WordPress wProject Theme < 5.8.0 is vulnerable to Privilege Escalation

Software wProject Type Theme Vulnerable versions 5.8.0 Fixed in 5.8.0 OWASP Top 10 A1: Broken Access Control Classification Privilege Escalation CVE CVE-2025-39366 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID dc57f98abe0c Credits Dave Jong Patchstack Required privileg...

WordPress Amazon Showcase WordPress Plugin plugin <= 2.2 - CSRF to XSS vulnerability

CSRF to XSS vulnerability discovered by johska Patchstack Alliance in WordPress Plugin Amazon Showcase WordPress Plugin versions = 2.2...

WordPress JetTabs plugin <= 2.2.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin JetTabs versions = 2.2.7...

WordPress Bulk Page Stub Creator plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Bulk Page Stub Creator versions = 1.1...

WordPress Html5 Audio Player plugin <= 2.2.28 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin Html5 Audio Player versions = 2.2.28...

WordPress Membership For WooCommerce plugin <= 2.8.0 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by zaim in WordPress Plugin Membership For WooCommerce versions = 2.8.0...

WordPress Logo Carousel Gutenberg Block plugin <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via sliderId Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via sliderId Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin Logo Carousel Gutenberg Block versions = 2.1.6...

WordPress WooCommerce Products without featured images Plugin <= 0.1 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability

CSRF to Reflected Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 in WordPress Plugin WooCommerce Products without featured images versions = 0.1...

WordPress MemberPress Discord Addon Plugin <= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 in WordPress Plugin MemberPress Discord Addon versions = 1.1.1...

WordPress TS Poll – Survey, Versus Poll, Image Poll, Video Poll plugin <= 2.4.6 - Authenticated (Administrator+) SQL Injection via 's' Parameter vulnerability

Authenticated Administrator+ SQL Injection via 's' Parameter vulnerability discovered by broccoli in WordPress Plugin TS Poll versions = 2.4.6...

WordPress PowerPress Podcasting plugin < 11.9.18 - Author+ XSS via Podcast URL vulnerability

Author+ XSS via Podcast URL vulnerability discovered by Bob Matyas in WordPress Plugin PowerPress Podcasting versions 11.9.18...

WordPress Kargo Entegratör plugin <= 1.1.14 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Le Ngoc Anh Patchstack Alliance in WordPress Plugin Kargo Entegratör versions = 1.1.14...

CVE-2025-29369

creationtimestamp| type| source ---|---|--- 2025-04-10 20:49:35+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/11340...

WordPress License Manager for WooCommerce plugin <= 3.0.9 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Peter Thaleikis in WordPress Plugin License Manager for WooCommerce versions = 3.0.9...

WordPress SERPed.net Plugin <= 4.6 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 in WordPress Plugin SERPed.net versions = 4.6...

WordPress Zephyr Project Manager plugin <= 3.3.101 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Dimas Maulana in WordPress Plugin Zephyr Project Manager versions = 3.3.101...

WordPress Waymark plugin <= 1.5.3 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by theviper17 in WordPress Plugin Waymark versions = 1.5.3...

WordPress Motors plugin <= 1.4.71 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by LVT-tholv2k in WordPress Plugin Motors versions = 1.4.71...

WordPress Motors plugin <= 1.4.64 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Plugin Installation vulnerability discovered by mikemyers in WordPress Plugin Motors versions = 1.4.64...

WordPress coreActivity: Activity Logging for WordPress plugin <= 2.7 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Yassine NEGGAOUI in WordPress Plugin coreActivity: Activity Logging plugin for WordPress versions = 2.7...