CVE-2025-57970

Technical details for CVE-2025-57970 are not provided in the connected documents. A related SALESmanago item (CVE-2025-57971) mentions missing authorization, but does not provide CVE-2025-57970 specifics; monitor for updates.

CVE-2025-57971 WordPress SALESmanago Plugin <= 3.8.1 - Broken Access Control Vulnerability

Missing Authorization vulnerability in SALESmanago SALESmanago & Leadoo salesmanago allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SALESmanago & Leadoo: from n/a through = 3.8.1...

CVE-2025-57974

CVE-2025-57974 documents a Cross‑Site Scripting (Stored XSS) vulnerability in the WordPress plugin TZ Plus Gallery. Affected range: TZ Plus Gallery

CVE-2025-57985 WordPress Ultimate Watermark Plugin <= 1.1 - Broken Access Control Vulnerability

Missing Authorization vulnerability in MantraBrain Ultimate Watermark ultimate-watermark allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Watermark: from n/a through = 1.1...

CVE-2025-57996 WordPress Buckets Plugin <= 0.3.9 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in matthewordie Buckets buckets allows Stored XSS.This issue affects Buckets: from n/a through = 0.3.9...

CVE-2025-58000

CVE-2025-58000 is a Missing Authorization vulnerability in the Memberful WordPress plugin (Memberful – Membership Plugin) that allows accessing functionality not properly constrained by ACLs. Affected software: Memberful, version range from unknown up through 1.75.0. Root cause: Missing authoriza...

CVE-2025-58007 WordPress Social Pug Plugin <= 1.35.1 - Sensitive Data Exposure Vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in NerdPress Social Pug allows Retrieve Embedded Sensitive Data. This issue affects Social Pug: from n/a through 1.35.1...

CVE-2025-58010

Technical details beyond the initial description are not provided in the connected documents. The CSRF issue in SV Proven Expert for WordPress is described only at a high level; monitor for updates for affected versions and fixes.

CVE-2025-58011 WordPress Content Mask plugin <= 1.8.5.2 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in Alex Content Mask content-mask allows Server Side Request Forgery.This issue affects Content Mask: from n/a through = 1.8.5.2...

CVE-2025-58010 WordPress SV Proven Expert Plugin <= 2.0.06 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in straightvisions GmbH SV Proven Expert sv-provenexpert allows Cross Site Request Forgery.This issue affects SV Proven Expert: from n/a through = 2.0.06...

CVE-2025-58021 WordPress List Child Pages Shortcode Plugin <= 1.3.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in douglaskarr List Child Pages Shortcode list-child-pages-shortcode allows Stored XSS.This issue affects List Child Pages Shortcode: from n/a through = 1.3.1...

CVE-2025-58027 WordPress NGG Smart Image Search Plugin <= 3.4.3 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpo-HR NGG Smart Image Search ngg-smart-image-search allows Stored XSS.This issue affects NGG Smart Image Search: from n/a through = 3.4.3...

CVE-2025-58199

Summary: CVE-2025-58199 is a CSRF vulnerability in Fastly (the Fastly service) affecting versions up to 1.2.28. The accompanying metrics show base CVSS v3.1 score 4.3 (Medium) with network attack vector, low integrity impact, and user interaction required. The connected document indicates the iss...

CVE-2025-58219 WordPress Show Pages List Plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in LIJE Show Pages List show-pages-list allows Cross Site Request Forgery.This issue affects Show Pages List: from n/a through = 1.2.0...

CVE-2025-58222 WordPress Team Manager plugin <= 2.5.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Maidul Team Manager wp-team-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team Manager: from n/a through = 2.5.1...

CVE-2025-58223

CVE-2025-58223 describes a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin VoucherPress. Affected: VoucherPress versions from n/a up to and including 1.5.7. The CVE notes an input handling issue during web page generation that enables stored XSS. The vulnerability is rated...

CVE-2025-58224

Cross-Site Request Forgery CSRF vulnerability in Printeers Printeers Print & Ship invition-print-ship allows Cross Site Request Forgery.This issue affects Printeers Print & Ship: from n/a through = 1.17.0...

CVE-2025-58227 WordPress Podlove Subscribe button Plugin <= 1.3.11 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Alexander Lueken Podlove Subscribe button podlove-subscribe-button allows Stored XSS.This issue affects Podlove Subscribe button: from n/a through = 1.3.11...

CVE-2025-58237

CVE-2025-58237: LC Wizard (Connector Wizard) for WordPress has a stored XSS in LC Wizard/Connector Wizard up to version 1.4.0 (initial cites 1.3.0). Root cause: improper input neutralization during web page generation. Affected plugin: Connector Wizard (formerly LC Wizard); vulnerability context ...

CVE-2025-58239

CVE-2025-58239 describes a stored cross-site scripting vulnerability in the WordPress plugin “Category Dropdown” (WP Category Dropdown) by GCS Design, affecting versions up to 1.9 (input handling during web page generation is not properly neutralized). The CVE entry notes stored XSS as the vulner...