CVE-2025-1778

CVE-2025-1778 affects Art Theme (WordPress Theme). Root cause: missing capability check on the AJAX function arttheme_theme_option_restore, allowing authenticated attackers with subscriber-level access and above to delete the theme option. Affected versions: all up to and including 3.12.2.3. Reme...

CVE-2025-5531

The Employee Directory – Staff Listing & Team Directory Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emdmbmeta' shortcode in all versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping on user...

PT-2025-24017 · WordPress · Short Url Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Short URL WordPress plugin versions 1.6.8 and earlier Description: The issue is related to a SQL injection problem. The Short URL WordPress plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading t...

PT-2025-24014 · WordPress · The Art Theme

Name of the Vulnerable Software and Affected Versions: The Art Theme for WordPress versions up to, and including, 3.12.2.3 Description: The issue is related to unauthorized access due to a missing capability check on the 'arttheme theme option restore' AJAX function. This allows authenticated...

WordPress plugin PDF for WPForms 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A security...

PT-2025-24013 · WordPress · Bm Content Builder

Name of the Vulnerable Software and Affected Versions: BM Content Builder plugin for WordPress versions up to, and including, 3.16.2.1 Description: The issue is related to a missing capability check on the ux cb page options save function, allowing authenticated attackers with subscriber-level...

PT-2025-24164 · WordPress · Wordpress

Name of the Vulnerable Software and Affected Versions: Broadly for WordPress versions 3.0.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This enables potential attackers to...

PT-2025-24257 · WordPress · Wp Text Expander

Name of the Vulnerable Software and Affected Versions: WP Text Expander versions 1.0.1 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations:...

WordPress plugin FraudLabs Pro for WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

WordPress plugin Hive Support 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2025-24172 · WordPress · Wp Wham All Currencies For Woocommerce

Name of the Vulnerable Software and Affected Versions: WP Wham All Currencies for WooCommerce versions n/a through 2.4.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that a...

Exploit for CVE-2025-5701

CVE-2025-5701 - Unauthenticated Privilege Escalation Exploit...

CVE-2025-4205

The Popup Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘popupID' parameter in all versions up to, and including, 1.20.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

CVE-2025-5701

The HyperComments plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the hcrequesthandler function in all versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to...

CVE-2025-5341 Forminator <= 1.44.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via id and data-size Parameters

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id' and 'data-size’ parameters in all versions up to, and including, 1.44.1 due to insufficient input sanitization and output escaping. This makes it...

CVE-2025-2939

The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.0.18 via deserialization of untrusted input from the argscallback parameter . This makes it possible for unauthenticated attackers to inject a PHP Object...

CVE-2025-4047

The Broken Link Checker plugin for WordPress is vulnerable to unauthorized data access due to a missing capability check on the ajaxfullstatus and ajaxdashboardstatus functions in all versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with Subscriber-level...

PT-2025-23917 · WordPress · Hypercomments

Name of the Vulnerable Software and Affected Versions: HyperComments plugin for WordPress versions up to, and including, 1.2.2 Description: The HyperComments plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability...

PT-2025-23894 · WordPress · Wp User Frontend Pro

Name of the Vulnerable Software and Affected Versions: WP User Frontend Pro plugin for WordPress versions up to, and including, 4.1.3 Description: The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload files function...

CVE-2025-5482 Sunshine Photo Cart <= 3.4.11 - Authenticated (Subscriber+) Privilege Escalation

The Sunshine Photo Cart: Free Client Photo Galleries for Photographers plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.11. This is due to the plugin not properly validating a user-supplied key. This makes it possible for...