PT-2025-18754 · WordPress · Wordpress

Name of the Vulnerable Software and Affected Versions: WordPress plugins and themes affected versions not specified Description: The issue concerns multiple plugins and/or themes for WordPress that are vulnerable to unauthorized access due to a missing capability check on several AJAX actions, su...

PT-2025-18758 · WordPress · Taxonomy Chain Menu

Name of the Vulnerable Software and Affected Versions: Taxonomy Chain Menu plugin for WordPress versions up to, and including, 1.0.8 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on user-supplied attributes in the pn...

PT-2025-18765 · WordPress · Buddyboss Platform

Name of the Vulnerable Software and Affected Versions: Buddyboss Platform plugin for WordPress versions up to and including 2.8.50 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, allowing authenticated attackers with...

PT-2025-18759 · WordPress · Formality

Name of the Vulnerable Software and Affected Versions: Formality plugin for WordPress versions up to, and including, 1.5.8 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated attackers with...

PT-2025-18740 · WordPress · Yame | Link In Bio

Name of the Vulnerable Software and Affected Versions: The Yame | Link In Bio plugin for WordPress versions 0.9.0 and earlier Description: The issue allows unauthenticated attackers to view potentially sensitive information contained in an exposed file through the publicly accessible phpinfo.php...

PT-2025-18745 · WordPress · Flynax Bridge

Name of the Vulnerable Software and Affected Versions: Flynax Bridge plugin for WordPress versions up to, and including, 2.2.0 Description: The issue is related to limited Privilege Escalation due to a missing capability check on the registerUser function. This allows unauthenticated attackers to...

PT-2025-18757 · WordPress · Tagdiv Composer

Name of the Vulnerable Software and Affected Versions: tagDiv Composer plugin for WordPress versions up to, and including, 5.4 Description: The issue is related to Stored Cross-Site Scripting via multiple shortcodes due to insufficient input sanitization and output escaping on user-supplied...

PT-2025-18743 · WordPress · Gmapsmania

Name of the Vulnerable Software and Affected Versions: GmapsMania plugin for WordPress versions up to, and including, 1.1 Description: The issue is related to Stored Cross-Site Scripting via the plugin's gmap shortcode due to insufficient input sanitization and output escaping on user-supplied...

PT-2025-18752 · WordPress · Wordpress

Name of the Vulnerable Software and Affected Versions: WordPress affected versions not specified Description: The issue is related to a missing capability check on the ajaxUploadFonts function in various WordPress plugins and themes, allowing authenticated attackers with Subscriber-level access a...

VulnCheck KEV: CVE-2025-4131

The GmapsMania plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's gmap shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...

PT-2025-18762 · WordPress · Wpml

Name of the Vulnerable Software and Affected Versions: WPML plugin for WordPress versions 3.6.0 through 4.7.3 Description: The issue is related to Stored Cross-Site Scripting via the plugin's wpml language switcher shortcode due to insufficient input sanitization and output escaping on...

PT-2025-18767 · WordPress · Buddyboss Platform

Name of the Vulnerable Software and Affected Versions: Buddyboss Platform plugin for WordPress versions up to and including 2.8.50 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, specifically via the bbp topic title...

Exploit for SQL Injection in Valvepress Automatic

WP Automatic Plugin SQL Injection Exploit CVE-2024-27956 !...

CVE-2025-3890

The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpcartbutton' shortcode in all versions up to, and including, 5.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

CVE-2025-1529

The AM LottiePlayer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via uploaded lottie files in all versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and...

CVE-2025-1529

CVE-2025-1529 : AM LottiePlayer for WordPress is vulnerable to stored XSS via uploaded Lottie files in all versions up to and including 3.5.3. Exploitation requires authenticated access at Author level or higher. Root cause: insufficient input sanitization and output escaping. Affected software: ...

CVE-2025-4100

The Nautic Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'npmarinetrafficmap' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-4100

CVE-2025-4100 affects Nautic Pages for WordPress. It is a Stored Cross-Site Scripting vulnerability in the np_marinetraffic_map shortcode, exploitable by authenticated users with contributor-level access and above, due to insufficient input sanitization and output escaping in versions up to 2.0. ...

CVE-2025-3503

CVE-2025-3503 affects the WP Maps WordPress plugin prior to version 4.7.2. The vulnerability arises because some Map settings are not properly sanitized/escaped, enabling Stored XSS by high-privilege users (e.g., admins), even when unfiltered_html is disallowed (such as in multisite). Public expl...

CVE-2025-3952

The Projectopia – WordPress Project Management plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'ptoremovelogo' function in all versions up to, and including, 5.1.16. This makes it possible for...