WordPress WP Human Resource Management plugin 2.0.0-2.2.17 - Missing Authorization to Authenticated (Employee+) Privilege Escalation vulnerability

Missing Authorization to Authenticated Employee+ Privilege Escalation vulnerability discovered by kr0d in WordPress Plugin WP Human Resource Management versions 2.0.0-2.2.17...

WordPress WP Firebase Push Notification plugin <= 1.2.0 - Cross-Site Request Forgery to Broadcast Notification vulnerability

Cross-Site Request Forgery to Broadcast Notification vulnerability discovered by Nabil Irawan in WordPress Plugin WP Firebase Push Notification versions = 1.2.0...

WordPress Contact Form 7 Database Addon plugin <= 1.3.1 - Unauthenticated Stored Cross-Site Scripting via tmpD Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via tmpD Parameter vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin Contact Form 7 Database Addon – CFDB7 versions = 1.3.1...

WordPress Super Store Finder plugin < 7.8 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Bonds in WordPress Plugin Super Store Finder versions 7.8...

WordPress LoginWP - Pro Plugin <= 4.0.8.5 - Broken Access Control vulnerability

WordPress LoginWP - Pro Plugin = 4.0.8.5 - Broken Access Control vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin LoginWP - Pro versions = 4.0.8.5...

WordPress Ultimate Push Notifications plugin <= 1.2.0 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by astra.r3verii in WordPress Plugin Ultimate Push Notifications versions = 1.2.0...

WordPress Profiler - What Slowing Down Your WP <= 1.0.0 - Broken Access Control Vulnerability

WordPress Profiler - What Slowing Down Your WP = 1.0.0 - Broken Access Control Vulnerability discovered by ch4r0n Patchstack Alliance in WordPress Plugin Profiler - What Slowing Down Your WP versions = 1.0.0...

WordPress Pay with Contact Form 7 plugin <= 1.0.4 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Pay with Contact Form 7 versions = 1.0.4...

WordPress CSS3 Compare Pricing Tables for WordPress plugin <= 11.6 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao KhanhVCI - VNPT in WordPress Plugin CSS3 Compare Pricing Tables for WordPress versions = 11.6...

WordPress Wordpress Auto Spinner plugin <= 3.26.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Anhchangmutrang in WordPress Plugin Wordpress Auto Spinner versions = 3.26.0...

WordPress Dot html,php,xml etc pages plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Dot html,php,xml etc pages versions = 1.0...

WordPress Tennis Court Bookings plugin <= 1.2.7 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Tennis Court Bookings versions = 1.2.7...

WordPress Contact Form 7 Editor Button plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Contact Form 7 Editor Button versions = 1.0.0...

WordPress Infility Global plugin <= 2.13.4 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by astra.r3verii in WordPress Plugin Infility Global versions = 2.13.4...

WordPress Multi-language Responsive Contact Form plugin <= 2.8 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by ch4r0n in WordPress Plugin Multi-language Responsive Contact Form versions = 2.8...

WordPress Torod plugin <= 2.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Martino Spagnuolo r3verii in WordPress Plugin Torod versions = 2.1...

WordPress CoSchool LMS plugin <= 1.4.3 - PHP Object Injection Vulnerability

PHP Object Injection Vulnerability discovered by Drew / mcdruid in WordPress Plugin CoSchool LMS versions = 1.4.3...

WordPress WoodMart Theme <= 8.2.3 is vulnerable to Local File Inclusion

Software WoodMart Type Theme Vulnerable versions = 8.2.3 Fixed in 8.2.4 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2025-6746 Patch priority Low CVSS severity Low 7.5 Developer Xtemos PSID fa6d0144ad7f Credits stealthcopter Required privilege Contributor Published 7 Jul...

WordPress Ofiz - WordPress Business Consulting Theme Theme <= 2.0 is vulnerable to Cross Site Scripting (XSS)

Software Ofiz - WordPress Business Consulting Theme Type Theme Vulnerable versions = 2.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2025-31072 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 46fba1f0778c Credits Tran Nguye...

WordPress WoodMart Theme <= 8.2.3 is vulnerable to Cross Site Scripting (XSS)

Software WoodMart Type Theme Vulnerable versions = 8.2.3 Fixed in 8.2.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2025-6743 Patch priority Low CVSS severity Low 6.5 Developer Xtemos PSID 119b4b01c8c2 Credits stealthcopter Required privilege...