CVE-2025-5240 CRM and Lead Management by vcita <= 2.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via type Parameter

The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘type’ parameter in all versions up to, and including, 2.7.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2025-30385 · WordPress · Birth Chart Compatibility

Name of the Vulnerable Software and Affected Versions: Birth Chart Compatibility plugin for WordPress versions prior to 2.1 Description: The Birth Chart Compatibility plugin for WordPress is susceptible to full path disclosure due to insufficient protection against direct access to the plugin's...

PT-2025-30378 · WordPress · Wp Jobhunt

Name of the Vulnerable Software and Affected Versions: WP JobHunt versions prior to 7.3 Description: The WP JobHunt plugin for WordPress is susceptible to an Insecure Direct Object Reference issue in all versions up to and including 7.2, specifically within the cs remove profile callback function...

PT-2025-30388 · WordPress · Like & Share My Site

Name of the Vulnerable Software and Affected Versions: Like & Share My Site plugin for WordPress versions prior to 0.3 Description: The plugin is susceptible to Cross-Site Request Forgery CSRF due to missing or incorrect nonce validation on the lsms admin page. This allows unauthenticated attacke...

PT-2025-30383 · WordPress · Conditional Fields +3

Name of the Vulnerable Software and Affected Versions: Extensions For CF7 versions up to and including 3.2.8 Description: The Extensions For CF7 Contact form 7 Database, Conditional Fields and Redirection plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path...

PT-2025-30369 · WordPress · Crm/Lead Management By Vcita

Name of the Vulnerable Software and Affected Versions: CRM and Lead Management by vcita plugin for WordPress versions through 2.7.5 Description: The plugin is susceptible to Stored Cross-Site Scripting through the type parameter due to inadequate input sanitization and output escaping...

WordPress Latest Post Accordian Slider plugin <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability

Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability discovered by johska in WordPress Plugin Latest Post Accordian Slider versions = 1.3...

WordPress bSecure plugin 1.3.7-1.7.9 - Missing Authorization to Unauthenticated Privilege Escalation via order_info REST Endpoint

Missing Authorization to Unauthenticated Privilege Escalation via orderinfo REST Endpoint vulnerability discovered by kr0d in WordPress Plugin bSecure Your Universal Checkout versions 1.3.7-1.7.9...

WordPress Like & Share My Site plugin <= 0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability

Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability discovered by johska in WordPress Plugin Like & Share My Site versions = 0.2...

WordPress FoxyPress plugin <= 0.4.2.1 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by WordFence in WordPress Plugin Foxypress versions 0.4.2.2...

WordPress User Registration plugin <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via urcr_restrict Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via urcrrestrict Shortcode vulnerability discovered by muhammad yudha in WordPress Plugin User Registration versions = 4.2.4...

WordPress Ebook Store plugin <= 5.8012 - Authenticated (Administrator+) Stored Cross-Site Scripting via Order Details vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting via Order Details vulnerability discovered by Bee in WordPress Plugin Ebook Store versions = 5.8012...

WordPress The E-Commerce ERP <= 2.1.1.3 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by ch4r0n in WordPress Plugin The E-Commerce ERP versions = 2.1.1.3...

CVE-2016-15043

The WP Mobile Detector plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in resize.php file in versions up to, and including, 3.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may...

CVE-2025-6720

The Vchasno Kasa plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the clearalllog function in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to clear log files...

CVE-2025-7661

The Partnerský systém Martinus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'martinus' shortcode in all versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-7669

The Avishi WP PayPal Payment Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0. This is due to missing or incorrect nonce validation on the 'avishi-wp-paypal-payment-button/index.php' page. This makes it possible for unauthenticated...

WordPress ThemeREX Addons plugin <= 2.35.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via trx_addons_get_svg_from_file Function vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via trxaddonsgetsvgfromfile Function vulnerability discovered by stealthcopter in WordPress Plugin ThemeREX Addons versions = 2.35.1.1...

WordPress Temporarily Hidden Content plugin <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by muhammad yudha in WordPress Plugin Temporarily Hidden Content versions = 1.0.6...

CVE-2025-5811

The Listly: Listicles For WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Init function in all versions up to, and including, 2.7. This makes it possible for unauthenticated attackers to delete arbitrary transient values o...