CVE-2025-30567

CVE-2025-30567 affects WordPress WP01 plugin versions up to 2.6.2. The vulnerability is a path traversal flaw in the ZIP generation that allows unauthenticated attackers to download arbitrary files. Remediation: upgrade to WP01 version 2.6.3 or later, which validates file paths in the archive gen...

CVE-2025-1970

The Export and Import Users and Customers plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.6.2 via the validatefile function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web request...

CVE-2025-1970 Export and Import Users and Customers <= 2.6.2 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function

The Export and Import Users and Customers plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.6.2 via the validatefile function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web request...

CVE-2025-2267

The WP01 plugin for WordPress is vulnerable to Arbitrary File Download in all versions up to, and including, 2.6.2 due to a missing capability check and insufficient restrictions on the makearchive function. This makes it possible for authenticated attackers, with Subscriber-level access and abov...

CVE-2025-26914

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Bowo Variable Inspector variable-inspector allows Reflected XSS.This issue affects Variable Inspector: from n/a through = 2.6.2...

CVE-2024-13724

The Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction plugin for WordPress is vulnerable to unauthorized access to functionality in all versions up to, and including, 2.6.2. This makes it possible for unauthenticated attackers to increase their...

CVE-2024-13724 Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction <= 2.6.2 - Missing Authorization

The Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction plugin for WordPress is vulnerable to unauthorized access to functionality in all versions up to, and including, 2.6.2. This makes it possible for unauthenticated attackers to increase their...

WordPress plugin Variable Inspector 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2024-32568

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Melapress WP 2FA wp-2fa.This issue affects WP 2FA: from n/a through = 2.6.2...

CVE-2024-11104

The Sky Addons for Elementor Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blogs plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the saveoptions...

CVE-2025-23811

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ghasemy14 WP2APP wp2appir allows Reflected XSS.This issue affects WP2APP: from n/a through = 2.6.2...

PT-2025-5111 · WordPress · Wp2App

Name of the Vulnerable Software and Affected Versions: WP2APP versions prior to 2.6.3 is not mentioned, however, the versions from n/a through 2.6.2 are affected. WP2APP versions from n/a through 2.6.2 Description: The issue is related to improper neutralization of input during web page generatio...

WordPress plugin New User Approve 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress plugin Sky Addons for Elementor 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability...

CVE-2024-50407

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Kiboko Labs Namaste! LMS allows Reflected XSS.This issue affects Namaste! LMS: from n/a through 2.6.2...

WordPress plugin Namaste! LMS 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2024-34180 · Unknown · Namaste! Lms

Name of the Vulnerable Software and Affected Versions: Namaste! LMS versions through 2.6.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS attacks. Recommendations: For versions...

WordPress plugin Namaste! LMS 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress Infinite-Scroll plugin <= 2.6.2 - Cross-Site Request Forgery to Plugin Settings Update vulnerability

Cross-Site Request Forgery to Plugin Settings Update vulnerability discovered by Francesco Carlucci in WordPress Plugin Infinite-Scroll versions = 2.6.2...

PT-2024-15990 · WordPress · Infinite-Scroll

Name of the Vulnerable Software and Affected Versions: Infinite-Scroll plugin for WordPress versions up to, and including, 2.6.2 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the process ajax edit and process ajax delete functions...