CVE-2025-3832

The FuseDesk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘successredirect’ parameter in all versions up to, and including, 6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level acces...

CVE-2025-3776

The Verification SMS with TargetSMS plugin for WordPress is vulnerable to limited Remote Code Execution in all versions up to, and including, 1.5 via the 'targetvrajaxhandler' function. This is due to a lack of validation on the type of function that can be called. This makes it possible for...

CVE-2025-3604

The Flynax Bridge plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.2.0. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for unauthenticated...

CVE-2025-3058

The Xelion Webchat plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the xwcsavesettings function in all versions up to, and including, 9.1.0. This makes it possible for authenticated attackers, with...

CVE-2025-3793

CVE-2025-3793 affects the Buddypress Force Password Change plugin for WordPress (versions up to 0.1). The vulnerability enables authenticated users (subscriber level or higher) to perform an account takeover by exploiting insufficient identity validation in the bp_force_password_ajax password-upd...

CVE-2025-2579 Lottie Player <= 1.1.8 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload

The Lottie Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File uploads in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to...

CVE-2025-3607 Frontend Login and Registration Blocks <= 1.0.7 - Authenticated (Subscriber+) Privilege Escalation via Password Reset

The Frontend Login and Registration Blocks plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.7. This is due to the plugin not properly validating a user's identity prior to updating a password. This makes it possible for...

CVE-2025-3101 Configurator Theme Core <= 1.4.7 - Authenticated (Subscriber+) Privilege Escalation

The Configurator Theme Core plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.4.7. This is due to the plugin not properly validating user meta fields prior to updating them in the database. This makes it possible for authenticated attackers, with...

CVE-2025-2543 Advanced Accordion Gutenberg Block <= 5.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The Advanced Accordion Gutenberg Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 5.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-lev...

CVE-2025-3761

The My Tickets – Accessible Event Ticketing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.16. This is due to the mtsaveprofile function not appropriately restricting access to unauthorized users to update roles. This makes it possible for...

Exploit for CVE-2025-3776

CVE-2025-3776 - Remote Code Execution in "Verification SMS wit...

PT-2025-17721 · WordPress · Usedesk

Name of the Vulnerable Software and Affected Versions: FuseDesk plugin for WordPress versions up to, and including, 6.7 Description: The issue is related to Stored Cross-Site Scripting via the successredirect parameter due to insufficient input sanitization and output escaping. This allows...

PT-2025-17718 · WordPress · Frontend Login/Registration Blocks

Name of the Vulnerable Software and Affected Versions: Frontend Login and Registration Blocks plugin for WordPress versions up to, and including, 1.0.7 Description: The issue is related to privilege escalation via account takeover due to the plugin not properly validating a user's identity prior ...

WordPress plugin Social Counter 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

PT-2025-17840 · WordPress · Wp-Recaptcha-Bp

Name of the Vulnerable Software and Affected Versions: WP-reCAPTCHA-bp versions n/a through 4.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Stored XSS. This means that an attacker can inject...

PT-2025-17714 · WordPress · Elex Woocommerce Advanced Bulk Edit Products

Name of the Vulnerable Software and Affected Versions: ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin for WordPress versions up to, and including, 1.4.9 Description: The issue allows authenticated attackers with Subscriber-level access and above to perform SQL Injection...

PT-2025-17711 · WordPress · Xelion Webchat

Name of the Vulnerable Software and Affected Versions: Xelion Webchat plugin for WordPress versions up to and including 9.1.0 Description: The Xelion Webchat plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability...

PT-2025-17719 · WordPress · Verification Sms With Targetsms Plugin

Name of the Vulnerable Software and Affected Versions: Verification SMS with TargetSMS plugin for WordPress versions up to, and including, 1.5 Description: The issue is related to limited Remote Code Execution in the Verification SMS with TargetSMS plugin for WordPress. This vulnerability is due ...

PT-2025-17716

Name of the Vulnerable Software and Affected Versions Flynax Bridge plugin for WordPress versions up to and including 2.2.0 Description The Flynax Bridge plugin for WordPress is vulnerable to privilege escalation via account takeover. This issue arises because the plugin does not properly validat...

PT-2025-17689

Name of the Vulnerable Software and Affected Versions Category Posts Widget WordPress plugin versions prior to 4.9.20 Description The issue concerns the Category Posts Widget WordPress plugin, which does not properly sanitise and escape some of its settings. This could allow high-privilege users,...