WordPress WPBakery Visual Composer WHMCS Elements plugin <= 1.0.4.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by zaim in WordPress Plugin WPBakery Visual Composer WHMCS Elements versions = 1.0.4.3...

WordPress plugin Ultimate Dashboard 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

Exploit for CVE-2025-3102

🔐 CVE-2025-3102 – Authentication Bypass in SureTriggers WordPr...

CVE-2025-3105 Vehica Core <= 1.0.97 - Authenticated (Subscriber+) Privilege Escalation

The Vehica Core plugin for WordPress, used by the Vehica - Car Dealer & Listing WordPress Theme, is vulnerable to privilege escalation in all versions up to, and including, 1.0.97. This is due to the plugin not properly validating user meta fields prior to updating them in the database. This make...

WordPress Free Woocommerce Product Table View plugin <= 1.78 - Arbitrary Content Deletion vulnerability

Arbitrary Content Deletion vulnerability discovered by Mika in WordPress Plugin Free Woocommerce Product Table View versions = 1.78...

WordPress plugin GDPR Cookie Compliance 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

Exploit for CVE-2025-23942

WP Load Gallery Exploit CVE-2025-23942 📌 Description Unr...

CVE-2024-11816

The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Remote Code Execution in version 3.0.11. This is due to a missing capability check on the 'wpexthandlesnippetupdate' function. This makes it possible for authenticated attackers, with Subscriber-level access and...

CVE-2024-13409

The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.10 via the 'theme' parameter of the posttypeajaxhandler function. This makes it possible for...

CVE-2024-13319 Themify Builder <= 7.6.5 - Reflected Cross-Site Scripting

The Themify Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 7.6.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

PT-2025-1607 · WordPress · Eventer

Name of the Vulnerable Software and Affected Versions: Eventer plugin for WordPress versions up to, and including, 3.9.7 Description: The issue allows authenticated attackers with Subscriber-level access and above to read the contents of arbitrary files on the server, which can contain sensitive...

WordPress Save & Import Image from URL Plugin <= 0.7 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Save & Import Image from URL versions = 0.7...

CVE-2024-11810

CVE-2024-11810 – PayGreen Payment Gateway (WordPress) reflected XSS : The WordPress PayGreen Payment Gateway plugin is vulnerable to Reflected Cross-Site Scripting via the message_id parameter in all versions up to and including 1.0.26 due to insufficient input sanitization and output escaping. T...

WordPress plugin Hero Banner Ultimate 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

age -- age vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution

Filippo Valsorda reports: A plugin name containing a path separator may allow an attacker to execute an arbitrary binary. Such a plugin name can be provided to the age CLI through an attacker-controlled recipient or identity string, or to the plugin.NewIdentity, plugin.NewIdentityWithoutData, or...

CVE-2024-11880

CVE-2024-11880 affects the WordPress plugin B Testimonial (WP plugin) up to version 1.2.2 . The vulnerability is a Stored Cross-Site Scripting (Stored XSS) in the plugin’s b_testimonial shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. Exploitation ...

CVE-2024-11293

CVE-2024-11293 concerns the Pie Register – Social Sites Login (Add on) for WordPress. The WordPress plugin registrations form suite is vulnerable to authentication bypass due to insufficient verification of the user returned by the social login token, allowing unauthenticated attackers to log in ...

CVE-2024-11229

The 코드엠샵 소셜톡 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's addplusfriends and addplustalk shortcodes in all versions up to, and including, 1.1.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-10869

CVE-2024-10869 : GuardGiant WordPress plugin “WordPress Brute Force Protection – Stop Brute Force Attacks” is vulnerable to Reflected Cross-Site Scripting due to improper escaping of add_query_arg/remove_query_arg in versions up to and including 2.2.6. Affected plugin: WordPress Brute Force Prote...

CVE-2024-10785

CVE-2024-10785 : Gutenberg Blocks with AI by Kadence WP – Page Builder Features (Kadence Blocks) is vulnerable to Stored Cross-Site Scripting via the Countdown widget in versions