CVE-2025-58249

CVE-2025-58249 involves Themeum Qubely (qubely) for WordPress, described as an Insertion of Sensitive Information Into Sent Data vulnerability that can lead to retrieval of embedded sensitive data. Affected product/version range stated as Qubely: from n/a through

CVE-2025-58252 WordPress Getwid Plugin <= 2.1.2 - Sensitive Data Exposure Vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in jetmonsters Getwid getwid allows Retrieve Embedded Sensitive Data.This issue affects Getwid: from n/a through = 2.1.2...

CVE-2025-58256 WordPress DOAJ Export Plugin <= 1.0.4 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jonathan Brinley DOAJ Export doaj-export allows Stored XSS.This issue affects DOAJ Export: from n/a through = 1.0.4...

CVE-2025-58260 WordPress Highlight and Share – Social Text and Image Sharing plugin <= 5.1.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ronald Huereca Highlight and Share highlight-and-share allows Stored XSS.This issue affects Highlight and Share: from n/a through = 5.1.1...

CVE-2025-58269

CVE-2025-58269 affects WP Project Manager (weDevs). The vulnerability is described as a hard-coded credentials issue that could allow retrieval of embedded sensitive data from WP Project Manager versions up to 2.6.25. The connected data indicates no published exploit details in the provided docs,...

CVE-2025-58647

CVE-2025-58647 is a stored XSS in the WordPress plugin Simple Restaurant Menu. Affected: Simple Restaurant Menu

CVE-2025-58646 WordPress Mobi2Go Plugin <= 1.0.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in chtombleson Mobi2Go mobi2go allows Stored XSS.This issue affects Mobi2Go: from n/a through = 1.0.0...

CVE-2025-58646

CVE-2025-58646 affects Mobi2Go (WordPress plugin). Reported as an Improper Neutralization of Input During Web Page Generation (Stored XSS) affecting Mobi2Go: from n/a through 1.0.0. Public details in the initial document indicate a Stored XSS vulnerability via insufficient input sanitization, wit...

CVE-2025-58655 WordPress Category Featured Images Plugin <= 1.1.8 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Mat Category Featured Images category-featured-images allows Stored XSS.This issue affects Category Featured Images: from n/a through = 1.1.8...

CVE-2025-58660 WordPress Oshine Core Plugin <= 1.5.5 - Broken Access Control Vulnerability

Missing Authorization vulnerability in brandexponents Oshine Core oshine-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Oshine Core: from n/a through = 1.5.5...

CVE-2025-58679 WordPress AppMySite plugin <= 3.15.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in AppMySite AppMySite appmysite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AppMySite: from n/a through = 3.15.0...

CVE-2025-58680 WordPress Gutentor plugin <= 3.5.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in gutentor Gutentor gutentor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutentor: from n/a through = 3.5.2...

CVE-2025-58703

CVE-2025-58703: Stored XSS in Skyword API Plugin (WordPress) affecting Skyword API Plugin versions up to 2.5.3. Impact per CVSS: NETWORK attack, Low to Low confidentiality/integrity/availability, UI interaction required. Connected sources indicate the issue is currently Unpatched (no public fix d...

WordPress Nokri Theme <= 1.6.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Nokri Type Theme Vulnerable versions = 1.6.4 Fixed in N/A OWASP Top 10 A5: Security Misconfiguration Classification Cross Site Request Forgery CSRF CVE CVE-2025-58259 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 2379088ca94b Credits Tran Nguyen Bao Khanh VCI -...

PT-2025-38809

Name of the Vulnerable Software and Affected Versions tmatsuur Slightly troublesome permalink versions through 1.2.0 Description The software contains a flaw due to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that...

PT-2025-38796

Name of the Vulnerable Software and Affected Versions payOS versions through 1.0.61 Description A Cross-Site Request Forgery CSRF issue exists in Loc Bui payOS. This allows an attacker to perform actions on behalf of a user without their knowledge. The issue affects payOS versions through 1.0.61...

WordPress DriCub Theme <= 2.9 is vulnerable to Server Side Request Forgery (SSRF)

Software DriCub Type Theme Vulnerable versions = 2.9 Fixed in N/A OWASP Top 10 A3: Injection Classification Server Side Request Forgery SSRF CVE CVE-2025-58005 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 1d20e3f4bf71 Credits Bonds Required privilege Unauthenticated...

PT-2025-38805

Name of the Vulnerable Software and Affected Versions Post Carousel Slider for Elementor versions through 1.7.0 Description An authorization issue exists in Post Carousel Slider for Elementor, allowing exploitation due to incorrectly configured access control security levels. Recommendations Upda...

PT-2025-39042

Name of the Vulnerable Software and Affected Versions RelyWP Coupon Affiliates versions through 6.8.0 Description A missing authorization issue exists in Elliot Sowersby / RelyWP Coupon Affiliates, allowing exploitation of incorrectly configured access control security levels. Recommendations...

PT-2025-38904

Name of the Vulnerable Software and Affected Versions Chandrika Sista WP Category Dropdown versions through 1.9 Description The software contains a flaw related to improper input handling during web page creation, specifically a Stored Cross-Site Scripting issue. This allows for the injection of...