PT-2025-31602

Name of the Vulnerable Software and Affected Versions BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript versions up to and including 2.2.42 Description The BerqWP plugin for WordPress is susceptible to arbitrary file uploads due to...

PT-2025-29985 · WordPress · Wp Knowledgebase

Name of the Vulnerable Software and Affected Versions: Knowledge Base plugin for WordPress versions prior to 2.3.2 Description: The Knowledge Base plugin for WordPress is susceptible to Stored Cross-Site Scripting via the plugin slug setting due to insufficient input sanitization and output...

WordPress GB Forms DB plugin code injection vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A code injection vulnerability exists in the WordPress GB Forms DB plugin that originates in the gbfdbtalktofront function that accepts user input and passes it through...

PT-2025-29989 · WordPress · Copymatic – Ai Content Writer & Generator

Name of the Vulnerable Software and Affected Versions: Copymatic – AI Content Writer & Generator plugin for WordPress versions up to and including 2.1 Description: The Copymatic – AI Content Writer & Generator plugin for WordPress is susceptible to Cross-Site Request Forgery due to missing or...

CVE-2025-7712

CVE-2025-7712: Madara - Core (WordPress) versions

CVE-2025-7712 Madara - Core <= 2.2.3 - Unauthenticated Arbitrary File Deletion

The Madara - Core plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wpmangadeletezip function in all versions up to, and including, 2.2.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, whic...

CVE-2025-5396

The Bears Backup plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.0. This is due to the bbackupajaxhandle function not having a capability check, nor validating user supplied input passed directly to calluserfunc. This makes it possible for...

CVE-2025-5396 Bears Backup <= 2.0.0 - Unauthenticated Remote Code Execution

The Bears Backup plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.0. This is due to the bbackupajaxhandle function not having a capability check, nor validating user supplied input passed directly to calluserfunc. This makes it possible for...

PT-2025-29897 · Alone +1 · Alone +1

Name of the Vulnerable Software and Affected Versions: Bears Backup versions prior to 2.0.1 Description: The Bears Backup plugin for WordPress is vulnerable to Remote Code Execution in all versions up to and including 2.0.0. This is due to the bbackup ajax handle function lacking capability check...

PT-2025-29899 · WordPress · Madara - Core

Name of the Vulnerable Software and Affected Versions: Madara - Core plugin for WordPress versions prior to 2.2.3 Description: The Madara - Core plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wp manga delete zip function. This allows...

WordPress DB Backup <= 6.0 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by 0xd4rk5id3 in WordPress Plugin DB Backup versions = 6.0...

CVE-2025-24759 WordPress WP-BusinessDirectory <= 3.1.5 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in CMSJunkie - WordPress Business Directory Plugins WP-BusinessDirectory wp-businessdirectory allows Blind SQL Injection.This issue affects WP-BusinessDirectory: from n/a through = 3.1.4...

CVE-2025-24777 WordPress Hillter theme <= 3.0.7 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in awethemes Hillter allows Object Injection. This issue affects Hillter: from n/a through 3.0.7...

CVE-2025-24777 WordPress Hillter theme <= 3.0.7 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in awethemes Hillter allows Object Injection. This issue affects Hillter: from n/a through 3.0.7...

CVE-2025-30949 WordPress Site Chat on Telegram plugin <= 1.0.4 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in Guru Team Site Chat on Telegram site-chat-on-telegram allows Object Injection.This issue affects Site Chat on Telegram: from n/a through = 1.0.4...

CVE-2025-30949

CVE-2025-30949 is a PHP Object Injection deserialization vulnerability in the WordPress plugin Site Chat on Telegram (Guru Team Site Chat on Telegram). Affected versions are up to 1.0.4. The issue is triggered via deserializing untrusted data, enabling potential object injection. The CVE is corro...

CVE-2025-31070 WordPress HTML5 Radio Player - WPBakery Page Builder Addon plugin <= 2.5 - Arbitrary File Download vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in LambertGroup HTML5 Radio Player - WPBakery Page Builder Addon lbg-cleverbakery allows Path Traversal.This issue affects HTML5 Radio Player - WPBakery Page Builder Addon: from n/a through = 2.5...

CVE-2025-31072 WordPress Ofiz - Business Consulting Theme plugin <= 2.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in designthemes Ofiz - WordPress Business Consulting Theme ofiz allows Reflected XSS.This issue affects Ofiz - WordPress Business Consulting Theme: from n/a through = 2.0...

CVE-2025-31422

Vulnerability: CVE-2025-31422 in designthemes Visual Art | Gallery WordPress Theme (

CVE-2025-31427 WordPress Invico - WordPress Consulting Business Theme <= 1.9 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in designthemes Invico - WordPress Consulting Business Theme invico allows Reflected XSS.This issue affects Invico - WordPress Consulting Business Theme: from n/a through = 1.9...