WordPress Burst Statistics plugin <= 2.0.6 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Burst Statistics versions = 2.0.6...

CVE-2025-53323 WordPress Pre-Publish Post Checklist plugin <= 3.1 - Broken Access Control Vulnerability

Missing Authorization vulnerability in danbriapps Pre-Publish Post Checklist pre-publish-post-checklist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pre-Publish Post Checklist: from n/a through = 3.1...

CVE-2025-53318

CVE-2025-53318 (WP DB Booster) : A Missing Authorization vulnerability in the WordPress plugin WP DB Booster (affected versions: from n/a through 1.0.1) allows exploitation of incorrectly configured access control security levels. Connected sources consistently identify it as a missing/weak autho...

CVE-2025-53309

CVE-2025-53309 refers to a vulnerability in the WordPress plugin Accept Stripe Payments Using Contact Form 7 (versions 3.0 and earlier). The issue is described as Insertion of Sensitive Information Into Sent Data, enabling retrieval of embedded sensitive data. Public sources in the provided docum...

CVE-2025-53304 WordPress Contact Form – 7 : Hide Success Message plugin <= 1.1.4 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Rohil Contact Form – 7 : Hide Success Message contact-form-7-hide-success-message allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Contact Form – 7 : Hide Success Message: from n/a through = 1.1.4...

CVE-2025-53290 WordPress WP Visual Sitemap plugin <= 1.0.2 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in MS WP Visual Sitemap wp-visual-sitemap allows Stored XSS.This issue affects WP Visual Sitemap: from n/a through = 1.0.2...

CVE-2025-53288

CVE-2025-53288 corresponds to a Missing Authorization vulnerability in the WordPress plugin “PlatiOnline Payments” (versions up to 6.3.2). The issue arises from misconfigured access control, enabling unauthorized access due to insufficient authorization checks. Public details in Patchstack/Red Ha...

CVE-2025-53280

CVE-2025-53280 : Stored Cross-Site Scripting in the WordPress plugin Football Pool (AntoineH)

CVE-2025-53278 WordPress WP AdCenter plugin <= 2.6.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPeka WP AdCenter allows Stored XSS. This issue affects WP AdCenter: from n/a through 2.6.0...

CVE-2025-53274 WordPress WP Permalink Translator plugin <= 1.7.6 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in Hossin Asaadi WP Permalink Translator wp-permalink-translator allows Stored XSS.This issue affects WP Permalink Translator: from n/a through = 1.7.6...

CVE-2025-53269 WordPress My Wp Brand plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in imw3 My Wp Brand my-wp-brand allows Cross Site Request Forgery.This issue affects My Wp Brand: from n/a through = 1.1.3...

CVE-2025-53262 WordPress Writesonic plugin <= 1.0.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Writesonic Writesonic writesonic allows Cross Site Request Forgery.This issue affects Writesonic: from n/a through = 1.0.5...

CVE-2025-53261 WordPress WP YouTube Live plugin <= 1.10.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in macbookandrew WP YouTube Live wp-youtube-live allows Cross Site Request Forgery.This issue affects WP YouTube Live: from n/a through = 1.10.0...

CVE-2025-53260 WordPress File Manager Plugin For Wordpress plugin <= 7.5 - Arbitrary File Upload Vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in getredhawkstudio File Manager Plugin For Wordpress file-manager-plugin-for-wordpress allows Upload a Web Shell to a Web Server.This issue affects File Manager Plugin For Wordpress: from n/a through = 7.5...

CVE-2025-53255 WordPress HurryTimer plugin <= 2.13.1 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Nabil Lemsieh HurryTimer hurrytimer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HurryTimer: from n/a through = 2.13.1...

CVE-2025-53255

CVE-2025-53255 affects HurryTimer (WordPress plugin)

CVE-2025-25171 WordPress WP SmartPay plugin <= 2.7.13 - Account Takeover vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in ThemesGrove WP SmartPay allows Authentication Abuse. This issue affects WP SmartPay: from n/a through 2.7.13...

CVE-2025-25173

CVE-2025-25173 is a stored XSS in WordPress plugin FastBook (FasterThemes)

CVE-2025-27361

CVE-2025-27361 concerns the WordPress plugin “Photo Express for Google” (thhake) with versions

CVE-2025-28960

CVE-2025-28960 : The Evangelische Termine WordPress plugin (regibaer) has a reflected XSS due to improper input neutralization during web page generation. Affected versions are n/a through 3.3. CVSS v3.1 base score 7.1 (HIGH). Exploitation status and patch availability are not detailed in the pro...