10026 matches found
CVE-2025-2111 WP Headers And Footers <= 3.1.1 - Cross-Site Request Forgery to Arbitrary Options Update
The Insert Headers And Footers plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.1. This is due to missing or incorrect nonce validation on the 'custompluginsetoption' function. This makes it possible for unauthenticated attackers to update...
CVE-2025-2010
The JobWP – Job Board, Job Listing, Career Page and Recruitment Plugin plugin for WordPress is vulnerable to SQL Injection via the 'jobwpuploadresume' parameter in all versions up to, and including, 2.3.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparati...
CVE-2025-3278
The UrbanGo Membership plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.0.4. This is due to the plugin allowing users who are registering new accounts to set their own role or by supplying 'userregisterrole' field. This makes it possible for...
EUVD-2025-11919
The JobWP – Job Board, Job Listing, Career Page and Recruitment Plugin plugin for WordPress is vulnerable to SQL Injection via the 'jobwpuploadresume' parameter in all versions up to, and including, 2.3.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparati...
CVE-2025-3284 User Registration & Membership PRO – Custom Registration Form, Login Form, and User Profile <= 5.1.3 - Cross-Site Request Forgery to User Deletion
The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.1.3. This is due to missing or incorrect nonce validation on the userregistrationprodeleteaccount...
CVE-2025-3598
The Coupon Affiliates – Affiliate Plugin for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the commissionsummary parameter in all versions up to, and including, .6.3.0 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2025-3598 Coupon Affiliates – Affiliate Plugin for WooCommerce <= 6.3.0 - Reflected Cross-Site Scripting via 'commission_summary' Parameter
The Coupon Affiliates – Affiliate Plugin for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the commissionsummary parameter in all versions up to, and including, .6.3.0 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2025-3598
CVE-2025-3598 concerns the Coupon Affiliates – Affiliate Plugin for WooCommerce for WordPress. It is a reflected Cross-Site Scripting vulnerability exploitable via the commission_summary parameter in all versions up to and including 6.3.0, caused by insufficient input sanitization and output esca...
CVE-2024-13452
The Contact Form by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.29. This is due to missing or incorrect nonce validation on a saveAsCopy function. This makes it possible for unauthenticated attackers to update settings and...
CVE-2025-30514
Unauthenticated attackers can obtain restricted information about a user's smart device collections i.e., "scenes"...
CVE-2025-30257
Unauthenticated attackers can retrieve serial number of smart meters associated to a specific user account...
CVE-2025-30512
Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely e.g., on/off...
CVE-2025-27719
Unauthenticated attackers can query an API endpoint and get device details...
CVE-2025-27561
Unauthenticated attackers can rename "rooms" of arbitrary users...
CVE-2025-27938
Unauthenticated attackers can obtain restricted information about a user's smart device collections i.e., "rooms"...
CVE-2025-27929
Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts...
CVE-2025-27927
An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprotected API...
CVE-2025-24315
Unauthenticated attackers can add devices of other users to their scenes or arbitrary scenes of other arbitrary users...