CVE-2025-4219

The DPEPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dpe' shortcode in all versions up to, and including, 0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, wit...

CVE-2025-4219

CVE-2025-4219 affects the WordPress plugin DPEPress . The vulnerability is a Stored Cross-Site Scripting (Stored XSS) in the plugin’s dpe shortcode caused by insufficient input sanitization and output escaping on user-supplied attributes. It affects all versions up to and including 0.3. An attack...

CVE-2025-4221 Animated Buttons <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Animated Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'auto-downloader' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-3750

The CVE CVE-2025-3750 affects the WordPress plugin Network Posts Extended (versions up to and including 7.7.1). It describes a Stored Cross-Site Scripting (Stored XSS) via the post_height parameter caused by insufficient input sanitization and output escaping. Exploitation requires authentication...

CVE-2024-12561 Affiliate Sales in Google Analytics and other tools <= 2.0.0 - Open Redirect

The Affiliate Sales in Google Analytics and other tools plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 2.0.0. This is due to insufficient validation on the redirect url supplied via the 'afflink' parameter. This makes it possible for unauthenticated...

CVE-2025-4105 Splitit <= 4.2.8 - Missing Authorization to Multiple Administrative Actions

The Splitit plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on several functions in the 'splitIt-flexfields-payment-gateway.php' file in all versions up to, and including, 4.2.8. This makes it possible for authenticated attackers, with...

CVE-2025-4105 Splitit <= 4.2.8 - Missing Authorization to Multiple Administrative Actions

The Splitit plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on several functions in the 'splitIt-flexfields-payment-gateway.php' file in all versions up to, and including, 4.2.8. This makes it possible for authenticated attackers, with...

CVE-2025-4611

The CVE-2025-4611 entry concerns the WordPress plugin Slim SEO – Fast & Automated WordPress SEO Plugin. Affected component: the slim_seo_breadcrumbs shortcode in all versions up to and including 4.5.3. Root cause: insufficient input sanitization and output escaping on user-supplied attributes, en...

CVE-2025-4803

The CVE-2025-4803 entry concerns WordPress Glossary by WPPedia (

CVE-2025-3781

CVE-2025-3781: Raisely Donation Form plugin for WordPress (versions

CVE-2025-3781 Raisely Donation Form <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via raisely_donation_form Shortcode

The Raisely Donation Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's raiselydonationform shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-2561

The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2025-1626

The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its Countdown block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2025-4094 Digits < 8.4.6.1 - Auth Bypass via OTP Bruteforcing

The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for attackers to bruteforce them...

CVE-2025-2892

The All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post Meta Description and Canonical URL parameters in all versions up to, and including, 4.8.1.1 due to insufficient input sanitization and...

PT-2025-22335 · WordPress · Splitit

Name of the Vulnerable Software and Affected Versions: Splitit plugin for WordPress versions up to, and including, 4.2.8 Description: The issue allows authenticated attackers with Subscriber-level access and above to modify plugin settings due to missing capability checks on several functions in...

CVE-2025-4322

CVE-2025-4322 affects the Motors WordPress theme up to version 5.6.67, where a flawed password update flow allows unauthenticated attackers to change arbitrary user passwords (including administrators), enabling account takeover. Root cause: insufficient validation of requester identity before pr...

PT-2025-22122 · WordPress · Motors

Name of the Vulnerable Software and Affected Versions: Motors WordPress theme versions prior to 5.6.68 Description: The Motors theme for WordPress is vulnerable to privilege escalation via account takeover. This is due to the theme not properly validating a user's identity prior to updating their...

CVE-2025-39352

Missing Authorization vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Grand Restaurant: from n/a through = 7.0...

CVE-2025-32926

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in ThemeGoods Grand Restaurant WordPress allows Path Traversal.This issue affects Grand Restaurant WordPress: from n/a through 7.0...