WordPress Geo Mashup plugin <= 1.13.16 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Dimas Maulana in WordPress Plugin Geo Mashup versions = 1.13.16...

CVE-2025-5835

The Droip plugin for WordPress is vulnerable to unauthorized modification and access of data due to a missing capability check on the droippostapis function in all versions up to, and including, 2.2.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

CVE-2025-5831

The Droip plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the makegooglefontoffline function in all versions up to, and excluding, 2.5.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload...

CVE-2015-10144

The Responsive Thumbnail Slider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type sanitization in the via the image uploader in versions up to 1.0.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary...

CVE-2025-5753

The Valuation Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2025-6261

The Fleetwire Fleet Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's fleetwirelist shortcode in all versions up to, and including, 1.0.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WordPress Frontend File Manager plugin <= 21.5 - Missing Authorization to Unauthenticated Arbitrary Post Deletion vulnerability

Missing Authorization to Unauthenticated Arbitrary Post Deletion vulnerability discovered by WordFence in WordPress Plugin Frontend File Manager versions = 21.5...

WordPress Droip plugin < 2.5.2 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Foxyyy in WordPress Plugin Droip versions 2.5.2...

CVE-2025-6082

The Birth Chart Compatibility plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0. This is due to insufficient protection against directly accessing the plugin's index.php file, which causes an error exposing the full path. This makes it possible f...

CVE-2025-7687

The Latest Post Accordian Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3. This is due to missing or incorrect nonce validation on the 'lpaccordian' page. This makes it possible for unauthenticated attackers to update settings and...

CVE-2025-7692

The Orion Login with SMS plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.5. This is due to the olwshandleverifyphone function not utilizing a strong enough OTP value, exposing the hash needed to generate the OTP value, and no restrictions on t...

CVE-2025-7822

The WP Wallcreeper plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the adminnotices hook in all versions up to, and including, 1.6.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enable...

CVE-2025-6385

The WP Applink plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 0.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2025-7690 Affiliate Plus <= 1.3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Affiliate Plus plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.2. This is due to missing or incorrect nonce validation on the 'affiplussettings' page. This makes it possible for unauthenticated attackers to perform an unauthorized...

CVE-2025-7645

The Extensions For CF7 Contact form 7 Database, Conditional Fields and Redirection plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete-file' field in all versions up to, and including, 3.2.8. This makes it possible for...

PT-2025-30646 · WordPress · Onlyoffice Docs Plugin For Wordpress

Name of the Vulnerable Software and Affected Versions: ONLYOFFICE Docs plugin for WordPress versions 1.1.0 through 2.2.0 Description: The ONLYOFFICE Docs plugin for WordPress is susceptible to a privilege escalation issue due to insufficient authorization checks within the oo.callback REST...

PT-2025-30633

Name of the Vulnerable Software and Affected Versions WPBookit versions prior to 1.0.7 Description The WPBookit plugin for WordPress is susceptible to arbitrary file uploads due to a lack of file type validation in the image upload handle function. This function is connected via the 'add new...

WordPress hiWeb Export Posts plugin <= 0.9.0.0 - Cross-Site Request Forgery to Arbitrary File Deletion vulnerability

Cross-Site Request Forgery to Arbitrary File Deletion vulnerability discovered by johska in WordPress Plugin hiWeb Export Posts versions = 0.9.0.0...

WordPress WP Get The Table plugin <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via url Parameter vulnerability discovered by Gilang in WordPress Plugin WP Get The Table versions = 1.5...

WordPress Get Youtube Subs plugin <= 3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via subscribe_link_att Function vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via subscribelinkatt Function vulnerability discovered by Peter Thaleikis in WordPress Plugin Get Youtube Subs versions = 3.5...