CVE-2025-23968 WordPress AiBud WP plugin <= 1.9 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in WebFactory AiBud WP aibuddy-openai-chatgpt allows Upload a Web Shell to a Web Server.This issue affects AiBud WP: from n/a through = 1.9...

WordPress Paytiko for WooCommerce plugin <= 1.3.21 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Paytiko for WooCommerce versions = 1.3.21...

WordPress WC Pickup Store plugin <= 1.8.9 - Settings Change Vulnerability

Settings Change Vulnerability discovered by Mika in WordPress Plugin WC Pickup Store versions = 1.8.9...

PT-2025-27805 · WordPress · Wpvivid Backup/Migration

Name of the Vulnerable Software and Affected Versions: Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress versions up to, and including, 0.9.116 Description: The issue is related to arbitrary file uploads due to missing file type validation in the wpvivid upload import...

CVE-2025-2330

CVE-2025-2330 involves the WordPress plugin All-in-One Addons for Elementor – WidgetKit. It presents a Stored Cross-Site Scripting (XSS) in the widget called “button+modal,” due to insufficient input sanitization and output escaping of user-supplied attributes. Affected products: All-in-One Addon...

CVE-2025-6687

The Magic Buttons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's magic-button shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on the 'icon' user supplied attributes. This makes it...

CVE-2025-4381

The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the ‘$id’ variable of the getSpace function in all versions up to, and including, 4.89 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2025-3848

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2025-25171. Reason: This candidate is a reservation duplicate of CVE-2025-25171. Notes: All CVE users should reference CVE-2025-25171 instead of this candidate. All references and descriptions in this candidate have been...

CVE-2025-4689

The CVE-2025-4689 entry concerns Ads Pro Plugin for WordPress (Advertising Manager). The connected sources confirm a vulnerability chain: an unauthenticated Local File Inclusion (LFI) that can lead to Remote Code Execution (RCE), triggered by a prior SQL Injection, within all versions up to 4.89....

PT-2025-27592 · WordPress · Drag/Drop Multiple File Upload

Name of the Vulnerable Software and Affected Versions: Drag and Drop Multiple File Upload Pro - WooCommerce plugin for WordPress versions 1.7.1 and earlier Drag and Drop Multiple File Upload Pro - WooCommerce plugin for WordPress versions 5.0 through 5.0.5 when bundled with the PrintSpace theme...

PT-2025-27588 · WordPress · Soumettre.Fr

Name of the Vulnerable Software and Affected Versions: Soumettre.fr plugin for WordPress versions up to, and including, 2.1.5 Description: The issue is related to improper authorization checks on the make signature function, allowing unauthorized access and modification of data. This enables...

WordPress Forminator plugin <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion vulnerability

Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin Forminator versions = 1.44.2...

WordPress Soumettre.fr plugin <= 2.1.5 - Improper Authorization to Unauthenticated Soumettre Posts Creation/Modification/Deletion vulnerability

Improper Authorization to Unauthenticated Soumettre Posts Creation/Modification/Deletion vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Soumettre.fr versions = 2.1.5...

WordPress CSS3 Vertical Web Pricing Tables plugin <= 1.9 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin CSS3 Vertical Web Pricing Tables versions = 1.9...

CVE-2025-49029 WordPress Custom Login And Signup Widget plugin <= 1.0 - Arbitrary Code Execution vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in bitto.kazi Custom Login And Signup Widget custom-login-and-signup-widget allows Code Injection.This issue affects Custom Login And Signup Widget: from n/a through = 1.0...

WordPress Custom Login And Signup Widget plugin <= 1.0 - Arbitrary Code Execution vulnerability

Arbitrary Code Execution vulnerability discovered by Bao Patchstack Alliance in WordPress Plugin Custom Login And Signup Widget versions = 1.0...

WordPress SureForms plugin <= 1.7.3 - Unauthenticated Arbitrary File Deletion

Unauthenticated Arbitrary File Deletion vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin SureForms versions = 1.7.3...

WordPress Case Theme User < 1.0.4 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by Bonds Patchstack Alliance in WordPress Plugin Case Theme User versions 1.0.4...

WordPress Leyka plugin <= 3.32 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Leyka versions = 3.32...

WordPress Beautiful Cookie Consent Banner plugin <= 4.6.1 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Martin Herancourt in WordPress Plugin Beautiful Cookie Consent Banner versions = 4.6.1...