WordPress Traveler theme <= 3.1.8 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by István Márton in WordPress Theme Traveler versions = 3.1.8...

WordPress pixelstats plugin <= 0.8.2 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by johska in WordPress Plugin pixelstats versions = 0.8.2...

WordPress WC Affiliate plugin <= 2.5.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via wf-export-all vulnerability

Missing Authorization to Authenticated Subscriber+ Sensitive Information Exposure via wf-export-all vulnerability discovered by Thanh Nam Tran in WordPress Plugin WC Affiliate versions = 2.5.3...

WordPress DethemeKit for Elementor plugin <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Webbernaut in WordPress Plugin DethemeKit For Elementor versions = 2.1.9...

WordPress Schedule plugin <= 1.0.0 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Hassan Khan Yusufzai - Splint3r7 in WordPress Plugin Schedule versions = 1.0.0...

WordPress Simply Schedule Appointments plugin <= 1.6.8.5 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Luciano Hanna in WordPress Plugin Simply Schedule Appointments versions = 1.6.8.5...

WordPress PageLayer plugin <= 1.9.9 - Missing Authorization to Authenticated (Contributor+) Post Publication vulnerability

Missing Authorization to Authenticated Contributor+ Post Publication vulnerability discovered by Brian Sans-Souci liardom in WordPress Plugin PageLayer versions = 1.9.8...

WordPress Picture Gallery plugin <= 1.6.3 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Picture Gallery versions = 1.6.3...

CVE-2025-2077

The Simple Amazon Affiliate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'msg' parameter in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

WordPress Simple Amazon Affiliate plugin <= 1.0.9 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by siyuan shao in WordPress Plugin Simple Amazon Affiliate versions = 1.0.9...

WordPress Back To Top Plugin <= 2.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Back To Top versions = 2.0...

WordPress Custom Dashboard Page plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nguyen Thi Huyen Trang - Skalucy in WordPress Plugin Custom Dashboard Page versions = 1.0...

WordPress Mobile Themes plugin <= 1.1.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Mobile Themes versions = 1.1.1...

WordPress ZipList Recipe plugin <= 3.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nguyen Thi Huyen Trang - Skalucy in WordPress Plugin ZipList Recipe versions = 3.1...

CVE-2025-28908

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in pipdig pipDisqus pipdisqus allows Stored XSS.This issue affects pipDisqus: from n/a through = 1.6...

CVE-2025-28883

Cross-Site Request Forgery CSRF vulnerability in Martin WP Compare Tables wp-compare-tables allows Stored XSS.This issue affects WP Compare Tables: from n/a through = 1.0.5...

CVE-2025-28875

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in shanebp BP Email Assign Templates allows Stored XSS. This issue affects BP Email Assign Templates: from n/a through 1.6...

CVE-2025-28910

CVE-2025-28910 describes a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin WP Hide Admin Bar . Affected versions are listed as up to 2.0. The NVD entry and multiple sources indicate the issue is CSRF in this plugin, with a CVSSv3.1/3.1 base score of 4.3 (Medium) and the at...

CVE-2025-28886 WordPress REST API TO MiniProgram plugin <= 5.1.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in xjb REST API TO MiniProgram rest-api-to-miniprogram allows Cross Site Request Forgery.This issue affects REST API TO MiniProgram: from n/a through = 5.1.2...

WordPress Accounting for WooCommerce plugin <= 1.6.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by b4orvn Patchstack Alliance in WordPress Plugin Accounting for WooCommerce versions = 1.6.8...