CVE-2024-11190 jwp-a11y <= 4.1.7 - Admin+ Stored XSS

The jwp-a11y WordPress plugin through 4.1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-10677 BTEV <= 2.0.2 - Settings Update via CSRF

The BTEV WordPress plugin through 2.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-10631

The CVE-2024-10631 entry concerns the WordPress Countdown Timer for Block Editor plugin (versions up to 1.0.5). The issue is that the plugin does not validate and escape certain block options before outputting them in pages or posts where the block is embedded, which could allow Stored Cross-Site...

CVE-2024-10075 Jetpack < 13.8 - Unauthenticated Arbitrary Block & Shortcode Execution

The Jetpack WordPress plugin before 13.8 does not ensure that the post created by the Contact Form is only accessible to authorised users, which could allow unauthenticated users to run arbitrary shortcodes and block...

CVE-2024-10098 ApplyOnline – Application Form Builder and Manager < 2.6.3 - Unauthenticated Application File Access

The ApplyOnline WordPress plugin before 2.6.3 does not protect uploaded files during the application process, allowing unauthenticated users to access them and any private information they contain...

CVE-2024-10054 Happyforms < 1.26.3 - Admin+ Stored XSS

The Happyforms WordPress plugin before 1.26.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-10054

The CVE-2024-10054 entry concerns the WordPress Happyforms plugin (versions before 1.26.3). Affected component: settings sanitization/escaping in the plugin allows high-privilege users (e.g., admins) to perform Stored Cross-Site Scripting, potentially even when unfiltered_html is disallowed (nota...

CVE-2025-4589

The Bon Toolkit WordPress plugin (versions up to 1.3.2) is vulnerable to Stored Cross-Site Scripting via the bt-map shortcode due to insufficient input sanitization and output escaping. Exploitation requires authenticated access (contributor level or higher) and can inject scripts that execute wh...

PT-2025-21525 · WordPress · Pagelayer

Name of the Vulnerable Software and Affected Versions: Page Builder: Pagelayer versions prior to 1.9.0 Description: The issue concerns the Page Builder: Pagelayer WordPress plugin, where versions prior to 1.9.0 do not properly sanitise and escape some of its settings. This could allow...

PT-2025-21390

Name of the Vulnerable Software and Affected Versions: coreActivity: Activity Logging for WordPress plugin versions prior to 1.8.1 Description: The issue allows unauthenticated users to perform a Stored XSS attack against high-privilege users, such as administrators, due to the plugin's failure t...

PT-2025-21528 · WordPress · 10Web Photo Gallery

Name of the Vulnerable Software and Affected Versions: Photo Gallery by 10Web for WordPress versions prior to 1.8.29 Description: The issue allows high-privilege users, such as administrators, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability ...

PT-2025-21258

Name of the Vulnerable Software and Affected Versions: EG-Series plugin for WordPress versions up to, and including, 2.1.1 Description: The issue is related to Stored Cross-Site Scripting via the plugin's series shortcode due to insufficient input sanitization and output escaping on user-supplied...

PT-2025-21486 · WordPress · The Kbucket: Your Curated Content

Name of the Vulnerable Software and Affected Versions: The KBucket: Your Curated Content in WordPress plugin versions prior to 4.1.5 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being...

PT-2025-21460

Name of the Vulnerable Software and Affected Versions: LifterLMS WordPress plugin versions prior to 8.0.1 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page. Thi...

PT-2025-21396 · WordPress · Applyonline

Name of the Vulnerable Software and Affected Versions: ApplyOnline WordPress plugin versions prior to 2.6.3 Description: The issue concerns the ApplyOnline WordPress plugin, which fails to protect files uploaded during the application process. This allows unauthenticated users to access these fil...

PT-2025-21431 · WordPress · Twitter Bootstrap Collapse Aka Accordian Shortcode

Name of the Vulnerable Software and Affected Versions: Twitter Bootstrap Collapse aka Accordian Shortcode WordPress plugin versions 1.0 and earlier Description: The issue concerns the Twitter Bootstrap Collapse aka Accordian Shortcode WordPress plugin, which does not properly validate and escape...

PT-2025-21512 · WordPress · Javascript Logic

Name of the Vulnerable Software and Affected Versions: JavaScript Logic WordPress plugin versions 0.1 and earlier Description: The issue concerns a lack of CSRF check in some areas of the plugin, along with missing sanitization and escaping. This could allow attackers to make logged-in admins add...

10,000 WordPress Sites Affected by Remote Code Execution Vulnerability in UiPress lite WordPress Plugin

📢In case you missed it, Wordfence just published itsannual WordPress security report for 2024. Read it now to learn more about the evolving risk landscape of WordPress so you can keep your sites protected in 2025 and beyond. On March 29th, 2025, we received a submission for a Remote Code Executio...

CVE-2025-3769 Latepoint <= 5.1.92 - Unauthenticated Insecure Direct Object Reference

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.92 via the 'viewbookingsummaryinlightbox' due to missing validation on a user controlled key. This makes it possible...

CVE-2025-3649

The LightPress Lightbox WordPress plugin before 2.3.4 does not check download links point to valid, non-Javascript URLs, allowing users with at least the contributor role to conduct Stored XSS attacks...