CVE-2025-22562

CVE-2025-22562 : A CSRF vulnerability in Title Experiments Free affects the WordPress plugin, with impact described as Cross-Site Request Forgery. Public details indicate the issue applies to Title Experiments Free versions from n/a up to 9.0.4; root cause is CSRF, but no patch/version fix inform...

CVE-2025-22585 WordPress Ultimate Image Hover Effects plugin <= 1.1.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in themebon Ultimate Image Hover Effects ultimate-image-hover-effects allows DOM-Based XSS.This issue affects Ultimate Image Hover Effects: from n/a through = 1.1.2...

CVE-2024-12738 User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.12.9 - Unauthenticated Stored Cross-Site Scripting

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several user meta parameters in all versions up to, and including, 3.12.9 due to insufficient input sanitization and output escaping...

CVE-2024-11826 Quill Forms | The Best Typeform Alternative | Create Conversational Multi Step Form, Survey, Quiz, Cost Estimation or Donation Form on WordPress <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Quill Forms | The Best Typeform Alternative | Create Conversational Multi Step Form, Survey, Quiz, Cost Estimation or Donation Form on WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'quillforms-popup' shortcode in all versions up to, and including...

CVE-2024-56278

CVE-2024-56278: Improper generation of code (Code Injection) in Smackcoders WP Ultimate Exporter allows PHP Remote File Inclusion. Affected: WP Ultimate Exporter versions from n/a to 2.9.1. CVSSv3.1 base score 9.1 (CRITICAL); vectors: Network, Privileges Required HIGH, User Interaction NONE, Scop...

CVE-2024-56296 WordPress Mang Board WP plugin <= 1.8.4 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Hometory Mang Board WP allows Reflected XSS.This issue affects Mang Board WP: from n/a through 1.8.4...

CVE-2025-22261 WordPress WP FullCalendar plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Pixelite WP FullCalendar wp-fullcalendar allows Stored XSS.This issue affects WP FullCalendar: from n/a through 1.5...

CVE-2025-22304 WordPress WP Visitor Statistics plugin <= 7.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in osama.esh WP Visitor Statistics Real Time Traffic wp-stats-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Visitor Statistics Real Time Traffic: from n/a through = 7.5...

CVE-2025-22357

CVE-2025-22357 details (Reflected XSS): Affects Target Notifications (WordPress plugin) with Improper Neutralization of Input During Web Page Generation. Reported as a Reflected XSS vulnerability that can be exploited remotely via network access, requiring user interaction, and with no privileges...

CVE-2024-10866

CVE-2024-10866: Export Import Menus (WordPress) vulnerability is confirmed in the WordPress Export Import Menus plugin up to version 1.9.1, where an missing capability check in dsp_export_import_menus() allows unauthenticated users to export menu data and settings. The CVSS-like score in the init...

CVE-2024-9354

The Estatik Mortgage Calculator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'color' parameter in all versions up to, and including, 2.0.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2024-11282

The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.10 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that...

CVE-2024-9697

The Social Rocket – Social Sharing Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tweetsettingssave and tweetsettingsupdate functions in all versions up to, and including, 1.3.4. This makes it possible for authenticated...

CVE-2024-11756

The SweepWidget Contests, Giveaways, Photo Contests, Competitions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sweepwidget' shortcode in all versions up to, and including, 2.0.6 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-10102

The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.22 does not sanitise and escape some of its Gallery settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks...

CVE-2024-9638 Category Posts Widget < 4.9.18 - Admin+ Stored XSS

The Category Posts Widget WordPress plugin before 4.9.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-8855

CVE-2024-8855 affects the WordPress Auction Plugin (

CVE-2024-12535 Host PHP Info <= 1.0.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure

The Host PHP Info plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check when including the 'phpinfo' function in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attackers to read configuration settings and predefin...

CVE-2024-12535

CVE-2024-12535 concerns the Host PHP Info WordPress plugin. The vulnerability is a missing capability check when including the phpinfo function, leading to unauthorized access to server configuration and predefined variables. It affects all versions up to and including 1.0.4, and can be exploited...

CVE-2024-11749 App Embed <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The App Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'appizy' shortcode in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacker...