CVE-2025-5529 Educenter <= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Educenter theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Circle Counter Block in all versions up to, and including, 1.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2025-6989

CVE-2025-6989 (KALLYAS theme for WordPress) is an authenticated (Contributor+) vulnerability in all versions up to 4.21.0 where delete_font() uses insufficient file-path validation, enabling an attacker to delete arbitrary folders on the server. The issue, with CVSS 3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:...

CVE-2025-6989 Kallyas <= 4.21.0 - Authenticated (Contributor+) Arbitrary Folder Deletion

The Kallyas theme for WordPress is vulnerable to arbitrary folder deletion due to insufficient file path validation in the deletefont function in all versions up to, and including, 4.21.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete...

CVE-2025-5529

CVE-2025-5529 concerns the Educenter WordPress theme. According to connected sources, the vulnerability is a stored cross-site scripting (XSS) in the Circle Counter Block affecting Educenter versions up to 1.6.2, caused by insufficient input sanitization and output escaping. Exploitation requires...

CVE-2025-6989 Kallyas <= 4.21.0 - Authenticated (Contributor+) Arbitrary Folder Deletion

The Kallyas theme for WordPress is vulnerable to arbitrary folder deletion due to insufficient file path validation in the deletefont function in all versions up to, and including, 4.21.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete...

CVE-2025-7501

The Wonder Slider Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image title and description DOM in all versions up to, and including, 14.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-8097

The WoodMart theme for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 8.2.6. This is due to insufficient validation of the qty parameter in the woodmartupdatecartitem function. This makes it possible for unauthenticated attackers to manipulate cart...

CVE-2025-6987

The CVE-2025-6987 entry concerns the WordPress plugin Advanced iFrame. A stored XSS exists in the advanced_iframe shortcode across versions up to 2025.5 due to insufficient input sanitization and output escaping of user-supplied attributes. Exploitation requires at least contributor-level (authen...

CVE-2025-7437

The Ebook Store plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ebookstoresaveform function in all versions up to, and including, 5.8012. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's...

CVE-2025-6895

CVE-2025-6895 — Melapress Login Security (WordPress) is an authentication bypass vulnerability in versions 2.1.0–2.1.1. The flaw occurs in get_valid_user_based_on_token(), allowing unauthenticated attackers who know a user meta value to bypass login checks and log in as that user. Multiple connec...

CVE-2024-13507

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to time-based SQL Injection via the dist parameter in all versions up to, and including, 2.8.97 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2024-13507

CVE-2024-13507 affects the WordPress GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin. All versions up to 2.8.97 are vulnerable to a time-based SQL Injection via the dist parameter, caused by insufficient escaping of user-supplied input and inadequate preparati...

CVE-2024-13507 GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.97 - Unauthenticated SQL Injection

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to time-based SQL Injection via the dist parameter in all versions up to, and including, 2.8.97 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2024-13507 GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.97 - Unauthenticated SQL Injection

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to time-based SQL Injection via the dist parameter in all versions up to, and including, 2.8.97 due to insufficient escaping on the user supplied parameter and lack of sufficient...

PT-2025-30967 · WordPress · Educenter

Name of the Vulnerable Software and Affected Versions: Educenter theme for WordPress versions prior to 1.6.3 Description: The Educenter theme for WordPress is susceptible to Stored Cross-Site Scripting through the Circle Counter Block. Insufficient input sanitization and output escaping allows...

PT-2025-30968 · WordPress · Kallyas

Name of the Vulnerable Software and Affected Versions: Kallyas versions prior to 4.21.1 Description: The Kallyas theme for WordPress is susceptible to arbitrary folder deletion due to inadequate file path validation within the delete font function. Authenticated attackers possessing...

WordPress plugin MinimogWP 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2025-30969 · WordPress · Kallyas Theme

Name of the Vulnerable Software and Affected Versions: kallyas theme for WordPress versions prior to 4.21.1 Description: The kallyas theme for WordPress is susceptible to Local File Inclusion via the TH LatestPosts4 widget. Authenticated attackers with Contributor-level access or higher can inclu...

PT-2025-30963 · WordPress · Advanced Iframe

Name of the Vulnerable Software and Affected Versions: Advanced iFrame plugin for WordPress versions prior to 2025.5 Description: The Advanced iFrame plugin for WordPress is susceptible to Stored Cross-Site Scripting through the plugin's advanced iframe shortcode. Insufficient input sanitization...

CVE-2023-7306

The Frontend File Manager Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the wpfmdeletemultiplefiles function in all versions up to, and including, 21.5. This makes it possible for unauthenticated attackers to delete arbitrary posts...