CVE-2025-24810

CVE-2025-24810 affects the WordPress plugin Simple Image Sizes (versions ≤ 3.2.3). The observed issue is a cross-site scripting vulnerability that, if exploited, can execute arbitrary script in the web browser of an admin user when accessing the settings screen. The root cause is a stored XSS vec...

WordPress plugin Simple Image Sizes 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin ... A cross-site scripting...

PT-2025-5579 · Unknown · Simple Image Sizes

Name of the Vulnerable Software and Affected Versions: Simple Image Sizes versions 3.2.3 and earlier Description: A cross-site scripting issue exists, allowing an arbitrary script to be executed on the web browser of a user with administrative privileges who accesses the settings screen. This can...

JVN#88046370: WordPress Plugin "Simple Image Sizes" vulnerable to cross-site scripting

WordPress Plugin "Simple Image Sizes" provided by Rahe contains a stored cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the web browser of the user who is logging in to the product with the administrative privilege and accessing the settings screen...

CVE-2025-22513

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Kyle Phillips Simple Locator simple-locator allows Reflected XSS.This issue affects Simple Locator: from n/a through = 2.0.4...

CVE-2025-22513

CVE-2025-22513 — WordPress Simple Locator (

CVE-2025-22513 WordPress Simple Locator Plugin <= 2.0.4 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NotFound Simple Locator allows Reflected XSS. This issue affects Simple Locator: from n/a through 2.0.4...

CVE-2025-22513 WordPress Simple Locator Plugin <= 2.0.4 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Kyle Phillips Simple Locator simple-locator allows Reflected XSS.This issue affects Simple Locator: from n/a through = 2.0.4...

WordPress plugin Simple Locator 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerability...

PT-2025-4506 · Unknown · Simple Locator

Name of the Vulnerable Software and Affected Versions: Simple Locator versions n/a through 2.0.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Reflected XSS in NotFound Simple Locator...

WordPress Simple Downloads List plugin <= 1.4.2 - Authenticated (Contributor+) SQL Injection vulnerability

Authenticated Contributor+ SQL Injection vulnerability discovered by Peter Thaleikis in WordPress Plugin Simple Downloads List versions = 1.4.2...

WordPress Simple Gallery with Filter plugin <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin Simple Gallery with Filter versions = 2.0...

CVE-2025-24703

Server-Side Request Forgery SSRF vulnerability in Ronald Huereca Comment Edit Core – Simple Comment Editing simple-comment-editing allows Server Side Request Forgery.This issue affects Comment Edit Core – Simple Comment Editing: from n/a through = 3.0.33...

CVE-2025-24663

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in mra13 Simple Download Monitor simple-download-monitor allows Blind SQL Injection.This issue affects Simple Download Monitor: from n/a through = 3.9.25...

CVE-2025-24634

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Svetoslav Marinov Orbisius Simple Notice orbisius-simple-notice allows Stored XSS.This issue affects Orbisius Simple Notice: from n/a through = 1.1.3...

CVE-2025-24623

Cross-Site Request Forgery CSRF vulnerability in Really Simple Plugins Really Simple SSL really-simple-ssl allows Cross Site Request Forgery.This issue affects Really Simple SSL: from n/a through = 9.1.4...

CVE-2025-24703

CVE-2025-24703 describes a Server-Side Request Forgery (SSRF) in the WordPress plugin Comment Edit Core – Simple Comment Editing (DLX Plugins) up to version 3.0.33 . The vulnerability allows SSRF within the affected component, potentially enabling an attacker to induce the server to make requests...

CVE-2025-24703 WordPress Comment Edit Core – Simple Comment Editing Plugin <= 3.0.33 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in Ronald Huereca Comment Edit Core – Simple Comment Editing simple-comment-editing allows Server Side Request Forgery.This issue affects Comment Edit Core – Simple Comment Editing: from n/a through = 3.0.33...

CVE-2025-24663

CVE-2025-24663 : SQL Injection in WordPress plugin Simple Download Monitor (versions up to 3.9.25). Description and Red Hat/Redirection sources confirm improper neutralization of SQL commands enabling blind SQL injection. Base impact is high (CVSS 3.1: 7.6; Network access, high confidentiality im...

CVE-2025-24663 WordPress Simple Download Monitor plugin <= 3.9.25 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in mra13 Simple Download Monitor simple-download-monitor allows Blind SQL Injection.This issue affects Simple Download Monitor: from n/a through = 3.9.25...