CVE-2025-5753

CVE-2025-5753 : The WordPress plug‑in “Valuation Calculator” (Commercial Real Estate Valuation Calculator) is vulnerable to Stored Cross‑Site Scripting via the “link” parameter in all versions up to and including 1.3.2. An authenticated attacker with Contributor‑level access can inject scripts th...

CVE-2025-6214 Omnishop <= 1.0.9 - Cross-Site Request Forgery to Arbitrary User Deletion via /users/delete REST Endpoint

The Omnishop plugin for WordPress is vulnerable to Cross-Site Request Forgery on its /users/delete REST route in all versions up to, and including, 1.0.9. The route’s permissioncallback only verifies that the requester is logged in, but fails to require any nonce or other proof of intent. This...

CVE-2025-6214

CVE-2025-6214 (Omnishop) : WordPress plugin Omnishop

CVE-2025-6261

CVE-2025-6261 describes a Stored Cross-Site Scripting flaw in the Fleetwire Fleet Management WordPress plugin (versions

CVE-2025-6190 Realty Portal – Agent <= 0.3.9 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via rp_user_profile() Function

The Realty Portal – Agent plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within the rpuserprofile AJAX handler in versions 0.1.0 through 0.3.9. The handler reads the client-supplied meta key and value pairs from $POST and passes them directly to...

CVE-2025-6215 Omnishop <= 1.0.9 - Missing Registration Restriction to Unauthenticated Account Creation via /users/register REST Endpoint

The Omnishop plugin for WordPress is vulnerable to Unauthenticated Registration Bypass in all versions up to, and including, 1.0.9. Its /users/register endpoint is exposed to the public permissioncallback always returns true and invokes wpcreateuser unconditionally, ignoring the site’s...

PT-2025-30515 · WordPress · Omnishop

Name of the Vulnerable Software and Affected Versions: Omnishop plugin for WordPress versions up to and including 1.0.9 Description: The Omnishop plugin for WordPress is susceptible to unauthenticated registration bypass. The /users/register API endpoint is publicly exposed and unconditionally...

WordPress JetBlocks For Elementor Cross-Site Scripting Vulnerability

WordPress JetBlocks For Elementor is an enhancement plugin designed specifically for Elementor to extend the functionality of your WordPress website. WordPress JetBlocks For Elementor suffers from a cross-site scripting vulnerability that stems from improper input neutralization, which can be...

PT-2025-30514 · WordPress · Omnishop

Name of the Vulnerable Software and Affected Versions: Omnishop versions up to and including 1.0.9 Description: The Omnishop plugin for WordPress is susceptible to Cross-Site Request Forgery on its /users/delete REST route. The route’s permission callback only verifies that the requester is logge...

PT-2025-30513 · WordPress · Realty Portal – Agent

Name of the Vulnerable Software and Affected Versions: Realty Portal – Agent plugin for WordPress versions 0.1.0 through 0.3.9 Description: The Realty Portal – Agent plugin for WordPress is vulnerable to privilege escalation due to missing authorization within the rp user profile AJAX handler. Th...

CVE-2025-8015

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded image's 'Title' and 'Slide link' fields in all versions up to, and including, 7.4.2 due to insufficient input sanitization and output escaping. This makes it possible f...

CVE-2025-8015

CVE-2025-8015 concerns the WordPress plugin “WP Shortcodes Plugin — Shortcodes Ultimate.” The vulnerability is a Stored Cross-Site Scripting (XSS) that arises from insufficient input sanitization and output escaping in image upload fields (Title and slide link). Affected versions include all up t...

CVE-2025-7692

The Orion Login with SMS plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.5. This is due to the olwshandleverifyphone function not utilizing a strong enough OTP value, exposing the hash needed to generate the OTP value, and no restrictions on t...

CVE-2025-6187

The bSecure plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within its orderinfo REST endpoint in versions 1.3.7 through 1.7.9. The plugin registers the /webhook/v2/orderinfo/ route with a permissioncallback that always returns true, effectively bypassing a...

CVE-2025-6213

The Nginx Cache Purge Preload plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.1.1 via the 'nppppreloadcacheonupdate' function. This is due to insufficient sanitization of the $SERVER'HTTPREFERERER' parameter passed from the...

CVE-2025-6187 bSecure 1.3.7 - 1.7.9 - Missing Authorization to Unauthenticated Privilege Escalation via order_info REST Endpoint

The bSecure plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within its orderinfo REST endpoint in versions 1.3.7 through 1.7.9. The plugin registers the /webhook/v2/orderinfo/ route with a permissioncallback that always returns true, effectively bypassing a...

CVE-2025-6213

The CVE concerns the WordPress plugin “Nginx Cache Purge Preload” (NPP) for Nginx caching. Affected: all versions up to and including 2.1.1. Root cause: insufficient sanitization of the HTTP_REFERERER parameter in nppp_preload_cache_on_update, passed from nppp_handle_fastcgi_cache_actions_admin_b...

CVE-2025-6213 Nginx Cache Purge Preload <= 2.1.1 - Authenticated (Administrator+) Remote Code Execution

The Nginx Cache Purge Preload plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.1.1 via the 'nppppreloadcacheonupdate' function. This is due to insufficient sanitization of the $SERVER'HTTPREFERERER' parameter passed from the...

CVE-2025-6187

The WordPress bSecure plugin (versions 1.3.7–1.7.9 ) contains a privilege-escalation flaw in the order_info REST endpoint. The plugin registers the route /webhook/v2/order_info/ with a permission_callback that always returns true, effectively bypassing authentication . This lets unauthenticated a...

CVE-2025-6213 Nginx Cache Purge Preload <= 2.1.1 - Authenticated (Administrator+) Remote Code Execution

The Nginx Cache Purge Preload plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.1.1 via the 'nppppreloadcacheonupdate' function. This is due to insufficient sanitization of the $SERVER'HTTPREFERERER' parameter passed from the...