CVE-2025-4479

CVE-2025-4479 corresponds to a stored XSS flaw in the ElementsKit Lite/ElementsKit Elementor Addons and Templates WordPress plugin (versions

CVE-2025-3774

The Wise Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the X-Forwarded-For header in all versions up to, and including, 3.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

PT-2025-26204 · WordPress · Download Manager

Name of the Vulnerable Software and Affected Versions: Download Manager plugin for WordPress versions up to, and including, 3.3.18 Description: The issue is related to Stored Cross-Site Scripting in the Download Manager plugin for WordPress. This is due to insufficient input sanitization and outp...

CVE-2025-6220

The CVE-2025-6220 entry concerns the Ultra Addons for Contact Form 7 WordPress plugin (versions

CVE-2025-6086 CSV Me <= 2.0 - Authenticated (Administrator+) Arbitrary File Upload

The CSV Me plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'csvmeoptionspage' function in all versions up to, and including, 2.0. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload...

CVE-2025-5237

CVE-2025-5237 (Target Video Easy Publish, WordPress) is a stored XSS vulnerability. The issue affects Target Video Easy Publish plugin versions up to 3.8.5, where the width parameter is not properly sanitized/escaped. An attacker with Contributor-level access or higher can inject scripts that exe...

CVE-2025-4413

The Pixabay Images plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the pixabayupload function in all versions up to, and including, 3.4. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary...

CVE-2025-4413

The CVE-2025-4413 entry refers to the Pixabay Images plugin for WordPress (versions &lt;= 3.4). The vulnerability is an arbitrary file upload due to missing file-type validation in the pixabay_upload function. authenticated attackers with Author-level access or higher could upload arbitrary files...

PT-2025-25768 · WordPress · Pixabay Images

Name of the Vulnerable Software and Affected Versions: Pixabay Images plugin for WordPress versions up to, and including, 3.4 Description: The Pixabay Images plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the pixabay upload function. This makes...

PT-2025-25772 · WordPress · Tarteaucitron.Io

Name of the Vulnerable Software and Affected Versions: tarteaucitron.io WordPress plugin versions prior to 1.9.5 Description: The issue concerns the tarteaucitron.io WordPress plugin, which uses query parameters from YouTube oEmbed URLs without proper sanitization. This could allow users with the...

PT-2025-25858 · WordPress · Csv Me

Name of the Vulnerable Software and Affected Versions: CSV Me plugin for WordPress versions up to, and including, 2.0 Description: The issue is related to insufficient file type validation in the csv me options page function, allowing authenticated attackers with Administrator-level access and...

CVE-2025-49451 WordPress Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery plugin <= 1.0.13 - Directory Traversal Vulnerability

Path Traversal: '.../...//' vulnerability in yannisraft Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery aeroscroll-gallery allows Path Traversal.This issue affects Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery: from n/a through...

CVE-2025-24761 WordPress DSK theme < 2.4 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in snstheme DSK dsk allows PHP Local File Inclusion.This issue affects DSK: from n/a through 2.4...

CVE-2025-24773 WordPress WPCRM - CRM for Contact form CF7 & WooCommerce plugin <= 3.2.0 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in mojoomla WPCRM - CRM for Contact form CF7 & WooCommerce wpcrm allows SQL Injection.This issue affects WPCRM - CRM for Contact form CF7 & WooCommerce: from n/a through = 3.2.0...

CVE-2025-29002 WordPress Simen <= 4.6 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in snstheme Simen allows PHP Local File Inclusion. This issue affects Simen: from n/a through 4.6...

CVE-2025-39508 WordPress Nasa Core Plugin <= 6.4.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NasaTheme Nasa Core nasa-core allows Reflected XSS.This issue affects Nasa Core: from n/a through = 6.4.4...

CVE-2025-47452 WordPress WP VR <= 8.5.26 - Arbitrary File Upload Vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in RexTheme WP VR allows Upload a Web Shell to a Web Server. This issue affects WP VR: from n/a through 8.5.26...

CVE-2025-47452 WordPress WP VR plugin <= 8.5.26 - Arbitrary File Upload Vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in RexTheme WP VR wpvr allows Upload a Web Shell to a Web Server.This issue affects WP VR: from n/a through = 8.5.26...

CVE-2025-49254 WordPress Nika theme <= 1.2.8 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in thembay Nika nika allows PHP Local File Inclusion.This issue affects Nika: from n/a through = 1.2.8...

CVE-2025-49257 WordPress Zota theme <= 1.3.8 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in thembay Zota zota allows PHP Local File Inclusion.This issue affects Zota: from n/a through = 1.3.8...