CVE-2025-48129 WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin <= 2.4.37 - Privilege Escalation Vulnerability

Incorrect Privilege Assignment vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light excel-like-price-change-for-woocommerce-and-wp-e-commerce-light allows Privilege Escalation.This issue affects Spreadsheet Price Changer for WooCommerce and WP...

CVE-2025-48130 WordPress Spice Blocks plugin <= 2.0.7.4 - Arbitrary File Download vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in spicethemes Spice Blocks spice-blocks allows Path Traversal.This issue affects Spice Blocks: from n/a through = 2.0.7.4...

CVE-2025-48139 WordPress StyleAI plugin <= 1.0.4 - Broken Access Control Vulnerability

Missing Authorization vulnerability in relentlo StyleAI relentlosoftware allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects StyleAI: from n/a through = 1.0.4...

CVE-2025-48261 WordPress MultiVendorX plugin <= 4.2.22 - Sensitive Data Exposure Vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Retrieve Embedded Sensitive Data.This issue affects MultiVendorX: from n/a through = 4.2.22...

CVE-2025-48261

CVE-2025-48261 is an information exposure issue in MultiVendorX (WordPress plugin) described as an insertion of sensitive information into sent data, allowing retrieval of embedded sensitive data. Affected releases range up to 4.2.22; multiple sources label the CVE with a CVSS v3.1 base score of ...

CVE-2025-49275

Summary: CVE-2025-49275 affects the Blogbyte WordPress theme (versions &lt;= 1.1.1). The root cause is improper filename control in PHP, enabling Local File Inclusion (LFI) via an include/require statement. The vulnerability is unauthenticated and can be triggered by an attacker to read or includ...

CVE-2025-49278 WordPress Blogty theme <= 1.0.11 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in unfoldwp Blogty blogty allows PHP Local File Inclusion.This issue affects Blogty: from n/a through = 1.0.11...

CVE-2025-49279

CVE-2025-49279 is a Local File Inclusion vulnerability in the WordPress Blogvy theme/plugin. The issue arises from improper filename handling in PHP include/require, enabling local file inclusion. Affected versions are Blogvy up to 1.0.7; a fix was released in 1.0.8. CVSSv3.1 base score is 8.1 (H...

CVE-2025-49280 WordPress Magty theme <= 1.0.6 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in unfoldwp Magty magty allows PHP Local File Inclusion.This issue affects Magty: from n/a through = 1.0.6...

CVE-2025-49281 WordPress Magways <= 1.2.1 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Unfoldwp Magways allows PHP Local File Inclusion. This issue affects Magways: from n/a through 1.2.1...

CVE-2025-49295

CVE-2025-49295 describes a path traversal vulnerability in Mikado-Themes MediClinic WordPress theme (affected: MediClinic

CVE-2025-49296 WordPress GrandPrix <= 1.6 - Local File Inclusion Vulnerability

Path Traversal vulnerability in Mikado-Themes GrandPrix allows PHP Local File Inclusion. This issue affects GrandPrix: from n/a through 1.6...

CVE-2025-49297 WordPress Grill and Chow theme <= 1.6 - Local File Inclusion Vulnerability

Path Traversal: '.../...//' vulnerability in Mikado-Themes Grill and Chow grillandchow allows PHP Local File Inclusion.This issue affects Grill and Chow: from n/a through = 1.6...

CVE-2025-49297 WordPress Grill and Chow theme <= 1.6 - Local File Inclusion Vulnerability

Path Traversal: '.../...//' vulnerability in Mikado-Themes Grill and Chow grillandchow allows PHP Local File Inclusion.This issue affects Grill and Chow: from n/a through = 1.6...

CVE-2025-5528

The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the heateormastodonshare parameter in all versions up to, and including, 3.3.75 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-9994

The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the eaelpricingitemtooltipcontent parameter of the Pricing Table Widget in all versions up to, and including, 6.1.12 due...

CVE-2025-4652

CVE-2025-4652 concerns the Broadstreet WordPress plugin (prior to 1.51.8). The issue is a reflected XSS caused by not sanitising/escaping a parameter before outputting it on the page, which could be exploited against high privilege users (e.g., admins). The evidence consistently notes the vulnera...

CVE-2025-5814

The Profiler – What Slowing Down Your WP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpsdplugincontrol function in all versions up to, and including, 1.0.0. This makes it possible for unauthenticated attackers to reactivate...

WordPress plugin Fitrush 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2025-24514 · WordPress · Wp Event Manager

Name of the Vulnerable Software and Affected Versions: WP Event Manager versions 3.1.49 and earlier Description: The issue affects WP Event Manager, allowing PHP Local File Inclusion due to improper control of filename for include/require statement in PHP program, also known as 'PHP Remote File...