CVE-2025-62052 WordPress One Page Express Companion plugin <= 1.6.43 - Broken Access Control vulnerability

Missing Authorization vulnerability in Horea Radu One Page Express Companion one-page-express-companion.This issue affects One Page Express Companion: from n/a through = 1.6.43...

CVE-2025-62042

CVE-2025-62042 is a Cross-Site Scripting (XSS) vulnerability in the WordPress plugin “Event post” (event-post) affecting versions up to and including 5.10.3. The issue stems from improper input neutralization during web page generation, enabling an attacker to inject malicious scripts. Exploitati...

CVE-2025-62024 WordPress Pie Calendar plugin <= 1.2.9 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jonathan Jernigan Pie Calendar pie-calendar.This issue affects Pie Calendar: from n/a through = 1.2.9...

CVE-2025-62023

CVE-2025-62023 corresponds to a WordPress s2Member plugin vulnerability (versions up to 250905) described as an improper generation of code leading to remote code execution (code injection). The CVE documents list a critical impact (CVSS v3.1 base score 9.8) with unauthenticated access mogelijk v...

CVE-2025-62021

CVE-2025-62021 describes a Missing Authorization (Broken Access Control) flaw in the WordPress plugin Acknowledgify, affecting versions

CVE-2025-62022

CVE-2025-62022 affects the WordPress BuddyPress plugin up to version 14.3.4 and is described as a Missing Authorization (Broken Access Control) vulnerability. The issue is scoped to BuddyPress versions ≤ 14.3.4; CVSS 3.1 base score 7.5 (I: High). Exploitation details, specific vulnerable componen...

CVE-2025-62021 WordPress Acknowledgify plugin <= 1.1.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Made Neat Acknowledgify acknowledgify.This issue affects Acknowledgify: from n/a through = 1.1.3...

CVE-2025-60238

CVE-2025-60238 describes a deserialization of untrusted data vulnerability in the WordPress plugin UNIVERSAM (universam-demo) affecting versions from n/a through

CVE-2025-62006

CVE-2025-62006 refers to a Missing Authorization vulnerability in the WordPress WP SMS plugin (VeronaLabs WP SMS wp-sms) affecting versions up to 7.0.1. The connected documents identify this as a Broken Access Control issue that could enable an attack with network access, low privileges required,...

CVE-2025-60217

CVE-2025-60217 describes a path traversal vulnerability in WordPress PT Luxa Addons (pt-luxa-addons) affecting versions up to 1.2.2. Multiple sources (NVD, Red Hat, CVE List, CNNVD, EUVD, vulnrichment, Patchstack) concur that improper restriction of pathname access enables path traversal, with Pa...

CVE-2025-60216 WordPress Addison theme < 1.4.8 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in BoldThemes Addison addison allows Object Injection.This issue affects Addison: from n/a through 1.4.8...

CVE-2025-60220

The CVE concerns WordPress CouponXxL theme (

CVE-2025-60176 WordPress WP Tesseract Plugin <= 1.0.2 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in tattersoftware WP Tesseract wp-tesseract allows Stored XSS.This issue affects WP Tesseract: from n/a through = 1.0.2...

CVE-2025-60151 WordPress WP Gravity Forms HubSpot Plugin <= 1.2.5 - Open Redirection Vulnerability

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in CRM Perks WP Gravity Forms HubSpot gf-hubspot allows Phishing.This issue affects WP Gravity Forms HubSpot: from n/a through = 1.2.5...

CVE-2025-60151 WordPress WP Gravity Forms HubSpot Plugin <= 1.2.5 - Open Redirection Vulnerability

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in CRM Perks WP Gravity Forms HubSpot gf-hubspot allows Phishing.This issue affects WP Gravity Forms HubSpot: from n/a through = 1.2.5...

CVE-2025-60041

CVE-2025-60041 is a publicly disclosed vulnerability in the WordPress plugin Emails Catch All (versions

CVE-2025-59579 WordPress Simple Job Board plugin <= 2.13.7 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in PressTigers Simple Job Board simple-job-board allows Retrieve Embedded Sensitive Data.This issue affects Simple Job Board: from n/a through = 2.13.7...

CVE-2025-58970 WordPress Doctreat theme <= 1.6.7 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in AmentoTech Doctreat doctreat allows Code Injection.This issue affects Doctreat: from n/a through = 1.6.7...

CVE-2025-59006 WordPress Easy Woocommerce Customizer plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in themebon Easy Woocommerce Customizer easy-woocommerce-customizer allows Reflected XSS.This issue affects Easy Woocommerce Customizer: from n/a through = 1.0.2...

CVE-2025-53420 WordPress WPLMS plugin <= 1.9.9.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in VibeThemes WPLMS wplmsplugin allows Reflected XSS.This issue affects WPLMS: from n/a through = 1.9.9.8...