PT-2025-9822

Name of the Vulnerable Software and Affected Versions The Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More plugin for WordPress versions prior to 2.5.1 Description The issue allows unauthenticated attackers to extract sensitive data fro...

CVE-2024-11153: Exposure of Sensitive Information to an Unauthorized Actor

The Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5.0 via the WordPress core search feature. This makes it possible for...

PT-2025-9829

Name of the Vulnerable Software and Affected Versions The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin versions up to, and including, 2.10.0 Description The issue is related to a time-based SQL Injection vulnerability. It occurs du...

CVE-2025-1702: Improper Neutralization of Special Elements used in an SQL Command

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'search' parameter in all versions up to, and including, 2.10.0 due to insufficient escaping on the user suppli...

WordPress plugin Ultimate Member SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...

WordPress Ultimate Member plugin <= 2.10.0 - Unauthenticated SQL Injection via search Parameter vulnerability

Unauthenticated SQL Injection via search Parameter vulnerability discovered by mikemyers in WordPress Plugin Ultimate Member versions = 2.10.0...

CVE-2025-0370

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘src’ parameter in all versions up to, and including, 7.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-0958 Ultimate WordPress Auction Plugin <= 4.2.9 - Missing Authorization to Arbitrary Post Deletion

The Ultimate WordPress Auction Plugin plugin for WordPress is vulnerable to unauthorized access to functionality in all versions up to, and including, 4.2.9. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary auctions, posts as well as...

CVE-2025-0958 Ultimate WordPress Auction Plugin <= 4.2.9 - Missing Authorization to Arbitrary Post Deletion

The Ultimate WordPress Auction Plugin plugin for WordPress is vulnerable to unauthorized access to functionality in all versions up to, and including, 4.2.9. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary auctions, posts as well as...

WordPress Ultimate Auction plugin <= 4.2.9 - Missing Authorization to Arbitrary Post Deletion vulnerability

Missing Authorization to Arbitrary Post Deletion vulnerability discovered by Brian Sans-Souci liardom in WordPress Plugin Ultimate Auction versions = 4.2.9...

WordPress WP Shortcodes Ultimate plugin <= 7.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via src Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via src Parameter vulnerability discovered by stealthcopter in WordPress Plugin Shortcodes Ultimate versions = 7.3.3...

PT-2025-9650

Name of the Vulnerable Software and Affected Versions The Ultimate WordPress Auction Plugin versions prior to 4.3.0 Description The issue allows authenticated attackers with Contributor-level access and above to access functionality unauthorized, enabling them to delete arbitrary auctions, posts,...

PT-2025-9649

Name of the Vulnerable Software and Affected Versions WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress versions up to, and including, 7.3.3 Description The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, specifically via t...

CVE-2025-0958: Improper Input Validation

The Ultimate WordPress Auction Plugin plugin for WordPress is vulnerable to unauthorized access to functionality in all versions up to, and including, 4.2.9. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary auctions, posts as well as...

WordPress plugin Ultimate WordPress Auction Plugin 输入验证错误漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin ... An input validation erro...

CVE-2025-0370: Improper Neutralization of Input During Web Page Generation

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘src’ parameter in all versions up to, and including, 7.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

WordPress plugin Shortcodes Ultimate 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2025-23739

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in jtibbles WP Ultimate Reviews FREE wp-ultimate-reviews-free allows Reflected XSS.This issue affects WP Ultimate Reviews FREE: from n/a through = 1.0.2...

CVE-2025-23739 WordPress WP Ultimate Reviews FREE plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in jtibbles WP Ultimate Reviews FREE wp-ultimate-reviews-free allows Reflected XSS.This issue affects WP Ultimate Reviews FREE: from n/a through = 1.0.2...

CVE-2025-23739

CVE-2025-23739 is a Reflected Cross-Site Scripting vulnerability in the WordPress plugin WP Ultimate Reviews FREE (NotFound) affecting versions up to 1.0.2. The issue results from improper neutralization of input during web page generation. The available documents confirm the vulnerability and im...