PT-2025-17350 · WordPress · Jobwp

Name of the Vulnerable Software and Affected Versions: The JobWP – Job Board, Job Listing, Career Page and Recruitment Plugin plugin for WordPress versions up to, and including, 2.3.9 Description: The issue is related to SQL Injection via the jobwp upload resume parameter due to insufficient...

PT-2025-17256 · WordPress · The Coupon Affiliates – Affiliate Plugin For Woocommerce

Name of the Vulnerable Software and Affected Versions: The Coupon Affiliates – Affiliate Plugin for WooCommerce plugin for WordPress versions up to, and including, 6.3.0 Description: The issue is related to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping...

PT-2025-17249 · WordPress · Piotnet Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Piotnet Addons For Elementor plugin for WordPress versions up to, and including, 2.4.34 Description: The issue is related to Stored Cross-Site Scripting via the 'PAFE Before After Image Comparison Slider' widget due to insufficient input...

CVE-2025-27302

CVE-2025-27302 : WordPress CHATLIVE plugin (

CVE-2025-32513

CVE-2025-32513 affects the WordPress plugin Nomupay Payment Processing Gateway (Total processing card payments for WooCommerce). The issue is an improper input neutralization in web page generation causing a Reflected XSS . Affected: versions from n/a up to and including 7.1.6. Impact is describe...

CVE-2025-32573

KiotViet Sync WordPress plugin suffers an SQL Injection (CVE-2025-32573) due to improper neutralization of special elements in SQL commands. Affected: KiotViet Sync versions up to 1.8.3 (per CVE details); patched in 1.8.4+ per PatchStack entry. Impact: potential unauthorized data access/manipulat...

CVE-2025-32578 WordPress Coming Soon Countdown Plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Mapro Collins Coming Soon Countdown coming-soon-countdown allows Reflected XSS.This issue affects Coming Soon Countdown: from n/a through = 2.2...

CVE-2025-32666

CVE-2025-32666 concerns the WordPress plugin Hive Support. The vulnerability is a reflected Cross-Site Scripting (XSS) flaw in Hive Support versions up to and including 1.2.2, enabling attacker-controlled input to be reflected in web pages. Public sources in the Connected documents indicate remed...

CVE-2025-32682 WordPress MapSVG Lite plugin <= 8.6.4 - Arbitrary File Upload Vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in RomanCode MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through = 8.6.4...

CVE-2025-39526 WordPress Hotel Booking Plugin <= 3.6 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in nicdark Hotel Booking nd-booking allows PHP Local File Inclusion.This issue affects Hotel Booking: from n/a through = 3.6...

CVE-2025-39417

CVE-2025-39417 describes a CSRF-to-Stored XSS vulnerability in the WordPress plugin “Redirect wordpress to welcome or landing page” (versions n/a through 2.0). Exploitation details are not provided in the connected documents; the root cause is a CSRF flaw that permits storing and triggering XSS p...

CVE-2025-39417 WordPress Redirect wordpress to welcome or landing page plugin <= 2.0 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Eslam Mahmoud Redirect wordpress to welcome or landing page redirect-to-welcome-or-landing-page allows Stored XSS.This issue affects Redirect wordpress to welcome or landing page: from n/a through = 2.0...

CVE-2025-39418 WordPress RSS Manager plugin <= 0.06 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in ajayver RSS Manager allows Stored XSS. This issue affects RSS Manager: from n/a through 0.06...

CVE-2025-39444 WordPress MaxButtons plugin <= 9.8.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in maxfoundry MaxButtons maxbuttons allows Stored XSS.This issue affects MaxButtons: from n/a through = 9.8.3...

PT-2025-16934 · WordPress · Wp Editor

Name of the Vulnerable Software and Affected Versions: WP Editor plugin for WordPress versions up to, and including, 1.2.9.1 Description: The issue allows authenticated attackers with Administrator-level access and above to read arbitrary files on the affected site's server, potentially revealing...

PT-2025-17110 · WordPress · Push Notification For Wp

Name of the Vulnerable Software and Affected Versions: All push notification for WP versions 1.5.3 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that also allows Reflected XSS. This means an attacker could potentially trick a user into performing...

WordPress Wanderland Theme <= 1.7.1 is vulnerable to Local File Inclusion

Software Wanderland Type Theme Vulnerable versions = 1.7.1 Fixed in 1.7.2 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-39467 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID cc767e365da0 Credits Bonds Required privilege Unauthenticated...

CVE-2025-39524

CVE-2025-39524 is a stored XSS vulnerability in the WordPress Html5 Audio Player plugin. The issue arises from improper neutralization of script-related HTML tags in the plugin and affects Html5 Audio Player versions up to and including 2.2.28. If exploited, an attacker could inject scripted cont...

CVE-2025-39577 WordPress PropertyHive <= 2.1.2 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Property Hive PropertyHive allows Stored XSS. This issue affects PropertyHive: from n/a through 2.1.2...

CVE-2025-39582 WordPress WP Data Access plugin <= 5.5.36 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Passionate Programmer Peter WP Data Access wp-data-access allows DOM-Based XSS.This issue affects WP Data Access: from n/a through = 5.5.36...