WordPress plugin XV Random Quotes SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...

PT-2025-14186 · Unknown · Follow Us Badges

Name of the Vulnerable Software and Affected Versions: Follow Us Badges versions n/a through 3.1.11 Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored XSS. This means that an attacker can inject malicious scripts into the...

WordPress Varnish WordPress plugin <= 1.7 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by SOPROBRO in WordPress Plugin Varnish WordPress versions = 1.7...

WordPress CookieHint WP plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by SOPROBRO in WordPress Plugin CookieHint WP versions = 1.0.0...

WordPress Welcome Popup plugin <= 1.0.10 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Pham Van Tam in WordPress Plugin Welcome Popup versions = 1.0.10...

WordPress Timeline Event History plugin <= 3.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Peter Thaleikis in WordPress Plugin Timeline Event History versions = 3.2...

WordPress OpenMenu plugin <= 3.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by muhammad yudha in WordPress Plugin OpenMenu versions = 3.5...

WordPress Elfsight Testimonials Slider plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Pham Van Tam in WordPress Plugin Elfsight Testimonials Slider versions = 1.0.1...

WordPress Appointify plugin <= 1.0.8 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Tri Doan in WordPress Plugin Appointify versions = 1.0.8...

WordPress IMPress for IDX Broker plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Peter Thaleikis in WordPress Plugin IMPress for IDX Broker versions = 3.2.3...

WordPress Swiss Toolkit For WP plugin <= 1.4.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peter Thaleikis in WordPress Plugin Swiss Toolkit For WP versions = 1.4.2...

WordPress My auctions allegro plugin <= 3.6.20 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin My auctions allegro versions = 3.6.20...

WordPress ACME Divi Modules plugin <= 1.3.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin ACME Divi Modules versions = 1.3.5...

CVE-2025-31620

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in carperfer CoverManager covermanager allows Stored XSS.This issue affects CoverManager: from n/a through = 0.0.1...

CVE-2025-31601

Cross-Site Request Forgery CSRF vulnerability in appointy Appointy Appointment Scheduler appointy-appointment-scheduler allows Cross Site Request Forgery.This issue affects Appointy Appointment Scheduler: from n/a through = 4.2.1...

CVE-2025-31542

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Blind SQL Injection.This issue affects My auctions allegro: from n/a through = 3.6.20...

CVE-2025-31593 WordPress OpenMenu plugin <= 3.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in OpenMenu OpenMenu allows Stored XSS. This issue affects OpenMenu: from n/a through 3.5...

CVE-2025-31543

CVE-2025-31543 is a DOM-based Cross-Site Scripting vulnerability in the WordPress plugin Twice Commerce . The description specifies improper input neutralization during web page generation, enabling DOM-level XSS. Affected software is listed as “Twice Commerce: from n/a through 1.3.1,” indicating...

CVE-2025-31434

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Adrian Tobey FormLift for Infusionsoft Web Forms formlift allows Stored XSS.This issue affects FormLift for Infusionsoft Web Forms: from n/a through = 7.5.19...

CVE-2025-31432

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Chop Chop Pop-Up Chop Chop pop-up allows PHP Local File Inclusion.This issue affects Pop-Up Chop Chop: from n/a through = 2.1.7...