CVE-2025-46262

CVE-2025-46262 refers to a Cross-Site Scripting (Stored XSS) vulnerability in the WordPress plugin Mad Mimi for WordPress (versions up to 1.5.1). The issue is caused by improper neutralization of input during web page generation. Affected product: Mad Mimi for WordPress, plugin versions

CVE-2025-26867 WordPress Bulk theme <= 1.0.11 - Broken Access Control vulnerability

Missing Authorization vulnerability in Themes4WP Bulk allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Bulk: from n/a through 1.0.11...

CVE-2025-39376

CVE-2025-39376 is a Missing Authorization / Broken Access Control vulnerability in the WordPress plugin Car Park Booking System for WordPress , affecting versions up to 2.6. The root cause is missing authorization checks, potentially allowing unauthorized access to restricted functionality. The C...

CVE-2025-39369 WordPress Posts for Page plugin <= 2.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in sihibbs Posts for Page allows DOM-Based XSS.This issue affects Posts for Page: from n/a through 2.1...

CVE-2025-39369 WordPress Posts for Page plugin <= 2.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in sihibbs Posts for Page posts-for-page allows DOM-Based XSS.This issue affects Posts for Page: from n/a through = 2.1...

CVE-2025-39369

CVE-2025-39369 affects WordPress Posts for Page plugin (≤ 2.1). Root cause: improper neutralization of input during web page generation, enabling DOM-based XSS. Impact per sources: cross-site scripting with low privileges and user interaction required; affected versions are n/a through 2.1. Publi...

CVE-2025-39353 WordPress Grand Restaurant WordPress theme <= 7.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in ThemeGoods Grand Restaurant WordPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Grand Restaurant WordPress: from n/a through 7.0...

CVE-2025-23988 WordPress ghostwriter theme <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Bruno Cavalcante ghostwriter ghostwriter allows Reflected XSS.This issue affects ghostwriter: from n/a through = 1.4...

CVE-2025-22792 WordPress Js O3 Lite theme <= 1.5.8.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in jinwen Js O3 Lite allows Reflected XSS.This issue affects Js O3 Lite: from n/a through 1.5.8.2...

CVE-2025-22791 WordPress offset writing theme <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in twh offset writing allows Reflected XSS.This issue affects offset writing: from n/a through 1.2...

CVE-2025-22791 WordPress offset writing theme <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in twh offset writing allows Reflected XSS.This issue affects offset writing: from n/a through 1.2...

CVE-2025-48284

In CVE-2025-48284, the WordPress plugin Japanized For WooCommerce (

CVE-2025-48282

CVE-2025-48282 affects WordPress plugin Majestic Support (versions up to and including 1.1.0). The flaw is a Missing Authorization vulnerability caused by incorrectly configured access control levels, enabling bypass of protections without authentication. CVSS 3.1 base score 5.3 (Network, Low att...

CVE-2025-48272 WordPress WP Job Portal plugin <= 2.3.2 - Insecure Direct Object References (IDOR) Vulnerability

Missing Authorization vulnerability in wpjobportal WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through = 2.3.2...

CVE-2025-48270

CVE-2025-48270 targets the WordPress SKT Blocks plugin with a DOM‑based XSS caused by improper input neutralization during web page generation. Affected software is SKT Blocks versions n/a through 2.2. Multiple connected sources confirm the vulnerability class and vendor/product, including CVE re...

CVE-2025-48269 WordPress WPAdverts plugin <= 2.2.3 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Greg Winiarski WPAdverts wpadverts allows DOM-Based XSS.This issue affects WPAdverts: from n/a through = 2.2.3...

CVE-2025-48265 WordPress Year Make Model Search for WooCommerce plugin <= 1.0.11 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability

Cross-Site Request Forgery CSRF vulnerability in Pektsekye Year Make Model Search for WooCommerce ymm-search allows Cross Site Request Forgery.This issue affects Year Make Model Search for WooCommerce: from n/a through = 1.0.11...

CVE-2025-48262 WordPress Url Rewrite Analyzer plugin <= 1.3.3 - Broken Access Control Vulnerability

Missing Authorization vulnerability in M.Code Url Rewrite Analyzer url-rewrite-analyzer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Url Rewrite Analyzer: from n/a through = 1.3.3...

CVE-2025-48260 WordPress GDPR CCPA Compliance Support plugin <= 2.7.3 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Ninja Team GDPR CCPA Compliance Support ninja-gdpr-compliance allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GDPR CCPA Compliance Support: from n/a through = 2.7.3...

CVE-2025-48259

CVE-2025-48259 describes a Cross-Site Request Forgery (CSRF) in the WordPress plugin WP Mapa Politico España . Affected: WordPress sites running this plugin up to version 3.8.0 . The vulnerability allows CSRF to change settings, with the CVE notes and PatchStack entry confirming a CSRF-to-Setting...