3392 matches found
CVE-2025-3510
The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes in all versions up to, and including, 5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...
CVE-2025-4131
The GmapsMania plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's gmap shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, wi...
CVE-2025-3815 SurveyJS <= 1.12.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
The SurveyJS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.12.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...
CVE-2025-3952
The Projectopia – WordPress Project Management plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'ptoremovelogo' function in all versions up to, and including, 5.1.16. This makes it possible for...
CVE-2025-3779 Personizely <= 0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via widgetId Parameter
The Personizely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘widgetId’ parameter in all versions up to, and including, 0.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access a...
CVE-2025-2890
The tagDiv Opt-In Builder plugin for WordPress is vulnerable to time-based SQL Injection via the ‘subscriptionCouponId’ parameter in all versions up to, and including, 1.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Thi...
CVE-2025-3513 SureForms < 1.4.4 - Admin+ Stored XSS
The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2025-3858
The Formality plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ parameter in all versions up to, and including, 1.5.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...
CVE-2024-13420
Multiple plugins and/or themes for WordPress are vulnerable to unauthorized access due to a missing capability check on several AJAX actions like 'gsfresetsectionoptions', 'gsfresetsectionoptions', 'gsfcreatepresetoptions' and more in various versions. This makes it possible for authenticated...
CVE-2025-1326
The Homey theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the homeyreservationdel function in all versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete...
CVE-2025-4177
CVE-2025-4177 affects the WordPress plugin Flynax Bridge . The vulnerability is due to a missing capability check in the deleteUser() function, enabling unauthenticated attackers to delete arbitrary users on all versions up to and including 2.2.0. The CVE entry indicates an unauthenticated arbitr...
PT-2025-18761 · WordPress · Mstore Api +1
Name of the Vulnerable Software and Affected Versions: MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress versions up to, and including, 4.17.4 Description: The issue is related to limited privilege escalation due to a lack of restriction of role when registering,...
Wordfence Intelligence Weekly WordPress Vulnerability Report (April 21, 2025 to April 27, 2025)
In case you missed it, Wordfence just published itsannual WordPress security report for 2024. Read it now to learn more about the evolving risk landscape of WordPress so you can keep your sites protected in 2025 and beyond. Last week, there were 232 vulnerabilities disclosed in 199 WordPress...
CVE-2025-3452
The SecuPress Free — WordPress Security plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'secupressreinstallpluginsadminajaxcb' function in all versions up to, and including, 2.3.9. This makes it possible for authenticated attackers,...
CVE-2025-2893
The Gutenverse – Ultimate Block Addons and Page Builder for Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's countdown Block in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping on user supplied...
CVE-2025-3521
CVE-2025-3521 affects the WordPress plugin “Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder” (vulnerable up to 3.4.0). The flaw is stored XSS in Social Link icons due to insufficient input sanitization and output escaping, exploitable by authenticated atta...
CVE-2025-3504
CVE-2025-3504 affects the WP Maps WordPress plugin prior to 4.7.2. The issue is that map settings aren’t properly sanitized/escaped, enabling stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disallowed (e.g., multisite). Remediation: upgrade to WP Maps 4.7.2 or later...
PT-2025-18353 · WordPress · Newsblogger
Name of the Vulnerable Software and Affected Versions: NewsBlogger theme for WordPress versions up to, and including, 0.2.5.1 Description: The NewsBlogger theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the newsblogger install and activate plugin...
PT-2025-18786 · Beaver Builder Team +2 · Beaver Builder Plugin +2
Name of the Vulnerable Software and Affected Versions: Beaver Builder Plugin Starter Version versions prior to 2.9.1 Description: The Beaver Builder Plugin Starter Version for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the save enabled icons function...
