CVE-2025-4973 Workreap <= 3.3.1 - Authentication Bypass via 'workreap_verify_user_account'

The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to authentication bypass in all versions up to, and including, 3.3.1. This is due to the plugin not properly verifying a user's identity prior to logging them in when verifying an accoun...

CVE-2025-5925

The Bunny’s Print CSS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.95. This is due to missing or incorrect nonce validation on the pcssoptionssubpanel function. This makes it possible for unauthenticated attackers to update settings via ...

CVE-2025-5144

CVE-2025-5144 affects The Events Calendar plugin for WordPress. The issue is a DOM-based Stored Cross-Site Scripting vulnerability via the data-date-* parameters in all versions up to 6.13.2, caused by insufficient input sanitization and output escaping. Exploitation requires authentication at Co...

CVE-2025-5144 The Events Calendar <= 6.13.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-date-’ parameters in all versions up to, and including, 6.13.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-3302 Xagio SEO <= 7.1.0.16 - Unauthenticated Stored Cross-Site Scripting via 'HTTP_REFERER'

The Xagio SEO – AI Powered SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘HTTPREFERER’ parameter in all versions up to, and including, 7.1.0.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

CVE-2025-3302 Xagio SEO <= 7.1.0.16 - Unauthenticated Stored Cross-Site Scripting via 'HTTP_REFERER'

The Xagio SEO – AI Powered SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘HTTPREFERER’ parameter in all versions up to, and including, 7.1.0.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

CVE-2025-4315 CubeWP – All-in-One Dynamic Content Framework <= 1.1.23 - Authenticated (Subscriber+) Privilege Escalation

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.23. This is due to the plugin allowing a user to update arbitrary user meta through the updateusermeta function. This makes it possible for...

CVE-2025-4315

Summary: CVE-2025-4315 affects the CubeWP – All-in-One Dynamic Content Framework plugin for WordPress. The vulnerability is an authenticated privilege-escalation flaw exploitable by users with Subscriber+ privileges to elevate to Administrator via improper handling of update_user_meta(), affectin...

CVE-2025-4799 WP-DownloadManager <= 1.68.10 - Authenticated (Administrator+) Arbitrary File Deletion

The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file deletion due to lack of restriction on the directory a file can be deleted from in all versions up to, and including, 1.68.10. This makes it possible for authenticated attackers, with Administrator-level access and above,...

WordPress plugin CubeWP 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2025-25204 · WordPress · Xagio Seo

Name of the Vulnerable Software and Affected Versions: Xagio SEO – AI Powered SEO plugin for WordPress versions up to, and including, 7.1.0.16 Description: The Xagio SEO – AI Powered SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTTP REFERER parameter due to...

CVE-2025-49455 WordPress TinySalt < 3.10.0 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in LoftOcean TinySalt allows Object Injection.This issue affects TinySalt: from n/a before 3.10.0...

CVE-2025-5925 Bunny’s Print CSS <= 0.95 - Cross-Site Request Forgery to Settings Update

The Bunny’s Print CSS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.95. This is due to missing or incorrect nonce validation on the pcssoptionssubpanel function. This makes it possible for unauthenticated attackers to update settings via ...

CVE-2025-5925

CVE-2025-5925 – Bunny’s Print CSS (WordPress) : Wordfence and related sources confirm a Cross-Site Request Forgery vulnerability in Bunny’s Print CSS plugin for WordPress versions up to 0.95. The root cause is missing or incorrect nonce validation in the pcss_options_subpanel() function, enabling...

PT-2025-24607 · WordPress · Rh - Real Estate Wordpress Theme

Name of the Vulnerable Software and Affected Versions: RH - Real Estate WordPress Theme versions prior to 4.4.1 Description: The issue is related to privilege escalation due to the theme not properly restricting user roles that can be updated as part of the inspiry update profile function. This...

PT-2025-24612 · WordPress · Elementor Website Builder

Name of the Vulnerable Software and Affected Versions: Elementor Website Builder Pro plugin for WordPress versions up to, and including, 3.29.0 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated...

Exploit for CVE-2025-26892

CVE-2025-26892 – WordPress Celestial Aura Theme = 2.2 Arbitra...

CVE-2023-26005

The CVE-2023-26005 entry covers BZOTheme Fitrush (WordPress theme) with an Improper Control of Filename for Include/Require Statement (PHP Remote File Inclusion) that leads to local file inclusion. Affected versions are Fitrush up to 1.3.4. The root cause, as stated, is improper filename handling...

CVE-2025-28888 WordPress GiftXtore theme < 1.7.7 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in BZOTheme GiftXtore bw-giftxtore allows PHP Local File Inclusion.This issue affects GiftXtore: from n/a through 1.7.7...

CVE-2025-28944

CVE-2025-28944 affects Avaz WordPress theme (versions n/a through 2.8). It is an Unauthenticated Local File Inclusion due to improper control of filenames for PHP Include/Require, enabling PHP LFI. CVSS v3.1 base score 8.1 (HIGH) with network attack vector, high impact on confidentiality, integri...