CVE-2024-13895: Improper Control of Generation of Code

The The Code Snippets CPT plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.1.0. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...

PT-2025-10437

Name of the Vulnerable Software and Affected Versions Post Lockdown plugin for WordPress versions prior to 4.1 Description The issue allows authenticated attackers with Subscriber-level access and above to extract data from password-protected, private, or draft posts they should not have access t...

PT-2025-10436

Name of the Vulnerable Software and Affected Versions Shortcode Cleaner Lite plugin for WordPress versions prior to 1.0.10 Description The issue allows unauthorized access to data due to a missing capability check on the download backup function. This makes it possible for authenticated attackers...

PT-2025-10423

Name of the Vulnerable Software and Affected Versions The Code Snippets CPT plugin for WordPress versions prior to 2.1.1 Description The issue arises from the software's failure to properly validate a value before executing the do shortcode function, allowing authenticated attackers with...

CVE-2025-1325: Missing Authorization

The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to arbitrary shortcode execution due to a missing capability check on the 'rclpreviewpost' AJAX endpoint in all versions up to, and including, 16.26.10. This makes it possible for authenticated attackers, wi...

PT-2025-10432

Name of the Vulnerable Software and Affected Versions WP-Recall – Registration, Profile, Commerce & More plugin for WordPress versions up to, and including, 16.26.10 Description The issue is related to arbitrary shortcode execution due to a missing capability check on the "rcl preview post" AJAX...

CVE-2024-10326: Missing Authorization

The RomethemeKit For Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveoptions and resetwidgets functions in all versions up to, and including, 1.5.3. This makes it possible for authenticated attackers, with...

CVE-2024-13816: Missing Authorization

The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability checks on multiple functions in all versions up to, and including, 2.3.6. This mak...

CVE-2025-1481: Missing Authorization

The Shortcode Cleaner Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the downloadbackup function in all versions up to, and including, 1.0.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

CVE-2025-1768

CVE-2025-1768 affects the SEO Plugin by Squirrly SEO for WordPress. The vulnerability is a blind SQL Injection in the plugin’s search parameter, exploitable on all versions up to 12.4.05 due to insufficient escaping of user input and inadequate preparation of the SQL query. With Subscriber-level ...

CVE-2025-1768 SEO Plugin by Squirrly SEO <= 12.4.05 - Authenticated (Subscriber+) SQL Injection via search Parameter

The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to blind SQL Injection via the 'search' parameter in all versions up to, and including, 12.4.05 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2024-13787

The VEDA - MultiPurpose WordPress Theme theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.2 via deserialization of untrusted input in the 'vedabackupandrestoreaction' function. This makes it possible for authenticated attackers, with Subscriber-leve...

CVE-2025-1309

CVE-2025-1309 affects UiPress lite for WordPress. A missing capability check in uip_save_form_as_option() in all versions up to 3.5.04 allows authenticated users with Subscriber-level access or higher to modify arbitrary options, enabling privilege escalation (e.g., changing the default registrat...

CVE-2024-13526

CVE-2024-13526 affects the EventPrime – Events Calendar, Bookings and Tickets WordPress plugin. The root cause is missing capability checks in the export_submittion_attendees function across all versions up to 4.0.7.3, enabling authenticated users with Subscriber-level access and higher to downlo...

CVE-2024-13526 EventPrime – Events Calendar, Bookings and Tickets <= 4.0.7.3 - Missing Authorization to Authenticated (Subscriber+) Event Attendees Export

The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability checks on the exportsubmittionattendees function in all versions up to, and including, 4.0.7.3. This makes it possible for authenticated attackers,...

WordPress plugin CS Framework 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal...

PT-2025-10054

Name of the Vulnerable Software and Affected Versions CS Framework plugin for WordPress versions up to and including 6.9 Description The issue arises from insufficient file path validation in the cs widget file delete function, allowing authenticated attackers with Subscriber-level access or high...

CVE-2024-13655: Missing Authorization

The Flex Mag - Responsive WordPress News Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the propanelofajaxcallback function in all versions up to, and including, 3.5.2. This makes it possible f...

PT-2025-10055

Name of the Vulnerable Software and Affected Versions CS Framework plugin for WordPress versions prior to 6.9 Description The issue allows authenticated attackers with subscriber-level access and above to read the contents of arbitrary files on the server, potentially containing sensitive...

PT-2025-10044

Name of the Vulnerable Software and Affected Versions The Flex Mag - Responsive WordPress News Theme versions up to, and including, 3.5.2 Description The issue allows authenticated attackers with Subscriber-level access and above to modify data, potentially leading to a denial of service. This is...