PT-2025-14457 · WordPress · Insert Headers/Footers Code – Ht Script

Name of the Vulnerable Software and Affected Versions: The Insert Headers and Footers Code – HT Script plugin for WordPress versions up to, and including, 1.1.2 Description: The issue is related to a missing capability check on the ajax dismiss function, allowing authenticated attackers with...

WordPress Countdown & Clock plugin <=2.8.8 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by astra.r3verii in WordPress Plugin Countdown & Clock versions = 2.8.8...

WordPress HTML Forms plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Abhinav Porwal in WordPress Plugin HTML Forms versions = 1.5.1...

WordPress Hyperlink Group Block plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Peter Thaleikis in WordPress Plugin Hyperlink Group Block versions = 2.0.1...

WordPress FancyPost plugin <= 6.0.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Gab in WordPress Plugin FancyPost versions = 6.0.1...

WordPress Beam me up Scotty – Back to Top Button plugin <= 1.0.23 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Webula in WordPress Plugin Beam me up Scotty versions = 1.0.23...

WordPress Mobile App Canvas Plugin <= 3.8.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Abdi Pranata in WordPress Plugin Mobile App Canvas versions = 3.8.2...

WordPress SCSS WP Editor plugin <= 1.2.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin SCSS WP Editor versions = 1.2.1...

WordPress Publitio plugin <= 2.1.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Publitio versions = 2.1.8...

WordPress Clockinator Lite plugin <= 1.0.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mika in WordPress Plugin Clockinator Lite versions = 1.0.8...

WordPress WP Modal Popup with Cookie Integration plugin <= 2.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Pham Van Tam in WordPress Plugin WP Modal Popup with Cookie Integration versions = 2.4...

WordPress HMH Footer Builder For Elementor plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Gab in WordPress Plugin HMH Footer Builder For Elementor versions = 1.0...

WordPress Auto scroll for reading plugin <= 1.1.4 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by SOPROBRO in WordPress Plugin Auto scroll for reading versions = 1.1.4...

WordPress Secure Copy Content Protection and Content Locking plugin <= 4.4.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by astra.r3verii in WordPress Plugin Secure Copy Content Protection and Content Locking versions = 4.4.3...

WordPress Booster for WooCommerce plugin <= 7.2.4 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Webbernaut in WordPress Plugin Booster for WooCommerce versions = 7.2.4...

@4399ywkf/bundler-vite (>=4.0.61, <=4.0.84), @4399ywkf/js (>=4.0.61, <=4.0.84) +508 more potentially affected by CVE-2025-31125 via vite (>=4.0.0, <=4.5.9)

vite NPM version =4.0.0, =4.0.61, =4.0.61, =4.0.61, =4.0.61, =0.0.1, =0.0.0, =0.0.1, =0.0.3, =0.0.1, =0.0.1, =0.0.1, =3.3.9-patch.1, =3.3.9-patch.2 and more Source cves: CVE-2025-31125 Source advisory: OSV:GHSA-4R4M-QW57-CHR8...

WordPress Import Export Suite for CSV and XML Datafeed plugin <= 7.19 - Authenticated (Subscriber+) Arbitrary File Deletion vulnerability

Authenticated Subscriber+ Arbitrary File Deletion vulnerability discovered by mikemyers in WordPress Plugin WP Ultimate CSV Importer versions = 7.19...

WordPress History Log by click5 plugin <= 1.0.13 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin History Log by click5 versions = 1.0.13...

WordPress Next-Cart Store to WooCommerce Migration plugin <= 3.9.4 - SQL Injection vulnerability

SQL Injection vulnerability discovered by LVT-tholv2k in WordPress Plugin Next-Cart Store to WooCommerce Migration versions = 3.9.4...

CVE-2025-31529 WordPress Slider Path for Elementor plugin <= 3.0.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Rashid Slider Path for Elementor slider-path allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Slider Path for Elementor: from n/a through = 3.0.0...