CVE-2025-2558

CVE-2025-2558 describes an unauthenticated Local File Inclusion (LFI) in the WordPress theme The Wound (versions

PT-2025-17859 · WordPress · Breeze Display

Name of the Vulnerable Software and Affected Versions: Breeze Display plugin for WordPress versions up to, and including, 1.2.3 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated attackers with...

PT-2025-17847 · WordPress · Eform

Name of the Vulnerable Software and Affected Versions: eForm - WordPress Form Builder plugin versions up to, and including, 4.18.0 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to...

PT-2025-17720 · WordPress · Buddypress Force Password Change

Name of the Vulnerable Software and Affected Versions: Buddypress Force Password Change plugin for WordPress versions up to, and including, 0.1 Description: The issue allows for authenticated account takeover due to improper validation of a user's identity prior to updating their password through...

CVE-2025-46251 WordPress VikRestaurants Table Reservations and Take-Away plugin <= 1.3.3 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in e4jvikwp VikRestaurants vikrestaurants allows Cross Site Request Forgery.This issue affects VikRestaurants: from n/a through = 1.3.3...

CVE-2025-46232

CVE-2025-46232 affects the WordPress plugin “Alt Text AI” (Download Alt Text AI) and covers versions up to and including 1.9.93. The issue is a Missing/Misconfigured Authorization vulnerability, i.e., broken access control that could enable unauthorized access to protected functionality. The publ...

CVE-2025-2594

The User Registration & Membership WordPress plugin before 4.1.3 does not properly validate data in an AJAX action when the Membership Addon is enabled, allowing attackers to authenticate as any user, including administrators, by simply using the target account's user ID...

PT-2025-17521 · WordPress · Classic Editor +1

Name of the Vulnerable Software and Affected Versions: Ocean Extra plugin for WordPress versions up to, and including, 2.4.6 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping via the ocean gallery id parameter. This allows...

PT-2025-17473 · WordPress · The Greenshift

Name of the Vulnerable Software and Affected Versions: Greenshift – animation and page builder blocks plugin for WordPress versions 11.4 through 11.4.5 Description: The Greenshift plugin is vulnerable to arbitrary file uploads due to missing file type validation in the gspb make proxy api request...

Exploit for CVE-2025-3102

CVE-2025-3102 🛠️ SureTriggers Exploit Script Script ini diguna...

CVE-2025-2010

Summary (CVE-2025-2010): WordPress Plugin JobWP (Job Board/Job Listing/Career Page) versions up to and including 2.3.9 are vulnerable to an unauthenticated SQL Injection via the jobwp_upload_resume parameter. The root cause is insufficient escaping and lack of proper query preparation, enabling a...

EUVD-2025-11919

The JobWP – Job Board, Job Listing, Career Page and Recruitment Plugin plugin for WordPress is vulnerable to SQL Injection via the 'jobwpuploadresume' parameter in all versions up to, and including, 2.3.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparati...

PT-2025-17350 · WordPress · Jobwp

Name of the Vulnerable Software and Affected Versions: The JobWP – Job Board, Job Listing, Career Page and Recruitment Plugin plugin for WordPress versions up to, and including, 2.3.9 Description: The issue is related to SQL Injection via the jobwp upload resume parameter due to insufficient...

PT-2025-17256 · WordPress · The Coupon Affiliates – Affiliate Plugin For Woocommerce

Name of the Vulnerable Software and Affected Versions: The Coupon Affiliates – Affiliate Plugin for WooCommerce plugin for WordPress versions up to, and including, 6.3.0 Description: The issue is related to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping...

PT-2025-17249 · WordPress · Piotnet Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Piotnet Addons For Elementor plugin for WordPress versions up to, and including, 2.4.34 Description: The issue is related to Stored Cross-Site Scripting via the 'PAFE Before After Image Comparison Slider' widget due to insufficient input...

CVE-2025-27302

CVE-2025-27302 : WordPress CHATLIVE plugin (

CVE-2025-32513

CVE-2025-32513 affects the WordPress plugin Nomupay Payment Processing Gateway (Total processing card payments for WooCommerce). The issue is an improper input neutralization in web page generation causing a Reflected XSS . Affected: versions from n/a up to and including 7.1.6. Impact is describe...

CVE-2025-32573

KiotViet Sync WordPress plugin suffers an SQL Injection (CVE-2025-32573) due to improper neutralization of special elements in SQL commands. Affected: KiotViet Sync versions up to 1.8.3 (per CVE details); patched in 1.8.4+ per PatchStack entry. Impact: potential unauthorized data access/manipulat...

CVE-2025-32578 WordPress Coming Soon Countdown Plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Mapro Collins Coming Soon Countdown coming-soon-countdown allows Reflected XSS.This issue affects Coming Soon Countdown: from n/a through = 2.2...

CVE-2025-32666

CVE-2025-32666 concerns the WordPress plugin Hive Support. The vulnerability is a reflected Cross-Site Scripting (XSS) flaw in Hive Support versions up to and including 1.2.2, enabling attacker-controlled input to be reflected in web pages. Public sources in the Connected documents indicate remed...