CVE-2025-48291

CVE-2025-48291 concerns the WordPress Contest Gallery plugin (versions

CVE-2025-49319 WordPress Wishlist for WooCommerce <= 3.2.3 - Broken Access Control Vulnerability

Missing Authorization vulnerability in WPFactory Wishlist for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Wishlist for WooCommerce: from n/a through 3.2.3...

CVE-2025-49319 WordPress Wishlist for WooCommerce <= 3.2.3 - Broken Access Control Vulnerability

Missing Authorization vulnerability in WPFactory Wishlist for WooCommerce wish-list-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wishlist for WooCommerce: from n/a through = 3.2.3...

CVE-2025-52779

CVE-2025-52779 describes a reflected Cross-Site Scripting vulnerability in the WordPress plugin “Dot html,php,xml etc pages” (versions

CVE-2025-48167

CVE-2025-48167 involves a missing authorization flaw in the WordPress plugin Chatbox Manager (versions up to 1.2.5). The vulnerability stems from incorrectly configured access control security levels, allowing unauthorized actions. Public sources in the connected documents confirm the affected so...

CVE-2025-54023 WordPress WP Delicious plugin <= 1.8.4 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Delicious WP Delicious allows DOM-Based XSS. This issue affects WP Delicious: from n/a through 1.8.4...

CVE-2025-54011 WordPress SMTP2GO plugin <= 1.12.1 - Broken Access Control Vulnerability

Missing Authorization vulnerability in SMTP2GO SMTP2GO smtp2go allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMTP2GO: from n/a through = 1.12.1...

CVE-2025-53995 WordPress JetPopup plugin <= 2.0.15.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetPopup jet-popup allows Stored XSS.This issue affects JetPopup: from n/a through = 2.0.15.1...

CVE-2025-53989

CVE-2025-53989 concerns Crocoblock JetBlocks For Elementor (WordPress plugin). The vulnerability is a Stored Cross-Site Scripting (XSS) in JetBlocks For Elementor versions

CVE-2025-53984

CVE-2025-53984 concerns Crocoblock JetTabs (WordPress plugin) with a stored XSS due to improper input neutralization in JetTabs up to version 2.2.9. The vulnerability is documented across multiple sources (NVD, CVE lists, Patchstack, PT-2025-29733) and is noted as patched in JetTabs 2.2.9+ (the p...

CVE-2025-5284

The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS extension in all versions up to, and including, 2.0.8.2 due to insufficient capability restriction, and...

CVE-2025-6993 Ultimate WP Mail 1.0.17 - 1.3.6 - Missing Authorization to Authenticated (Contributor+) Privilege Escalation via get_email_log_details Function

The Ultimate WP Mail plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization within the getemaillogdetails AJAX handler in versions 1.0.17 to 1.3.6. The handler reads the client-supplied postid and retrieves the corresponding email log post content including the...

CVE-2025-7035

CVE-2025-7035 affects the WordPress Media Library Assistant plugin (versions up to and including 3.26). The root cause is insufficient input sanitization and output escaping on mla_tag_cloud and mla_term_list shortcodes, enabling stored XSS. Exploitation requires authenticated access at contribut...

CVE-2025-7035 Media Library Assistant <= 3.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_tag_cloud and mla_term_list Shortcodes

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mlatagcloud and mlatermlist shortcodes in all versions up to, and including, 3.26 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2025-5284

CVE-2025-5284 affects the WordPress plugin “Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations.” It describes a Stored Cross-Site Scripting (XSS) vulnerability via the Custom JS extension in all versions up to and including 2.0.8.2, caused by ...

CVE-2025-5845

The Affiliate Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘numColumns’ parameter in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2025-6747

CVE-2025-6747 affects the Avada (Fusion) Builder plugin for WordPress prior to and including 3.12.1. The vulnerability is a Stored Cross-Site Scripting (XSS) in the plugin’s fusion_map shortcode caused by insufficient input sanitization and output escaping on user-supplied attributes. Exploitatio...

CVE-2025-5845 Affiliate Reviews <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via numColumns Parameter

The Affiliate Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘numColumns’ parameter in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2025-6043 Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal <= 17.0 - Authenticated (Subscriber+) Arbitrary File Deletion

The Malcure Malware Scanner — 1 Toolset for WordPress Malware Removal plugin for WordPress is vulnerable to Arbitrary File Deletion due to a missing capability check on the wpmrdeletefile function in all versions up to, and including, 17.0. This makes it possible for authenticated attackers, with...

CVE-2025-5845

The CVE-2025-5845 entry concerns the WordPress Affiliate Reviews plugin. A stored cross-site scripting (XSS) flaw exists in the numColumns parameter for all versions up to 1.0.6 due to insufficient input sanitization and output escaping. Exploitation requires authenticated access at Contributor l...