-2025-2942

The Order Delivery Date WordPress plugin before 12.6.0 discloses arbitrary post title such as from draft and private posts via an unauthenticated AJAX action, allowing attackers to retrieve such information...

CVE-2025-2942 Order Delivery Date Pro for WooCommerce < 12.6.0 - Unauthenticated Arbitrary Post Title Disclosure

The Order Delivery Date WordPress plugin before 12.6.0 discloses arbitrary post title such as from draft and private posts via an unauthenticated AJAX action, allowing attackers to retrieve such information...

CVE-2025-2942 Order Delivery Date Pro for WooCommerce < 12.6.0 - Unauthenticated Arbitrary Post Title Disclosure

The Order Delivery Date WordPress plugin before 12.6.0 discloses arbitrary post title such as from draft and private posts via an unauthenticated AJAX action, allowing attackers to retrieve such information...

CVE-2025-2942

CVE-2025-2942 affects the Order Delivery Date WordPress plugin prior to version 12.6.0. An unauthenticated AJAX action discloses arbitrary post titles (including drafts/private posts), enabling information disclosure. The root cause is an insecure AJAX endpoint that returns post title data withou...

CVE-2024-3558

The Custom Field Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the 'cfsposttitle' parameter versions up to, and including, 2.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2024-6458

The WooCommerce Product Table Lite plugin for WordPress is vulnerable to unauthorized post title modification due to a missing capability check on the wcptpresetsduplicatepresettotable function in all versions up to, and including, 3.5.1. This makes it possible for authenticated attackers with...

CVE-2024-1841

The wpbakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Title tag attribute in all versions up to, and including, 7.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or...

CVE-2023-5532

The ImageMapper plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.6. This is due to missing or incorrect nonce validation on the 'imgmapsaveareatitle' function. This makes it possible for unauthenticated attackers to update the post title and...

CVE-2023-2172

The BadgeOS plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.7.1.6. This is due to improper validation and authorization checks within the badgeosupdatestepsajaxhandler, badgeosupdateawardstepsajaxhandler,...

CVE-2022-36527

Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the post title text field under the publish blog module...

CVE-2021-24677

The Find My Blocks WordPress plugin before 3.4.0 does not have authorisation checks in its REST API, which could allow unauthenticated users to enumerate private posts' titles...

CVE-2020-35752

Baby Care System 1.0 is affected by a cross-site scripting XSS vulnerability in the Edit Page tab through the Post title parameter...

PT-2025-17349 · WordPress +1 · Order Delivery Date +1

Name of the Vulnerable Software and Affected Versions: Order Delivery Date WordPress plugin versions prior to 12.6.0 Description: The Order Delivery Date WordPress plugin before version 12.6.0 discloses arbitrary post titles including draft and private posts through an unauthenticated AJAX action...

CVE-2025-2252 Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.3.6.1 - Unauthenticated Private Post Title Disclosure

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.6.1 via the eddajaxgetdownloadtitle function. This makes it possible for unauthenticated attackers to extract...

WordPress Easy Digital Downloads plugin <= 3.3.6.1 - Unauthenticated Private Post Title Disclosure vulnerability

Unauthenticated Private Post Title Disclosure vulnerability discovered by Françoa Taffarel in WordPress Plugin Easy Digital Downloads versions = 3.3.6.1...

WordPress Post Title (TypeWriter) plugin <= 4.1 - CSRF to Privilege Escalation vulnerability

CSRF to Privilege Escalation vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin Post Title TypeWriter versions = 4.1...