WordPress plugin Networker 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2025-27160 · WordPress · Wp Edit

Name of the Vulnerable Software and Affected Versions: WP Edit versions 4.0.4 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject malicious...

WordPress plugin ONet Regenerate Thumbnails 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

WordPress plugin Amely SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection...

PT-2025-27212 · WordPress · Sh1Zen Wp Optimizer

Name of the Vulnerable Software and Affected Versions: sh1zen WP Optimizer versions 2.3.6 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows SQL Injection. Recommendations: For sh1zen WP Optimizer versions 2.3.6 and earlier, update to a version later...

WordPress plugin Virusdie 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

CVE-2025-6212

The CVE-2025-6212 entry details a stored XSS in the Ultra Addons for Contact Form 7 WordPress plugin (versions 3.5.11–3.5.19). Root cause: insufficient input sanitization and output escaping in the Database module, with unfiltered field names stored alongside sanitized values. The admin AJAX endp...

CVE-2025-5338

CVE-2025-5338 : Royal Elementor Addons for WordPress (affected: all versions up to 1.7.1024) is vulnerable to stored DOM-based cross-site scripting via multiple widgets. Exploitation requires authenticated access at contributor level or above, enabling injection of scripts that execute when users...

CVE-2025-5338 Royal Elementor Addons <= 1.7.1028 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Multiple Widgets

The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.7.1028 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-5338 Royal Elementor Addons <= 1.7.1028 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Multiple Widgets

The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.7.1028 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-6546

The Drive Folder Embedder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tablecssclass’ parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-5813

The Amazon Products to WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wcta2wgetamazonproductcallback function in all versions up to, and including, 1.2.7. This makes it possible for unauthenticated attackers to create n...

CVE-2025-5813

The Amazon Products to WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wcta2wgetamazonproductcallback function in all versions up to, and including, 1.2.7. This makes it possible for unauthenticated attackers to create n...

CVE-2025-5929

The The Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘clientId’ parameter in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level acces...

CVE-2025-6540

CVE-2025-6540 relates to the WordPress plugin “web-cam” (versions up to 1.0). It is a Stored Cross-Site Scripting (Stored XSS) vulnerability via the slug parameter caused by insufficient input sanitization and output escaping. Exploitation requires at least Contributor-level authentication, and t...

CVE-2025-6540 web-cam <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via slug Parameter

The web-cam plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slug’ parameter in all versions up to, and including, 3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above,...

CVE-2025-6546 Drive Folder Embedder <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via tablecssclass Parameter

The Drive Folder Embedder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tablecssclass’ parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-6546

CVE-2025-6546 (Drive Folder Embedder, WordPress) The WordPress plugin Drive Folder Embedder (

CVE-2025-5275

CVE-2025-5275 covers a Stored XSS in the WordPress plugin Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More (versions up to 1.8.6.1). Root cause: insufficient input sanitization and output escaping in privacy settings. Exploitation requires authenticated adm...

CVE-2025-5932

CVE-2025-5932 (Homerunner WordPress plugin) affects Homerunner (WordPress) up to version 1.0.29. Root cause: missing or incorrect nonce validation on main_settings(), enabling unauthenticated CSRF to update plugin settings via forged requests. Impact: can alter settings if an admin clicks a link....