CVE-2025-30933 WordPress LogisticsHub theme <= 1.1.6 - Arbitrary File Upload Vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in LiquidThemes LogisticsHub logistics-hub allows Upload a Web Shell to a Web Server.This issue affects LogisticsHub: from n/a through = 1.1.6...

CVE-2025-47479 WordPress WP Compress plugin <= 6.30.30 - Broken Authentication Vulnerability

Weak Authentication vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Authentication Abuse.This issue affects WP Compress: from n/a through = 6.30.30...

CVE-2025-47627 WordPress PrivateContent - Mail Actions plugin <= 2.3.2 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in LCweb PrivateContent - Mail Actions allows PHP Local File Inclusion. This issue affects PrivateContent - Mail Actions: from n/a through 2.3.2...

CVE-2025-47634 WordPress WC Pickup Store plugin <= 1.8.9 - Settings Change Vulnerability

Missing Authorization vulnerability in Keylor Mendoza WC Pickup Store wc-pickup-store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WC Pickup Store: from n/a through = 1.8.9...

CVE-2025-47634

CVE-2025-47634 refers to a Missing Authorization vulnerability in the WordPress WC Pickup Store plugin, affecting versions up to 1.8.9. The issue arises from insufficient access-control checks, enabling exploitation of incorrectly configured authorization levels. Public sources in connected docum...

CVE-2025-49274

CVE-2025-49274 concerns the WordPress Neom Blog theme (awplife Neom Blog), with a Reflected XSS vulnerability due to improper input neutralization during web page generation. Affected versions are 0.0.0 through 0.0.9. Multiple external sources (e.g., CNVD, NVD, Red Hat, CVE List, PatchStack, PT-S...

CVE-2025-49303 WordPress Frontend Admin by DynamiApps plugin <= 3.28.7 - Arbitrary File Download Vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element allows Path Traversal.This issue affects Frontend Admin by DynamiApps: from n/a through = 3.28.7...

CVE-2025-49866

CVE-2025-49866 describes a Reflected XSS in the WordPress plugin Beautiful Cookie Consent Banner up to version 4.6.1. Root cause: improper neutralization of input during web page generation. Affected software: Beautiful Cookie Consent Banner (WordPress plugin). Impact: potential for attacker-cont...

CVE-2025-49870 WordPress Paid Member Subscriptions plugin <= 2.15.1 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows SQL Injection.This issue affects Paid Member Subscriptions: from n/a through = 2.15.1...

CVE-2025-50039 WordPress VG WORT METIS plugin <= 2.0.1 - Broken Access Control Vulnerability

Missing Authorization vulnerability in vgwort VG WORT METIS vgw-metis allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VG WORT METIS: from n/a through = 2.0.1...

CVE-2025-52798

CVE-2025-52798 is a Reflected XSS in the WordPress JobSearch plugin. The issue arises from improper input neutralization during web page generation, enabling an attacker to inject scripts via the JobSearch UI. Affected software: WordPress JobSearch (plugin) versions up to 2.9.0. CVSS v3.1 base sc...

CVE-2025-52796 WordPress WP-Recall <= 16.26.14 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in tggfref WP-Recall allows Reflected XSS. This issue affects WP-Recall: from n/a through 16.26.14...

CVE-2025-52805 WordPress Leyka plugin <= 3.32.1 - Local File Inclusion vulnerability

Path Traversal: '.../...//' vulnerability in VaultDweller Leyka leyka allows PHP Local File Inclusion.This issue affects Leyka: from n/a through = 3.32.1...

CVE-2025-52828 WordPress Red Art theme <= 3.8 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in designthemes Red Art redart allows Object Injection.This issue affects Red Art: from n/a through = 3.8...

CVE-2025-52828

CVE-2025-52828 describes a Deserialization of Untrusted Data vulnerability in the WordPress theme designthemes Red Art, enabling PHP Object Injection. Affected: Red Art versions up to 3.7 (and potentially &lt;=3.8 per Patchstack reference). Root cause: deserializing untrusted data within the them...

CVE-2025-52828 WordPress Red Art theme <= 3.8 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in designthemes Red Art redart allows Object Injection.This issue affects Red Art: from n/a through = 3.8...

CVE-2025-52830 WordPress bSecure – Your Universal Checkout plugin <= 1.7.9 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in bSecure – Your Universal Checkout bSecure – Your Universal Checkout bsecure allows Blind SQL Injection.This issue affects bSecure – Your Universal Checkout: from n/a through = 1.7.9...

CVE-2025-52832 WordPress NGG Smart Image Search plugin <= 3.4.1 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in wpo-HR NGG Smart Image Search ngg-smart-image-search allows SQL Injection.This issue affects NGG Smart Image Search: from n/a through = 3.4.1...

CVE-2025-4414 WordPress CMSMasters Content Composer < 2.5.7 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in cmsmasters CMSMasters Content Composer allows PHP Local File Inclusion. This issue affects CMSMasters Content Composer: from n/a through n/a...

CVE-2025-49414 WordPress FW Gallery plugin <= 8.0.0 - Arbitrary File Upload Vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Fastw3b LLC FW Gallery fw-gallery allows Using Malicious Files.This issue affects FW Gallery: from n/a through = 8.0.0...