WordPress XStore theme <= 9.5.4 - Authenticated (Subscriber+) Local File Inclusion vulnerability

Authenticated Subscriber+ Local File Inclusion vulnerability discovered by khanhhnahk1 in WordPress Theme XStore versions = 9.5.4...

CVE-2025-8593

The GSheetConnector For Gravity Forms plugin for WordPress is vulnerable to authorization bypass in versions less than, or equal to, 1.3.27. This is due to a missing capability check on the 'installplugin' function. This makes it possible for authenticated attackers, with subscriber-level access...

EUVD-2025-33844

The GSheetConnector For Gravity Forms plugin for WordPress is vulnerable to authorization bypass in versions less than, or equal to, 1.3.27. This is due to a missing capability check on the 'installplugin' function. This makes it possible for authenticated attackers, with subscriber-level access...

EUVD-2025-33843

The WP Links Page plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 4.9.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticat...

CVE-2025-10175 WP Links Page <= 4.9.6 - Authenticated (Subscriber+) SQL Injection

The WP Links Page plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 4.9.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticat...

CVE-2025-8593

CVE-2025-8593 affects the GSheetConnector For Gravity Forms WordPress plugin, with versions

CVE-2025-8593 GSheetConnector For Gravity Forms <= 1.3.27 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation

The GSheetConnector For Gravity Forms plugin for WordPress is vulnerable to authorization bypass in versions less than, or equal to, 1.3.27. This is due to a missing capability check on the 'installplugin' function. This makes it possible for authenticated attackers, with subscriber-level access...

CVE-2025-10175

The CVE-2025-10175 entry covers the WP Links Page plugin for WordPress, vulnerable to SQL Injection via the id parameter in all versions up to and including 4.9.6. The issue arises from insufficient escaping of the user-supplied id and inadequate preparation of the existing SQL query, allowing au...

CVE-2025-6038

The Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme plugin for WordPress is vulnerable to privilege escalation via password update in all versions up to, and including, 1.4.0. This is due to the plugin not properly validating a user's identity prior to updating...

CVE-2025-6038

The Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme plugin for WordPress is vulnerable to privilege escalation via password update in all versions up to, and including, 1.4.0. This is due to the plugin not properly validating a user's identity prior to updating...

CVE-2025-10494

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation when deleting profile pictures in all versions up to, and including, 1.4.89. This makes it possible for authenticated attackers, with...

CVE-2025-10587

The Community Events plugin for WordPress is vulnerable to SQL Injection via the eventcategory parameter in all versions up to, and including, 1.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

EUVD-2025-33236

The Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme plugin for WordPress is vulnerable to privilege escalation via password update in all versions up to, and including, 1.4.0. This is due to the plugin not properly validating a user's identity prior to updating...

EUVD-2025-33267

The Community Events plugin for WordPress is vulnerable to SQL Injection via the ‘eventvenue’ parameter in all versions up to, and including, 1.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

PT-2025-41329

Name of the Vulnerable Software and Affected Versions WordPress Community Events plugin versions through 1.5.1 Description The WordPress Community Events plugin is susceptible to a SQL Injection issue due to inadequate input sanitization of the event venue parameter. This allows authenticated...

PT-2025-41355

Name of the Vulnerable Software and Affected Versions Lisfinity Core plugin for WordPress versions prior to 1.4.1 Description The Lisfinity Core plugin for WordPress is susceptible to privilege escalation. An authenticated attacker with Subscriber-level access or higher can modify passwords for a...

CVE-2025-10635 Find Me On <= 2.0.9.1 - Subscriber+ SQL Injection

The Find Me On WordPress plugin through 2.0.9.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing subscribers and above to perform SQL injection attacks...

CVE-2025-10587 Community Events <= 1.5.1 - Unauthenticated SQL Injection

The Community Events plugin for WordPress is vulnerable to SQL Injection via the eventcategory parameter in all versions up to, and including, 1.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2025-10494

CVE-2025-10494 affects the Motors – Car Dealership & Classified Listings Plugin for WordPress (versions up to 1.4.89). The root cause is insufficient validation of file paths when deleting profile pictures, allowing an authenticated attacker with Subscriber-level access or higher to delete arbitr...

PT-2025-41230

Name of the Vulnerable Software and Affected Versions Find Me On WordPress plugin versions through 2.0.9.1 Description The Find Me On WordPress plugin does not properly sanitize and escape a parameter before using it in a SQL query. This allows users with subscriber privileges or higher to execut...