PT-2025-23743 · WordPress · Wp Easy Contact

Name of the Vulnerable Software and Affected Versions: WP Easy Contact plugin for WordPress versions up to, and including, 4.0.0 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on user-supplied attributes in the emd mb me...

WordPress Bit File Manager plugin <= 6.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Uploads vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting via SVG File Uploads vulnerability discovered by TANG Cheuk Hei siunam in WordPress Plugin Bit File Manager versions = 6.7...

WordPress Newsletter plugin < 8.8.2 - Admin+ Stored XSS via Subscription vulnerability

Admin+ Stored XSS via Subscription vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin NewsLetter versions 8.8.2...

CVE-2025-4671

The Profile Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's usermeta and compare shortcodes in all versions up to, and including, 3.13.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-4205

The Popup Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘popupID' parameter in all versions up to, and including, 1.20.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

CVE-2025-5340 Music Player for Elementor <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via album_buy_url Parameter

The Music Player for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘albumbuyurl’ parameter in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

WordPress SHOUT plugin <= 3.5.3 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao KhanhVCI - VNPT in WordPress Plugin SHOUT versions = 3.5.3...

CVE-2025-4224

CVE-2025-4224 (wpForo + wpForo Advanced Attachments) affects the WordPress plugin pair and enables Stored Cross-Site Scripting via media upload names due to insufficient input sanitization and output escaping. According to the provided documents, exploitation requires Custom-level access or highe...

CVE-2025-4047 Broken Link Checker <= 2.4.4 - Missing Autorization to Authenticated (Subscriber+) Plugin Status Dashboard View

The Broken Link Checker plugin for WordPress is vulnerable to unauthorized data access due to a missing capability check on the ajaxfullstatus and ajaxdashboardstatus functions in all versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with Subscriber-level...

PT-2025-23595 · WordPress · Wp Plugin Info Card

Name of the Vulnerable Software and Affected Versions: WP Plugin Info Card plugin for WordPress versions up to, and including, 5.3.1 Description: The issue is related to Stored Cross-Site Scripting via the containerid parameter due to insufficient input sanitization and output escaping. This allo...

PT-2025-23602 · WordPress · Popup Maker

Name of the Vulnerable Software and Affected Versions: Popup Maker plugin for WordPress versions up to, and including, 1.20.4 Description: The issue is related to Stored Cross-Site Scripting via the popupID parameter due to insufficient input sanitization and output escaping. This allows...

CVE-2025-3919

The WordPress Comments Import & Export plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the savesettings function in all versions up to, and including, 2.4.3. Additionally, the plugin fails to properly sanitize and escape FTP settings...

CVE-2025-3919

CVE-2025-3919 affects the WordPress plugin WordPress Comments Import & Export. The issue is an unauthorized data modification vulnerability caused by a missing capability check in the save_settings function across versions up to 2.4.3, compounded by improper sanitization/escaping of FTP settings....

CVE-2025-3919 WordPress Comments Import & Export <= 2.4.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting

The WordPress Comments Import & Export plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the savesettings function in all versions up to, and including, 2.4.3. Additionally, the plugin fails to properly sanitize and escape FTP settings...

WordPress Real Cookie Banner Pro plugin < 5.1.6 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin Real Cookie Banner Pro versions 5.1.6...

CVE-2025-4672

The Offsprout Page Builder plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization placed on the permissioncallback function in versions 2.2.1 to 2.15.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to read, create,...

CVE-2025-4103

The WP-GeoMeta plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the wpajaxwpgmstartgeojsonimport function in versions 0.3.4 to 0.3.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their...

CVE-2025-5290

The Borderless – Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2025-4944

The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Compare and Google Maps widgets in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This...

CVE-2025-5286

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘additionalsettings’ parameter in all versions up to, and including, 5.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...