11800 matches found
CVE-2025-54675 WordPress YITH WooCommerce Popup Plugin plugin <= 1.48.0 - Cross Site Request Forgery (CSRF) Vulnerability
Cross-Site Request Forgery CSRF vulnerability in YITHEMES YITH WooCommerce Popup yith-woocommerce-popup allows Cross Site Request Forgery.This issue affects YITH WooCommerce Popup: from n/a through = 1.48.0...
CVE-2025-54675
CVE-2025-54675 is a CSRF vulnerability in the WordPress plugin YITH WooCommerce Popup affecting versions up to 1.48.0 . The issue enables cross-site requests from authenticated users (CSRF) as described in multiple connected sources. The CVSS details show an attack vector of NETWORK , no confiden...
CVE-2025-54671
The connected documents confirm CVE-2025-54671 affects the WordPress plugin oik (versions n/a–4.15.2) with a Cross‑Site Request Forgery (CSRF) flaw. No exploits, vectors, or vulnerable configurations are detailed beyond the CSRF condition and affected versions. Public sources indicate the issue i...
CVE-2025-25172
CVE-2025-25172 affects VidMov WordPress Theme (
CVE-2025-25172 WordPress VidMov <= 1.9.4 - Local File Inclusion Vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in beeteam368 VidMov vidmov allows PHP Local File Inclusion.This issue affects VidMov: from n/a through = 1.9.4...
CVE-2025-28975 WordPress Alike - WordPress Custom Post Comparison <= 3.0.1 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in redqteam Alike - WordPress Custom Post Comparison alike allows Reflected XSS.This issue affects Alike - WordPress Custom Post Comparison: from n/a through = 3.0.1...
CVE-2025-28962 WordPress Advanced Google Universal Analytics plugin <= 1.0.3 - Broken Access Control to Sensitive Data Exposure vulnerability
Missing Authorization vulnerability in stefanoai Advanced Google Universal Analytics advanced-google-universal-analytics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Google Universal Analytics: from n/a through = 1.0.3...
CVE-2025-28979
CVE-2025-28979 concerns the WordPress plugin WP Pipes (version <= 1.4.3). The flaw is an improper control of the filename for include/require statements, enabling Local File Inclusion (LFI). Multiple sources (NVD, Red Hat advisory, CVE lists, Patchstack) confirm WP Pipes
CVE-2025-47689
CVE-2025-47689 concerns the WordPress plugin Video Blogster Lite (affected: versions through 1.2) and describes a reflected XSS vulnerability arising from improper input neutralization during web page generation. The related connected documents consistently identify the issue as affecting Video B...
CVE-2025-49038
CVE-2025-49038 describes a reflected XSS in the WordPress plugin WP Dynamic Links (versions through 1.0.1) due to improper input neutralization during web page generation. The vulnerability affects WP Dynamic Links and could impact visitors/users via crafted input reflected in the page. Public so...
CVE-2025-49052
CVE-2025-49052 affects WordPress plugin Netease Music up to version 3.2.1, with a Missing/Broken Access Control vulnerability (no explicit exploit details in the provided docs). Root cause: improper authorization checks enabling access control bypass. Impact: potential unauthorized access or acti...
CVE-2025-49058 WordPress SoundSt SEO Search plugin <= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Sound Strategies SoundSt SEO Search allows Reflected XSS. This issue affects SoundSt SEO Search: from n/a through 1.2.3...
CVE-2025-49058 WordPress SoundSt SEO Search plugin <= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Sound Strategies SoundSt SEO Search soundst-seo-search allows Reflected XSS.This issue affects SoundSt SEO Search: from n/a through = 1.2.3...
CVE-2025-49059 WordPress CleverReach® WP Plugin <= 1.5.20 - SQL Injection Vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in CleverReach® CleverReach® WP allows SQL Injection. This issue affects CleverReach® WP: from n/a through 1.5.20...
CVE-2025-49433 WordPress Supermalink <= 1.1 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThanhD Supermalink supermalink allows DOM-Based XSS.This issue affects Supermalink: from n/a through = 1.1...
CVE-2025-49887 WordPress Product XML Feed Manager for WooCommerce Plugin <= 2.9.3 - Remote Code Execution (RCE) Vulnerability
Improper Control of Generation of Code 'Code Injection' vulnerability in WPFactory Product XML Feed Manager for WooCommerce product-xml-feeds-for-woocommerce allows Remote Code Inclusion.This issue affects Product XML Feed Manager for WooCommerce: from n/a through = 2.9.3...
CVE-2025-50031 WordPress DB Backup <= 6.0 - Broken Access Control Vulnerability
Missing Authorization vulnerability in syedamirhussain91 DB Backup db-backup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DB Backup: from n/a through = 6.0...
CVE-2025-52788
CVE-2025-52788: CaptionPix WordPress plugin
CVE-2025-52823 WordPress Cube Portfolio Plugin <= 1.16.8 - SQL Injection Vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in ovatheme Cube Portfolio cubeportfolio allows SQL Injection.This issue affects Cube Portfolio: from n/a through = 1.16.8...
CVE-2025-6253
The UiCore Elements – Free Elementor widgets and templates plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.3.0 via the preparetemplate function due to a missing capability check and insufficient controls on the filename specified. This makes it...