CVE-2025-5678

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘redirectURL’ parameter in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-34084

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it is a duplicate of CVE-2020-36848...

CVE-2025-34083

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it is a duplicate of CVE-2020-36849...

CVE-2025-34083

CVE-2025-34083 is rejected/not used; it is a duplicate of CVE-2020-36849.

WordPress plugin Gutenberg Blocks with AI by Kadence WP 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-28839 · WordPress · Simple Featured Image

Name of the Vulnerable Software and Affected Versions: Simple Featured Image plugin for WordPress versions up to, and including, 1.3.1 Description: The issue is related to Stored Cross-Site Scripting via the slideshow parameter due to insufficient input sanitization and output escaping. This allo...

PT-2025-28966 · WordPress · Events Manager

Name of the Vulnerable Software and Affected Versions: Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress versions prior to 7.0.4 Description: The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is susceptible to Reflected Cross-Site Scriptin...

Litho < 3.1 - Unauthenticated Arbitrary File Deletion

Description The Litho theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in all versions up to, and including, 3.0. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code...

CVE-2025-4855 Support Board <= 3.8.0 - Unauthenticated Authorization Bypass due to Use of Default Secret Key

The Support Board plugin for WordPress is vulnerable to unauthorized access/modification/deletion of data due to use of hardcoded default secrets in the sbencryption function in all versions up to, and including, 3.8.0. This makes it possible for unauthenticated attackers to bypass authorization...

CVE-2025-6744 Woodmart <= 8.2.3 - Unauthenticated Arbitrary Shortcode Execution

The The Woodmart theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.2.3. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode through the...

CVE-2025-6744

WoodMart for WordPress (Theme)

CVE-2025-6746

The WoodMart plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 8.2.3 via the 'layout' attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary .php files on the server,...

CVE-2025-6743 WoodMart <= 8.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Woodmart theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'multiplemarkers' attribute in all versions up to, and including, 8.2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-6743 WoodMart <= 8.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Woodmart theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'multiplemarkers' attribute in all versions up to, and including, 8.2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-6746 WoodMart <= 8.2.3 - Authenticated (Contributor+) Local File Inclusion

The WoodMart plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 8.2.3 via the 'layout' attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary .php files on the server,...

CVE-2025-6746

CVE-2025-6746 affects the WoodMart WordPress plugin (versions up to and including 8.2.3). It enables Local File Inclusion via the layout attribute, allowing authenticated attackers with Contributor+ privileges to include and execute arbitrary PHP files on the server, potentially bypassing access ...

CVE-2025-6743

CVE-2025-6743 : WoodMart WordPress theme (vulnerable up to 8.2.3) suffers Stored Cross-Site Scripting via the plugin’s multiple_markers attribute due to insufficient input sanitization and output escaping. Exploitation requires contributor-level authentication or higher and can cause arbitrary sc...

CVE-2025-7327 Widget for Google Reviews <= 1.0.15 - Authenticated (Subscriber+) Directory Traversal to Local File Inclusion

The Widget for Google Reviews plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.0.15 via the layout parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary files on the...

CVE-2025-5537

The FooBox Lightbox & Modal Popup WordPress plugin (versions up to 2.7.34) is affected by a Stored Cross-Site Scripting vulnerability via image alt texts due to insufficient input sanitization and output escaping. Exploitation requires authenticated access at Author level or higher, enabling an a...

CVE-2025-5570

The AI Engine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the mwaichatbot shortcode 'id' parameter in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...