CVE-2015-1582

Multiple cross-site scripting XSS vulnerabilities in the Spider Facebook plugin before 1.0.11 for WordPress allow 1 remote attackers to inject arbitrary web script or HTML via the appid parameter in a registration task to the default URI or remote administrators to inject arbitrary web script or...

CVE-2012-3434

Multiple cross-site scripting XSS vulnerabilities in userperspan.php in the Count Per Day module before 3.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 page, 2 datemin, or 3 datemax parameter...

CVE-2012-4264

Multiple cross-site scripting XSS vulnerabilities in the Better WP Security betterwpsecurity plugin before 3.2.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "server variables," a different vulnerability than CVE-2012-4263...

CVE-2011-5304

Multiple cross-site scripting XSS vulnerabilities in the Sodahead Polls plugin before 2.0.4 for WordPress allow remote attackers to inject arbitrary web script or HTML via 1 the pollid parameter to customizer.php or 2 the customize parameter to poll.php...

CVE-2011-5128

Multiple cross-site scripting XSS vulnerabilities in the Adminimize plugin before 1.7.22 for WordPress allow remote attackers to inject arbitrary web script or HTML via the page parameter to 1 inc-options/deinstalloptions.php, 2 inc-options/themeoptions.php, or 3 inc-options/imexportoptions.php, ...

CVE-2025-4105

CVE-2025-4105 affects the WordPress Splitit plugin (versions up to 4.2.8). The issue is due to missing capability checks, enabling authenticated users with Subscriber+ privileges to modify plugin settings, including changing the environment between sandbox and production. The impact is unauthoriz...

CVE-2025-31922

Cross-Site Request Forgery CSRF vulnerability in QuanticaLabs CSS3 Accordions for WordPress css3accordions allows Stored XSS.This issue affects CSS3 Accordions for WordPress: from n/a through = 3.0...

CVE-2024-13313

The AWeber WordPress plugin through 7.3.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-9390

CVE-2024-9390 affects the WordPress plugin RegistrationMagic prior to version 6.0.2.1. The issue arises because the plugin does not sanitize and escape several settings, allowing high-privilege users (e.g., admins) to perform Stored XSS even when unfiltered_html is disallowed (such as in multisit...

CVE-2024-8617

The Quiz Maker WordPress plugin is vulnerable prior to version 6.5.9.9 due to insufficient sanitization/escaping of certain settings, enabling Stored XSS for high-privilege users (e.g., admins) even when unfiltered_html is disallowed (including multisite). Affected versions include 6.5.9.8 and ea...

Wordfence Intelligence Weekly WordPress Vulnerability Report (May 5, 2025 to May 11, 2025)

In case you missed it, Wordfence just published itsannual WordPress security report for 2024. Read it now to learn more about the evolving risk landscape of WordPress so you can keep your sites protected in 2025 and beyond. Last week, there were 224 vulnerabilities disclosed in 207 WordPress...

CVE-2024-8988

CVE-2024-8988 concerns PeepSo Core: File Uploads for WordPress. It allows an unauthenticated attacker to exploit an Insecure Direct Object Reference via the file_download REST endpoint due to missing validation on a user-controlled key, enabling download of files uploaded by other users. Affected...

Wordfence Intelligence Weekly WordPress Vulnerability Report (April 28, 2025 to May 4, 2025)

In case you missed it, Wordfence just published itsannual WordPress security report for 2024. Read it now to learn more about the evolving risk landscape of WordPress so you can keep your sites protected in 2025 and beyond. Last week, there were 84 vulnerabilities disclosed in 68 WordPress Plugin...

CVE-2025-2806

The tagDiv Composer plugin for WordPress, used by the Newspaper theme, is vulnerable to Reflected Cross-Site Scripting via the ‘data’ parameter in all versions up to, and including, 5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacker...

CVE-2025-47635 WordPress WebinarPress plugin <= 1.33.28 - Server Side Request Forgery (SSRF) Vulnerability

Server-Side Request Forgery SSRF vulnerability in WPWebinarSystem WebinarPress wp-webinarsystem allows Server Side Request Forgery.This issue affects WebinarPress: from n/a through = 1.33.28...

PT-2025-20035 · WordPress · Wz Followed Posts

Name of the Vulnerable Software and Affected Versions: WZ Followed Posts – Display what visitors are reading plugin for WordPress versions up to and including 3.1.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'wfp' shortcode due to insufficient input...

CVE-2024-13418

CVE-2024-13418 is tied to WordPress ecosystems where multiple plugins/themes (notably the Smart Framework family: Benaa, April, Beyot, Auteur; and related plugins) expose an Arbitrary File Upload vulnerability via a missing capability check in ajaxUploadFonts(). The issue allows authenticated att...

CVE-2024-13419 Smart Framework <= Multiple Plugins - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting

Multiple plugins and/or themes for WordPress using Smart Framework are vulnerable to Stored Cross-Site Scripting due to a missing capability check on the saveOptions and importThemeOptions functions in various versions. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2025-1458 Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.29 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets like Dual Button, Creative Button, Image Stack and more in all versions up to, and including, 5.10.29 due to...

PT-2025-17947 · WordPress · Element Pack Elementor Addons

Name of the Vulnerable Software and Affected Versions: The Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites plugin versions up to, and including, 5.10.29 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitizati...