MStore API <= 3.9.1 - Authentication Bypass

The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.1. This is due to insufficient verification on the user being supplied during the cart sync from mobile REST API request through the plugin. This makes it possible for unauthenticated...

WordPress plugin Smartsupp – live chat, AI shopping assistant and chatbots 跨站脚本漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

CVE-2025-60040

CVE-2025-60040 is a Stored XSS in the WordPress plugin wp-mpdf. Affected software: wp-mpdf up to version 3.9.1 (authentication required). The issue arises from improper input neutralization during web page generation, enabling stored malicious script execution in the context of vulnerable sites. ...