CVE-2025-31571

CVE-2025-31571 involves a reflected Cross-Site Scripting vulnerability in The Logo Slider WordPress plugin. Affected software: The Logo Slider (vulnerable up to 1.0.0). Root cause: improper neutralization of input during web page generation. Impact: potential for an attacker to execute scripts in...

CVE-2025-31085 WordPress xili-language plugin <= 2.21.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Michel - xiligroup dev xili-language xili-language allows Reflected XSS.This issue affects xili-language: from n/a through = 2.21.2...

CVE-2025-31822 WordPress WordPress Simple HTML Sitemap plugin <= 3.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in Ashish Ajani WP Simple HTML Sitemap wp-simple-html-sitemap allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Simple HTML Sitemap: from n/a through = 3.5...

CVE-2025-31763

Technical details about CVE-2025-31763 are not publicly available in the provided documents. Monitor for updates.

CVE-2025-31730 WordPress Marketer Addons Plugin <= 1.0.1 - Stored Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in DigitalCourt Marketer Addons marketer-addons allows Stored XSS.This issue affects Marketer Addons: from n/a through = 1.0.1...

WordPress WP-LESS plugin <= 1.9.6 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Anhchangmutrang in WordPress Plugin WP-LESS versions = 1.9.6...

CVE-2025-1986 Gutentor < 3.4.7 - Admin+ SQL Injection

The Gutentor WordPress plugin before 3.4.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks...

CVE-2025-30796 WordPress The Ultimate WordPress Toolkit – WP Extended plugin <= 3.0.14 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended allows Reflected XSS.This issue affects The Ultimate WordPress Toolkit – WP Extended: from n/a through = 3.0.14...

PT-2025-14069 · WordPress · Wp Wham Sku Generator For Woocommerce

Name of the Vulnerable Software and Affected Versions: WP Wham SKU Generator for WooCommerce versions 1.6.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables...

PT-2025-14081 · WordPress · Gutentor

Name of the Vulnerable Software and Affected Versions: The Gutentor WordPress plugin versions prior to 3.4.7 Description: The issue allows admins to perform SQL injection attacks due to the lack of sanitization and escaping of a parameter before using it in a SQL statement. Recommendations: For...

PT-2025-14226 · WordPress · Wpfactory Wordpress Adverts Plugin

Name of the Vulnerable Software and Affected Versions: WPFactory WordPress Adverts Plugin versions 1.4 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows the exploitation of incorrectly configured access control security levels. Recommendations: F...

CVE-2025-31600 WordPress DesignO plugin <= 2.6.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in designnbuy DesignO designo allows Cross Site Request Forgery.This issue affects DesignO: from n/a through = 2.6.0...

Hackers Exploit WordPress mu-Plugins to Inject Spam and Hijack Site Images

Threat actors are using the "mu-plugins" directory in WordPress sites to conceal malicious code with the goal of maintaining persistent remote access and redirecting site visitors to bogus sites. mu-plugins, short for must-use plugins, refers to plugins in a special directory...

CVE-2025-23995 WordPress Tantyyellow theme <= 1.0.0.5 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ta2g Tantyyellow allows Reflected XSS.This issue affects Tantyyellow: from n/a through 1.0.0.5...

Exploit for CVE-2024-25600

CVE-2024-25600 Exploit - WordPress Bricks Builder Remote Code...

CVE-2025-2006 Inline Image Upload for BBPress <= 1.1.19 - Authenticated (Subscriber+) Arbitrary File Upload

The Inline Image Upload for BBPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file extension validation in the file uploading functionality in all versions up to, and including, 1.1.19. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2025-2840

CVE-2025-2840 affects the DAP to Autoresponders Email Syncing plugin for WordPress. The vulnerability is an unauthenticated information exposure through the publicly accessible phpinfo.php script, enabling anyone to view potentially sensitive information from the exposed file. The Wordfence entry...

CVE-2025-31010 WordPress SimplyRETS Real Estate IDX plugin <= 3.0.5 - CSRF to Multiple Admin Actions vulnerability

Cross-Site Request Forgery CSRF vulnerability in ReichertBrothers SimplyRETS Real Estate IDX simply-rets allows Cross Site Request Forgery.This issue affects SimplyRETS Real Estate IDX: from n/a through = 3.0.5...

CVE-2025-31456 WordPress Ultimate Security Checker plugin <= 4.2 - Cross Site Request Forgery (CSRF) to Security Rescan vulnerability

Cross-Site Request Forgery CSRF vulnerability in bsndev Ultimate Security Checker ultimate-security-checker allows Cross Site Request Forgery.This issue affects Ultimate Security Checker: from n/a through = 4.2...

CVE-2025-31456

CVE-2025-31456 describes a CSRF vulnerability in the WordPress plugin Ultimate Security Checker affecting versions up to 4.2. The connected information indicates a CVSS v3.1 base score of 4.3 (Medium) and that the patch status is Unpatched . No explicit exploitation details or affected subcompone...