3392 matches found
CVE-2024-10558
The Form Maker by 10Web WordPress plugin, in versions prior to 1.15.30 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape certain settings. This vulnerability allows high-privilege users, such as administrators, to perform XSS atta...
CVE-2025-0718
The Nested Pages WordPress plugin before 3.2.13 does not sanitise and escape some of its settings, which could allow high privilege users such as contributors to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2025-1446 Pods < 3.2.8.2 - Admin+ SQL Injection
The Pods WordPress plugin before 3.2.8.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks...
CVE-2025-0718 Nested Pages < 3.2.13 - Contributor+ Stored XSS
The Nested Pages WordPress plugin before 3.2.13 does not sanitise and escape some of its settings, which could allow high privilege users such as contributors to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2025-2186
The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable to SQL Injection via the ‘automationId’ parameter in all versions up to, and including, 3.5.1 due to insufficient escaping on the user supplied parameter and...
CVE-2025-1311
CVE-2025-1311 affects the WooCommerce Multivendor Marketplace – REST API for WooCommerce (WCFM) plugin. The vulnerability is an SQL Injection via the id parameter in update_delivery_status() in all versions up to 1.6.2, caused by insufficient escaping and inadequate SQL query preparation. Authent...
CVE-2025-2303 Block Logic <= 1.0.8 - Authenticated (Contributor+) Remote Code Execution
The Block Logic – Full Gutenberg Block Display Control plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0.8 via the blocklogicchecklogic function. This is due to the unsafe evaluation of user-controlled input. This makes it possible for...
CVE-2024-13737 Motors – Car Dealer, Classifieds & Listing <= 1.4.57 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Listing Template Creation
The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability checks on the motorscreatetemplate and motorsdeletetemplate functions in all versions up to, and including, 1.4.57. This makes it possible for...
CVE-2025-2290
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Unauthenticated Post Trashing due to a missing capability check on the deleteaccessplan function and the related AJAX calls in all versions up to, and including, 8.0.1. This makes it possible for...
CVE-2025-1802
CVE-2025-1802 (HT Mega – Absolute Addons For Elementor, WordPress) : Stored Cross-Site Scripting via the marker_title, notification_content, and stt_button_text parameters affects all versions up to and including 2.8.3. Root cause is insufficient input sanitization and output escaping. This enabl...
CVE-2024-13878
The SpotBot WordPress plugin, in versions 0.1.8 and earlier , is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape a parameter before outputting it back to the page. This flaw could be exploited to target high-privilege users, such ...
CVE-2025-1766 Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Missing Authorization to Unauthenticated Payment Status Update
The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'paymentcomplete' function in all versions up to, and including, 4.0.24. This makes it possible for unauthenticated...
CVE-2025-2511 AHAthat Plugin <= 1.6 - Authenticated (Administrator+) SQL Injection via id Parameter
The AHAthat Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 1.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...
CVE-2025-2290
CVE-2025-2290 affects the LifterLMS WordPress plugin (versions up to and including 8.0.1). The issue is an unauthenticated post trashing vulnerability caused by a missing capability check in the delete_access_plan function and related AJAX handlers. Impact per sources is that an unauthenticated a...
CVE-2025-2290 LifterLMS <= 8.0.1 - Missing Authorization to Unauthenticated Post Trashing
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Unauthenticated Post Trashing due to a missing capability check on the deleteaccessplan function and the related AJAX calls in all versions up to, and including, 8.0.1. This makes it possible for...
WHMPress Plugin for WordPress < 6.3-revision-1 Local File Inclusion
The WordPress WHMPress Plugin installed on the remote host is affected by a local file inclusion vulnerability due to improper validation of user-supplied input inside of the PHP's include function in the whmpressdomainsearchajaxextendedresults function. Note that the scanner has not tested for...
CVE-2025-1773
The Traveler theme for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...
CVE-2024-13602
The Poll Maker WordPress plugin before 5.5.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2025-26556 WordPress WP AntiDDOS Plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in zzmaster WP AntiDDOS wpantiddos allows Reflected XSS.This issue affects WP AntiDDOS: from n/a through = 2.0...