CVE-2025-32265 WordPress JobWP plugin <= 2.3.9 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Hossni Mubarak JobWP jobwp allows Cross Site Request Forgery.This issue affects JobWP: from n/a through = 2.3.9...

CVE-2025-32249

CVE-2025-32249 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress DirectoryPress plugin, affecting versions up to 3.6.19 (per multiple sources). The CVE entry notes a CSRF issue; the NVD entry lists a CVSS v3.1 base score of 5.4 (Medium) with network attack vector, low integrit...

CVE-2025-32188 WordPress Advanced Woo Labels plugin <= 2.14 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ILLID Advanced Woo Labels allows Stored XSS. This issue affects Advanced Woo Labels: from n/a through 2.14...

CVE-2025-32168 WordPress Gutenify plugin <= 1.5.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CodeYatri Gutenify gutenify allows Stored XSS.This issue affects Gutenify: from n/a through = 1.5.7...

CVE-2024-13645 TagDiv Composer <= 5.3 - Unauthenticated Arbitrary PHP Object Instantiation

The tagDiv Composer plugin for WordPress is vulnerable to PHP Object Instantiation in all versions up to, and including, 5.3 via module parameter. This makes it possible for unauthenticated attackers to Instantiate a PHP Object. No known POP chain is present in the vulnerable software, which mean...

CVE-2025-31846

Missing Authorization vulnerability in Jeroen Schmit Theater for WordPress theatre allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Theater for WordPress: from n/a through = 0.18.7...

Wordfence Intelligence Weekly WordPress Vulnerability Report (March 24, 2025 to March 30, 2025)

Did you know Wordfence runs aBug Bounty Program for all WordPress plugins and themes at no cost to vendors? Researchers can earn up to $31,200 per vulnerability , for all in-scope vulnerabilities submitted to our Bug Bounty Program! Find a vulnerability, submit the details directly to us, and we...

CVE-2024-13637

The Demo Awesome plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the installplugin function in all versions up to, and including, 1.0.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

CVE-2025-31571

CVE-2025-31571 involves a reflected Cross-Site Scripting vulnerability in The Logo Slider WordPress plugin. Affected software: The Logo Slider (vulnerable up to 1.0.0). Root cause: improper neutralization of input during web page generation. Impact: potential for an attacker to execute scripts in...

CVE-2025-31085 WordPress xili-language plugin <= 2.21.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Michel - xiligroup dev xili-language xili-language allows Reflected XSS.This issue affects xili-language: from n/a through = 2.21.2...

CVE-2025-31822 WordPress WordPress Simple HTML Sitemap plugin <= 3.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in Ashish Ajani WP Simple HTML Sitemap wp-simple-html-sitemap allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Simple HTML Sitemap: from n/a through = 3.5...

CVE-2025-31763

Technical details about CVE-2025-31763 are not publicly available in the provided documents. Monitor for updates.

CVE-2025-31730 WordPress Marketer Addons Plugin <= 1.0.1 - Stored Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in DigitalCourt Marketer Addons marketer-addons allows Stored XSS.This issue affects Marketer Addons: from n/a through = 1.0.1...

WordPress WP-LESS plugin <= 1.9.6 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Anhchangmutrang in WordPress Plugin WP-LESS versions = 1.9.6...

CVE-2025-1986 Gutentor < 3.4.7 - Admin+ SQL Injection

The Gutentor WordPress plugin before 3.4.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks...

CVE-2025-30796 WordPress The Ultimate WordPress Toolkit – WP Extended plugin <= 3.0.14 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended allows Reflected XSS.This issue affects The Ultimate WordPress Toolkit – WP Extended: from n/a through = 3.0.14...

PT-2025-14081 · WordPress · Gutentor

Name of the Vulnerable Software and Affected Versions: The Gutentor WordPress plugin versions prior to 3.4.7 Description: The issue allows admins to perform SQL injection attacks due to the lack of sanitization and escaping of a parameter before using it in a SQL statement. Recommendations: For...

PT-2025-14069 · WordPress · Wp Wham Sku Generator For Woocommerce

Name of the Vulnerable Software and Affected Versions: WP Wham SKU Generator for WooCommerce versions 1.6.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables...

PT-2025-14226 · WordPress · Wpfactory Wordpress Adverts Plugin

Name of the Vulnerable Software and Affected Versions: WPFactory WordPress Adverts Plugin versions 1.4 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows the exploitation of incorrectly configured access control security levels. Recommendations: F...

CVE-2025-31600 WordPress DesignO plugin <= 2.6.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in designnbuy DesignO designo allows Cross Site Request Forgery.This issue affects DesignO: from n/a through = 2.6.0...