CVE-2025-6838 Broken Link Notifier <= 1.3.0 - Authenticated (Contributor+) CSV Injection

The Broken Link Notifier plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.3.0 via broken links that are later exported. This makes it possible for authenticated attackers, with Contributor-level access and above, to embed untrusted input into exported CS...

CVE-2025-6851 Broken Link Notifier <= 1.3.0 - Unauthenticated Server-Side Request Forgery

The Broken Link Notifier plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.0 via the ajaxblinks function which ultimately calls the checkurlstatuscode function. This makes it possible for unauthenticated attackers to make web requests to...

CVE-2025-6851

The CVE-2025-6851 entry concerns the WordPress Broken Link Notifier plugin. Affected are versions up to and including 1.3.0, where the ajax_blinks() path ultimately calls check_url_status_code(), allowing unauthenticated SSRF from the web application to reach arbitrary external or internal locati...

CVE-2025-6851 Broken Link Notifier <= 1.3.0 - Unauthenticated Server-Side Request Forgery

The Broken Link Notifier plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.0 via the ajaxblinks function which ultimately calls the checkurlstatuscode function. This makes it possible for unauthenticated attackers to make web requests to...

CVE-2025-6745

The WoodMart plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 8.2.5 via the woodmartgetpostsbyquery function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from...

CVE-2025-6068

The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-caption-title & data-caption-description HTML attributes in all versions up to, and including, 2.4.31 due to insufficient input...

CVE-2025-6068

Summary (CVE-2025-6068) The FooGallery plugin for WordPress (versions up to and including 2.4.31) is affected by a stored DOM-based cross-site scripting vulnerability. The issue arises from insufficient input sanitization and output escaping in the data-caption-title and data-caption-description ...

CVE-2025-6745

CVE-2025-6745 concerns the WoodMart WordPress plugin (versions ≤ 8.2.5). The issue is information exposure through woodmart_get_posts_by_query(), caused by insufficient restrictions on which posts can be included, allowing unauthenticated attackers to access data from password‑protected, private,...

CVE-2025-6716

The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'upload1title' parameter in all versions up to, and including, 26.0.8...

CVE-2025-5392 GB Forms DB <= 1.0.2 - Unauthenticated Remote Code Execution

The GB Forms DB plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0.2 via the gbfdbtalktofront function. This is due to the function accepting user input and then passing that through calluserfunc. This makes it possible for unauthenticated...

CVE-2025-5392

GB Forms DB plugin for WordPress ≤ 1.0.2 is vulnerable to unauthenticated remote code execution via gbfdb_talk_to_front() which passes user input to call_user_func, enabling attackers to execute code, inject backdoors, or create admin accounts. This is a critical flaw (CVSS v3.1: 9.8). Remediatio...

CVE-2025-5392 GB Forms DB <= 1.0.2 - Unauthenticated Remote Code Execution

The GB Forms DB plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0.2 via the gbfdbtalktofront function. This is due to the function accepting user input and then passing that through calluserfunc. This makes it possible for unauthenticated...

CVE-2025-6691

The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteentryfiles function in all versions up to, and including, 1.7.3. This makes it possible for unauthenticated attackers to...

CVE-2025-7401 Premium Age Verification / Restriction for WordPress <= 3.0.2 - Unauthenticated Arbitrary File Read and Write via remote_tunnel.php

The Premium Age Verification / Restriction for WordPress plugin for WordPress is vulnerable to arbitrary file read and write due to the existence of an insufficiently protected remote support functionality in remotetunnel.php in all versions up to, and including, 3.0.2. This makes it possible for...

CVE-2025-5678

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘redirectURL’ parameter in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-34083

An unrestricted file upload vulnerability exists in the WordPress AIT CSV Import/Export plugin ≤ 3.0.3. The plugin exposes an upload handler at upload-handler.php that allows arbitrary file upload via a multipart/form-data POST request. This endpoint does not enforce authentication or content-typ...

CVE-2025-3780

The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wcfmredirecttosetup function in all versions up to, and including, 6.7.16. This makes i...

PT-2025-29211 · WordPress · Gb Forms Db

Name of the Vulnerable Software and Affected Versions: GB Forms DB plugin for WordPress versions up to and including 1.0.2 Description: The GB Forms DB plugin for WordPress is susceptible to Remote Code Execution via the gbfdb talk to front function. The function accepts user input and passes it...

PT-2025-29199 · WordPress · Premium Age Verification / Restriction For Wordpress

Name of the Vulnerable Software and Affected Versions: Premium Age Verification / Restriction for WordPress plugin for WordPress versions up to and including 3.0.2 Description: The Premium Age Verification / Restriction for WordPress plugin is susceptible to arbitrary file read and write issues d...

WordPress Nokri Theme <= 1.6.3 is vulnerable to Privilege Escalation

Software Nokri Type Theme Vulnerable versions = 1.6.3 Fixed in 1.6.4 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2025-1313 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 8781d35f0a1e Credits Tonn Required...