PT-2025-32031 · WordPress · Flex Guten

Name of the Vulnerable Software and Affected Versions: Flex Guten plugin for WordPress versions up to and including 1.2.5 Description: The Flex Guten plugin for WordPress is susceptible to Stored Cross-Site Scripting via the thumbnailHoverEffect parameter due to insufficient input sanitization an...

PT-2025-32081 · WordPress · Request A Quote Form

Name of the Vulnerable Software and Affected Versions: Request a Quote Form plugin for WordPress versions prior to 2.5.3 Description: The Request a Quote Form plugin for WordPress is susceptible to Remote Code Execution due to improper validation of user input before it is used as a function name...

PT-2025-32035 · WordPress · Cleverreach® Wp Plugin

Name of the Vulnerable Software and Affected Versions: CleverReach® WP plugin for WordPress versions through 1.5.20 Description: The CleverReach® WP plugin for WordPress is susceptible to time-based SQL Injection via the title parameter. Insufficient escaping of user-supplied input and inadequate...

WordPress plugin CleverReach 注入漏洞

WordPress CleverReach is a cloud-based enterprise email marketing software that supports integration with WordPress, WooCommerce and other platforms, providing automated marketing, personalized email delivery, A/B testing and more. WordPress CleverReach suffers from a SQL injection vulnerability...

PT-2025-32146 · WordPress · Givewp – Donation Plugin/Fundraising Platform

Name of the Vulnerable Software and Affected Versions: GiveWP – Donation Plugin and Fundraising Platform versions prior to 4.6.1 Description: The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is susceptible to information exposure. This allows unauthenticated attackers to...

PT-2025-32036 · WordPress · Wpbakery Page Builder For Wordpress

Name of the Vulnerable Software and Affected Versions: WPBakery Page Builder for WordPress plugin versions prior to 8.6 Description: The WPBakery Page Builder for WordPress plugin is susceptible to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on...

CVE-2012-10027 WordPress Plugin WP-Property <= 1.35.0 PHP File Upload

WP-Property plugin for WordPress up to and including version 1.35.0 contains an unauthenticated file upload vulnerability in the third-party uploadify.php script. A remote attacker can upload arbitrary PHP files to a temporary directory without authentication, leading to remote code execution...

CVE-2025-8294

The Download Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access a...

CVE-2025-5061

CVE-2025-5061 affects WordPress plugin WP Import Export Lite (versions ≤ 3.9.29). The vulnerability arises from missing file type validation in the wpie_parse_upload_data function, enabling authenticated users with Subscriber-level access (and those granted by an Administrator) to upload arbitrar...

CVE-2025-5061 WP Import Export Lite <= 3.9.29 - Authenticated (Subscriber+) Arbitrary File Upload

The WP Import Export Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpieparseuploaddata' function in all versions up to, and including, 3.9.29. This makes it possible for authenticated attackers, with Subscriber-level access and above...

CVE-2025-8295 Employee Directory <= 4.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess_msg Parameter

The Employee Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccessmsg’ parameter in all versions up to, and including, 4.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-lev...

CVE-2025-8313

The Campus Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccessmsg’ parameter in all versions up to, and including, 1.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2025-8315

The CVE-2025-8315 entry concerns the WordPress WP Easy Contact plugin. A stored cross-site scripting flaw exists in the noaccess_msg parameter affecting all versions up to 4.0.1 due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access or hi...

CVE-2025-7050 Use-your-Drive | Google Drive plugin for WordPress <= 3.3.1- Unauthenticated Stored Cross-Site Scripting via File Metadata

The Use-your-Drive | Google Drive plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in file metadata in all versions up to, and including, 3.3.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-7050

CVE-2025-7050 affects Use-your-Drive | Google Drive plugin for WordPress (versions

WordPress Groundhogg plugin <= 4.2.2 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by 63n0 in WordPress Plugin Groundhogg versions = 4.2.2...

PT-2025-31907 · WordPress · Use-Your-Drive | Google Drive

Name of the Vulnerable Software and Affected Versions: Use-your-Drive | Google Drive plugin for WordPress versions prior to 3.3.2 Description: The Use-your-Drive | Google Drive plugin for WordPress is susceptible to Stored Cross-Site Scripting via the title parameter in file metadata. Insufficien...

CVE-2025-7500

The Ocean Social Sharing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via social icon titles in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level acce...

CVE-2025-6626

The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the API URL Setting in all versions up to, and including, 3.10.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-8212

The Medical Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Typewriter widget in all versions up to, and including, 1.6.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...