CVE-2025-6717

CVE-2025-6717 affects the B1.lt for WooCommerce plugin (WordPress). The vulnerability is an authenticated SQL Injection via the id parameter in versions up to and including 2.2.56, caused by insufficient escaping of user input and lack of proper SQL query preparation. Exploitation requires Subscr...

CVE-2025-5767

CVE-2025-5767 : Crowdfunding for WooCommerce (WordPress) is affected by a stored XSS via the width parameter in versions up to 3.1.14. Exploitation requires authenticated access at Contributor level or higher, enabling an attacker to inject scripts that execute when a user visits the injected pag...

CVE-2025-6719 Terms descriptions <= 3.4.8 - Authenticated (Admin+) Stored Cross-Site Scripting

The Terms descriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2025-5767 Crowdfunding for WooCommerce <= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter

The Crowdfunding for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions up to, and including, 3.1.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-6726 Block Editor Gallery Slider <= 1.1.1 - Missing Authorization to Authenticated (Subscriber+) Limited Post Meta Update

The Block Editor Gallery Slider plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the classicgalleryslideroptions function in all versions up to, and including, 1.1.1. This makes it possible for authenticated attackers, with...

CVE-2025-6726 Block Editor Gallery Slider <= 1.1.1 - Missing Authorization to Authenticated (Subscriber+) Limited Post Meta Update

The Block Editor Gallery Slider plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the classicgalleryslideroptions function in all versions up to, and including, 1.1.1. This makes it possible for authenticated attackers, with...

CVE-2025-5754

CVE-2025-5754 affects the WordPress plugin Useful Tab Block – Responsive & AMP-Compatible . The vulnerability is a Stored Cross-Site Scripting (XSS) via the className parameter caused by insufficient input sanitization and output escaping. It requires authentication at Contributor level or higher...

CVE-2025-6813

The aapanel WP Toolkit plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization checks within the autologin function in versions 1.0 to 1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to bypass all role checks and gai...

CVE-2025-7648

The Ruven Themes: Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ruvenbutton' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-5816

The Plugin Pengiriman WooCommerce Kurir Reguler, Instan, Kargo – Biteship plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.2.0 via the getorderdetail due to missing validation on a user controlled key. This makes it possible for...

CVE-2025-6053

The Zuppler Online Ordering plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.0. This is due to missing or incorrect nonce validation on the 'zuppler-online-ordering-options' page. This makes it possible for unauthenticated attackers to...

CVE-2025-6781

The Copymatic – AI Content Writer & Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1. This is due to missing or incorrect nonce validation on the 'copymatic-menu' page. This makes it possible for unauthenticated attackers to upda...

CVE-2025-6781

CVE-2025-6781 affects the Copymatic – AI Content Writer & Generator WordPress plugin (versions ≤ 2.1). The issue is a Cross-Site Request Forgery on the copymatic-menu page, allowing unauthenticated attackers to update the copymatic_apikey option if a site administrator is tricked into performing ...

CVE-2025-6053 Zuppler Online Ordering <= 2.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Zuppler Online Ordering plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.0. This is due to missing or incorrect nonce validation on the 'zuppler-online-ordering-options' page. This makes it possible for unauthenticated attackers to...

CVE-2025-7431

The Knowledge Base plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin slug setting in all versions up to, and including, 2.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

PT-2025-30000 · WordPress · B1.Lt Plugin

Name of the Vulnerable Software and Affected Versions: B1.lt plugin for WordPress versions through 2.2.56 Description: The B1.lt plugin for WordPress is susceptible to SQL Injection via the id parameter. Insufficient escaping of user-supplied input and inadequate SQL query preparation allow...

PT-2025-30001 · WordPress · B1.Lt Plugin

Name of the Vulnerable Software and Affected Versions: B1.lt plugin for WordPress versions up to and including 2.2.56 Description: The B1.lt plugin for WordPress is susceptible to SQL Injection due to a missing capability check on the b1 run query API endpoint. This allows authenticated attackers...

PT-2025-31602

Name of the Vulnerable Software and Affected Versions BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript versions up to and including 2.2.42 Description The BerqWP plugin for WordPress is susceptible to arbitrary file uploads due to...

WordPress plugin Malcure Malware Scanner – #1 tool for removing WordPress malware. Security vulnerabilities.

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin Malcure...

WordPress GB Forms DB plugin code injection vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A code injection vulnerability exists in the WordPress GB Forms DB plugin that originates in the gbfdbtalktofront function that accepts user input and passes it through...