CVE-2025-60154 WordPress MWW Disclaimer Buttons plugin <= 3.41 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jennifer Moss MWW Disclaimer Buttons mww-disclaimer-buttons allows Stored XSS.This issue affects MWW Disclaimer Buttons: from n/a through = 3.41...

CVE-2025-60152 WordPress Subscribe To Unlock Plugin <= 1.1.5 - Broken Access Control Vulnerability

Missing Authorization vulnerability in wpshuffle Subscribe To Unlock subscribe-to-unlock allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Subscribe To Unlock: from n/a through = 1.1.5...

CVE-2025-60149

CVE-2025-60149 affects Notely (WordPress plugin). Reported as Stored XSS due to Improper Input Neutralization during Web Page Generation. Affected: Notely versions up to 1.8.0. Required access: authenticated (Administrator+). Description and context come from the CVE entry and the Wordfence vulne...

CVE-2025-60144 WordPress Lenix scss compiler Plugin <= 1.2 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in yonifre Lenix scss compiler lenix-scss-compiler allows Stored XSS.This issue affects Lenix scss compiler: from n/a through = 1.2...

CVE-2025-60143 WordPress Netgsm plugin <= 2.9.69 - Broken Access Control vulnerability

Missing Authorization vulnerability in netgsm Netgsm netgsm allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Netgsm: from n/a through = 2.9.69...

CVE-2025-60141

CVE-2025-60141 is a stored XSS issue in the Tribal WordPress plugin. The vulnerability is caused by improper input neutralization during web page generation and is exploitable only by authenticated users with Administrator+ privileges. Affected versions: The Tribal up to 1.3.3. The Wordfence entr...

CVE-2025-60129

CVE-2025-60129: Missing Authorization in the Yext WordPress plugin (affected versions: n/a–1.1.3) allows accessing functionality not properly constrained by ACLs. The entry lists a basic impact (low) with no documented exploit details in the provided data, and no connected documents specify root ...

CVE-2025-60128 WordPress Delisho Plugin <= 1.1.3 - Broken Access Control Vulnerability

Missing Authorization vulnerability in WP Delicious Delisho dr-widgets-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Delisho: from n/a through = 1.1.3...

CVE-2025-60128

CVE-2025-60128 affects the Delisho WordPress plugin (Delisho – Recipe Widgets and Blocks) up to version 1.1.3. The issue is Missing Authorization allowing unauthorized updates to Options via wcmlim_settings_ajax_handler, as documented in the CVE entry and corroborated by the Wordfence vulnerabili...

CVE-2025-60117 WordPress Vehica Core Plugin <= 1.0.100 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in TangibleWP Vehica Core vehica-core allows Cross Site Request Forgery.This issue affects Vehica Core: from n/a through = 1.0.100...

CVE-2025-60113 WordPress Groovy Menu Plugin <= 1.4.3 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in grooni Groovy Menu groovy-menu-free allows Cross Site Request Forgery.This issue affects Groovy Menu: from n/a through = 1.4.3...

CVE-2025-4957

The CVE-2025-4957 entry concerns the WordPress ProfileGrid plugin (versions up to and including 5.9.5.7). The issue is a Reflected Cross-Site Scripting (XSS) vulnerability caused by improper input neutralization during web page generation. Exploitation could allow injected scripts to run in a use...

CVE-2025-10747

The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the download-add.php file in all versions up to, and including, 1.68.11. This makes it possible for authenticated attackers, with Administrator-level access and above, to...

CVE-2025-11000

Open Babel up to 3.1.1 is affected by a vulnerability in PQSFormat::ReadMolecule (/src/formats/PQSformat.cpp) that can trigger a NULL pointer dereference. The attack is local, with exploitation information publicly disclosed. Affected products are Open Babel versions up to 3.1.1; remediation deta...

CVE-2025-9044 Mapster WP Maps <= 1.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple fields in versions up to, and including, 1.20.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level permissions and...

CVE-2025-9044

CVE-2025-9044 : Mapster WP Maps (WordPress plugin) is affected by a Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. Exploitation requires authentication (contributor level or higher) and can allow injection of web scripts on pages viewed by users. Affected ...

CVE-2025-10998 Open Babel chemkinformat.cpp ReadReactionQualifierLines null pointer dereference

A vulnerability has been found in Open Babel up to 3.1.1. The affected element is the function ChemKinFormat::ReadReactionQualifierLines of the file /src/formats/chemkinformat.cpp. The manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The...

WordPress Backuply plugin <= 1.4.8 - Authenticated (Admin+) Arbitrary File Deletion vulnerability

Authenticated Admin+ Arbitrary File Deletion vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Backuply – Backup, Restore, Migrate and Clone versions = 1.4.8...

PT-2025-39615

Name of the Vulnerable Software and Affected Versions rozx Recaptcha – wp versions through 0.2.6 Description The software contains a flaw related to improper input handling during web page generation, which allows for Stored Cross-Site Scripting XSS. This means that malicious scripts can be...

WordPress Mapster WP Maps plugin <= 1.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zer0gh0st in WordPress Plugin Mapster WP Maps versions = 1.20.0...