CVE-2025-5539 Simplify Contact Management: WP Easy Contact <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Simple Contact Form Plugin for WordPress – WP Easy Contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emdmbmeta' shortcode in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping on user supplied attribute...

PT-2025-23780 · WordPress · Sunshine Photo Cart

Name of the Vulnerable Software and Affected Versions: The Sunshine Photo Cart: Free Client Photo Galleries for Photographers plugin for WordPress versions up to, and including, 3.4.11 Description: The issue is related to privilege escalation via account takeover due to the plugin not properly...

PT-2025-23737 · WordPress · Campus Directory – Faculty

Name of the Vulnerable Software and Affected Versions: Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress versions up to, and including, 1.9.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's emd mb meta shortcode due to insufficient input...

PT-2025-23761 · WordPress · Filterprovider

Name of the Vulnerable Software and Affected Versions: File Provider versions 1.2.3 and earlier Description: The issue is related to the lack of a CSRF check when updating settings in the File Provider WordPress plugin. This could allow attackers to make a logged-in admin change the settings via ...

CVE-2025-3662

The FancyBox for WordPress plugin before 3.3.6 does not escape captions and titles attributes before using them to populate galleries' caption fields. The issue was received as a Contributor+ Stored XSS, however one of our researcher Marc Montpas escalated it to an Unauthenticated Stored XSS...

CVE-2025-4797

The CVE CVE-2025-4797 concerns the Golo - City Travel Guide WordPress Theme. A privilege-escalation vulnerability in which the plugin fails to validate a user’s identity before setting an authorization cookie allows unauthenticated attackers to log in as arbitrary users (including admins) if they...

PT-2025-23594 · WordPress · Woocommerce Ultimate Gift Card

Name of the Vulnerable Software and Affected Versions: Ultimate Gift Cards for WooCommerce plugin for WordPress versions prior to 3.1.5 Description: The issue is related to boolean-based SQL Injection via the default price and product id parameters. This is due to insufficient escaping of...

Malware Masquerades as Legitimate, Hidden WordPress Plugin with Remote Code Execution Capabilities

📢In case you missed it, Wordfence just published itsannual WordPress security report for 2024. Read it now to learn more about the evolving risk landscape of WordPress so you can keep your sites protected in 2025 and beyond. The Wordfence Threat Intelligence team recently discovered an interestin...

CVE-2025-4595

The FastSpring plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fastspring/block-fastspringblocks-complete-product-catalog' block in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping on the 'color' attribute. Thi...

CVE-2025-5016

The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Excerpt Highlights in all versions up to, and including, 4.24.5 Free and 2.27.6 Premium due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2025-4590

The Daisycon prijsvergelijkers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'daisyconuitvaart' shortcode in all versions up to, and including, 4.9.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

PT-2025-23372 · WordPress · Daisycon Prijsvergelijkers Plugin

Name of the Vulnerable Software and Affected Versions: Daisycon prijsvergelijkers plugin for WordPress versions up to, and including, 4.8.4 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'daisycon uitvaart' shortcode due to insufficient input sanitization and...

PT-2025-23371 · WordPress · Wp-Geometa

Name of the Vulnerable Software and Affected Versions: WP-GeoMeta plugin for WordPress versions 0.3.4 through 0.3.5 Description: The issue is related to a missing capability check on the wp ajax wpgm start geojson import function, allowing authenticated attackers with Subscriber-level access and...

PT-2025-23367 · WordPress · Relevanssi

Name of the Vulnerable Software and Affected Versions: Relevanssi – A Better Search plugin for WordPress versions up to, and including, 4.24.5 Free and 2.27.6 Premium Description: The issue is related to Stored Cross-Site Scripting via the Excerpt Highlights due to insufficient input sanitization...

PT-2025-23374 · WordPress · Psw Front-End Login & Registration

Name of the Vulnerable Software and Affected Versions: PSW Front-end Login & Registration plugin for WordPress versions up to, and including, 1.12 Description: The issue is related to Privilege Escalation due to a weak, low-entropy OTP mechanism used in the forget function. This allows...

CVE-2025-4659 Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.4 - Unauthenticated Full Path Disclosure

The Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.4.4. This makes it possible for unauthenticated attackers to retrieve the full path of the web...

Over 100,000 WordPress Sites at Risk from Critical CVSS 10.0 Vulnerability in Wishlist Plugin

Cybersecurity researchers have disclosed a critical unpatched security flaw impacting TI WooCommerce Wishlist plugin for WordPress that could be exploited by unauthenticated attackers to upload arbitrary files. TI WooCommerce Wishlist, which has over 100,000 active installations, is a tool to all...

CVE-2025-5287

The CVE-2025-5287 vulnerability affects the WordPress plugin Likes and Dislikes (≤ 1.0.0). Root cause: insufficient escaping / lack of prepared statements in the SQL queries used by the my_likes_dislikes_action/ajax flow, allowing unauthenticated SQL injection via the post parameter. Impact: atta...

Exploit for Use of a Broken or Risky Cryptographic Algorithm in File_Away_Project File_Away

POC - CVE-2025-2539 File Away = 3.9.9.0.1 - Missing Author...

CVE-2025-4223

The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘loginurl’ parameter in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping. This makes it possible for...