CVE-2025-11172: Missing Authorization

The Check Plagiarism plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the chkplagminepluginwpse10500adminaction function in all versions up to, and including, 2.0. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2025-11257: Missing Authorization

The LLM Hubspot Blog Import plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'processsaveblogs' AJAX endpoint in all versions up to, and including, 1.0.1. This makes it possible for authenticated attackers, with Subscriber-level acce...

CVE-2025-11887: Missing Authorization

The Supervisor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX functions in all versions up to, and including, 1.3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update...

CVE-2025-11128: Server-Side Request Forgery (SSRF)

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.1.0 via the 'feedzysanitizefeeds' function. This makes it possible for authenticated attackers...

PT-2025-43510

Name of the Vulnerable Software and Affected Versions Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress versions up to and including 5.1.0 Description The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator...

CVE-2025-10570: Authorization Bypass Through User-Controlled Key

The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.38 via the saverefundrequest function. This makes it possible for authenticated attackers, with subscriber-level access and above, to submit...

CVE-2025-6833: Authorization Bypass Through User-Controlled Key

The All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0 via the 'aiotimeclocklitejs' AJAX action due to missing validation on a user controlled key. This makes it...

PT-2025-43022

Name of the Vulnerable Software and Affected Versions Flexible Refund and Return Order for WooCommerce versions prior to 1.0.39 Description The plugin contains a missing authorization flaw within the save refund request function. This allows authenticated users with subscriber-level permissions o...

PT-2025-42820

Name of the Vulnerable Software and Affected Versions Element Pack Addons for Elementor plugin for WordPress versions up to and including 8.2.5 Description The Element Pack Addons for Elementor plugin for WordPress is susceptible to a Blind Server-Side Request Forgery issue. This affects versions...

CVE-2025-11536: Server-Side Request Forgery (SSRF)

The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 8.2.5 via the wpajaximportelementortemplate action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to ma...

CVE-2020-36854 Async JavaScript <= 2.19.07.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting

The Async JavaScript plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.19.07.14. This is due to missing authorization checks on the ajsteps AJAX aciton along with a lack on sanitization on the settings saved via the function. This makes it...

PT-2025-42690

Name of the Vulnerable Software and Affected Versions WPC Smart Wishlist for WooCommerce plugin for WordPress versions through 5.0.4 Description The WPC Smart Wishlist for WooCommerce plugin for WordPress is susceptible to unauthorized data access. A missing capability check on the wishlist...

PT-2025-42672

Name of the Vulnerable Software and Affected Versions Async JavaScript plugin for WordPress versions prior to 2.19.07.14 Description The software is susceptible to Stored Cross-Site Scripting due to missing authorization checks on the aj steps AJAX action and insufficient sanitization of settings...

CVE-2025-11742: Missing Authorization

The WPC Smart Wishlist for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'wishlistquickview' AJAX action in all versions up to, and including, 5.0.4. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2020-36854: Improper Neutralization of Input During Web Page Generation

The Async JavaScript plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.19.07.14. This is due to missing authorization checks on the ajsteps AJAX aciton along with a lack on sanitization on the settings saved via the function. This makes it...

CVE-2025-10706: Missing Authorization

The Classified Pro theme for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check in the 'cwpaddonsupdateplugincb' function in all versions up to, and including, 1.0.14. This makes it possible for authenticated attackers, with subscriber-level access and...

PT-2025-42295

Name of the Vulnerable Software and Affected Versions Library Management System plugin for WordPress versions prior to 3.2 Description The Library Management System plugin for WordPress is susceptible to unauthorized data modification. This is due to a missing capability check within the owt7...

CVE-2025-10293: Improper Authentication

The Keyy Two Factor Authentication like Clef plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.2.3. This is due to the plugin not properly validating a user's identity associated with a token generated. This makes it possible f...

CVE-2025-10303: Missing Authorization

The Library Management System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the owt7librarymanagementajaxhandler function in all versions up to, and including, 3.1. This makes it possible for authenticated attackers, with...

CVE-2025-11196: Exposure of Sensitive Information to an Unauthorized Actor

The External Login plugin for WordPress is vulnerable to sensitive information exposure in all versions up to, and including, 1.11.2 due to the 'exlogtestconnection' AJAX action lacking capability checks or nonce validation. This makes it possible for authenticated attackers, with subscriber-leve...