CVE-2025-32245: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Chaser324 Featured Posts Scroll featured-posts-scroll allows Stored XSS.This issue affects Featured Posts Scroll: from n/a through = 1.25...

CVE-2025-4169: Improper Neutralization of Input During Web Page Generation

The Posts per Cat Unmaintained plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ppc' shortcode in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-12767

The buddyboss-platform WordPress plugin before 2.7.60 lacks proper access controls and allows a logged-in user to view comments on private posts...

CVE-2024-10639

The Auto Prune Posts WordPress plugin before 3.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-12767 BuddyBoss platform < 2.7.60 - Private Comment Exposure via IDOR

The buddyboss-platform WordPress plugin before 2.7.60 lacks proper access controls and allows a logged-in user to view comments on private posts...

CVE-2024-12767

The buddyboss-platform WordPress plugin, in versions prior to 2.7.60 , is vulnerable to an Insecure Direct Object Reference (IDOR) due to improper access controls. This flaw allows a logged-in user to bypass authorization and view comments on private posts . To remediate this issue, users should ...

CVE-2024-0249 Advanced Schedule Posts <= 2.1.8 - Reflected XSS

The Advanced Schedule Posts WordPress plugin through 2.1.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admins...

CVE-2024-0249 Advanced Schedule Posts <= 2.1.8 - Reflected XSS

The Advanced Schedule Posts WordPress plugin through 2.1.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admins...

CVE-2024-10639 Auto Prune Posts < 3.0.0- Admin+ Stored XSS

The Auto Prune Posts WordPress plugin before 3.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-10639 Auto Prune Posts < 3.0.0- Admin+ Stored XSS

The Auto Prune Posts WordPress plugin before 3.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-10639

The Auto Prune Posts WordPress plugin versions prior to 3.0.0 is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitise and escape certain plugin settings. This vulnerability can be exploited by high-privilege users, such as administrators, ev...

CVE-2025-4609

creationtimestamp| type| source ---|---|--- 2025-05-15 10:48:39+00:00| exploited| https://t.me/itsecnews/5885 2025-05-15 19:50:59+00:00| seen| https://bsky.app/profile/cti-news.bsky.social/post/3lpaby2mjrc2v 2025-05-15 20:01:35+00:00| seen|...

PT-2025-21442 · WordPress · Buddyboss Platform

Name of the Vulnerable Software and Affected Versions: buddyboss-platform versions prior to 2.7.60 Description: The issue is related to improper access controls in the buddyboss-platform WordPress plugin, allowing a logged-in user to view comments on private posts. Recommendations: For versions...

WordPress plugin Advanced Schedule Posts has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in WordPre...

PT-2025-21408 · WordPress · Auto Prune Posts

Name of the Vulnerable Software and Affected Versions: Auto Prune Posts WordPress plugin versions prior to 3.0.0 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some settings are not properly sanitised an...

CVE-2024-9645: Improper Neutralization of Input During Web Page Generation

The Post Grid, Posts Slider, Posts Carousel, Post Filter, Post Masonry WordPress plugin before 2.2.93 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform...

CVE-2024-0249: Improper Neutralization of Input During Web Page Generation

The Advanced Schedule Posts WordPress plugin through 2.1.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admins...

CVE-2024-12767: Authorization Bypass Through User-Controlled Key

The buddyboss-platform WordPress plugin before 2.7.60 lacks proper access controls and allows a logged-in user to view comments on private posts...

CVE-2024-10639: Improper Neutralization of Input During Web Page Generation

The Auto Prune Posts WordPress plugin before 3.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2025-0020

creationtimestamp| type| source ---|---|--- 2025-05-14 08:31:22+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/16294 2025-05-14 09:17:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lp4o4q5plv2p 2025-05-14 09:19:53+00:00| seen|...