CVE-2025-28947 WordPress MBStore - Digital WooCommerce WordPress Theme <= 2.3 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in snstheme MBStore - Digital WooCommerce WordPress Theme mbstore allows PHP Local File Inclusion.This issue affects MBStore - Digital WooCommerce WordPress Theme: from n/a through ...

CVE-2025-49448

CVE-2025-49448 concerns FW Food Menu (WordPress plugin) versions up to 6.0.0 and describes an unauthenticated path traversal vulnerability. The issue is reported as an ability to traverse restricted directories, enabling potential arbitrary file deletion (as highlighted by Patchstack referencing ...

PT-2025-27168 · WordPress · Wp Youtube Live

Name of the Vulnerable Software and Affected Versions: WP YouTube Live versions 1.10.0 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized requests. Recommendations: For WP YouTube Live versions 1.10.0 and earlier, update to a version that...

PT-2025-26913 · WordPress · Wp Masonry & Infinite Scroll

Name of the Vulnerable Software and Affected Versions: WP Masonry & Infinite Scroll plugin for WordPress versions up to, and including, 2.2 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'wmis' shortcode due to insufficient input sanitization and output escaping...

CVE-2025-5585 SiteOrigin Widgets Bundle <= 1.68.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-url` DOM Element Attribute

The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-url DOM Element Attribute in all versions up to, and including, 1.68.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-50012 WordPress Inventory Presser plugin <= 15.2.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in fridaysystems Inventory Presser inventory-presser allows Stored XSS.This issue affects Inventory Presser: from n/a through = 15.2.6...

CVE-2025-50037 WordPress Buying Buddy IDX CRM plugin <= 2.3.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Buying Buddy Buying Buddy IDX CRM allows DOM-Based XSS. This issue affects Buying Buddy IDX CRM: from n/a through 2.3.0...

PT-2025-26279 · WordPress · Custom Post Carousels With Owl

Name of the Vulnerable Software and Affected Versions: Custom Post Carousels with Owl WordPress plugin versions prior to 1.4.12 Description: The issue concerns the use of the featherlight library and the data-featherlight attribute without proper sanitization. This could potentially lead to...

CVE-2025-5938

The Digital Marketing and Agency Templates Addons for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1. This is due to missing or incorrect nonce validation on the importtemplates function. This makes it possible for...

CVE-2025-5841

The ACF Onyx Poll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access a...

PT-2025-25367 · WordPress · Rest Api | Custom Api Generator For Cross Platform/Import Export In Wp

Name of the Vulnerable Software and Affected Versions: REST API | Custom API Generator For Cross Platform And Import Export In WP plugin for WordPress versions 1.0.0 through 2.0.3 Description: The issue is related to a missing capability check on the process handler function, allowing...

CVE-2025-49278 WordPress Blogty theme <= 1.0.11 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in unfoldwp Blogty blogty allows PHP Local File Inclusion.This issue affects Blogty: from n/a through = 1.0.11...

CVE-2025-49281 WordPress Magways theme <= 1.2.1 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in unfoldwp Magways magways allows PHP Local File Inclusion.This issue affects Magways: from n/a through = 1.2.1...

CVE-2025-1777

The BM Content Builder plugin for WordPress is vulnerable to unauthorized modification of data to a missing capability check on the 'uxcbpageoptionssave' function in all versions up to, and including, 3.16.2.1. This makes it possible for authenticated attackers, with subscriber-level access and...

CVE-2025-5733

The Modern Events Calendar Lite plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 7.21.9. This is due improper or insufficient validation of the id property when exporting calendars. This makes it possible for unauthenticated attackers to retrieve th...

CVE-2025-49439 WordPress Atelier Create CV plugin <= 1.1.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability

Cross-Site Request Forgery CSRF vulnerability in mariusz88atelierweb Atelier Create CV allows Cross Site Request Forgery. This issue affects Atelier Create CV: from n/a through 1.1.2...

CVE-2025-49453 WordPress BP Profile as Homepage plugin <= 1.1 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Jatinder Pal Singh BP Profile as Homepage allows Stored XSS. This issue affects BP Profile as Homepage: from n/a through 1.1...

CVE-2025-28989 WordPress Read More Login <= 2.0.3 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in arildur Read More Login allows Stored XSS. This issue affects Read More Login: from n/a through 2.0.3...

CVE-2025-49301 WordPress Greenshift plugin <= 11.5.5 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpsoul Greenshift greenshift-animation-and-page-builder-blocks allows DOM-Based XSS.This issue affects Greenshift: from n/a through = 11.5.5...

CVE-2023-2921

The CVE-2023-2921 entry concerns the WordPress Short URL plugin (versions ≤ 1.6.8). A parameter is not properly sanitised/escaped before its use in an SQL statement, enabling SQL injection. Impact is stated as exploitable by users with low privileges (e.g., subscribers). Affected component is the...