CVE-2025-2613

The CVE-2025-2613 entry concerns the WordPress plugin Login Manager – Design Login Page, View Login Activity, Limit Login Attempts, with Stored XSS in the Custom logo and background URLs, affecting all versions up to 2.0.5. The root cause is insufficient input sanitization and output escaping, en...

CVE-2025-3520

CVE-2025-3520 affects the WordPress Avatar plugin (versions ≤ 0.1.4). The root cause is insufficient file path validation in a function, enabling authenticated users with Subscriber+ access to delete arbitrary server files (e.g., wp-config.php), with potential remote code execution. Public entrie...

Hunk Companion Plugin 1.9.0 - Unauthenticated Plugin Installation

Exploit Title: Hunk Companion Plugin 1.9.0 - Unauthenticated Plugin Installation Date: 16 December, 2024 Exploit Author: Jun Takemura Author's GitHub: https://github.com/JunTakemura Author's Blog: juntakemura.dev Vendor Homepage: https://themehunk.com Software Link:...

PT-2025-17251 · WordPress · Avatar

Name of the Vulnerable Software and Affected Versions: Avatar plugin for WordPress versions up to, and including, 0.1.4 Description: The Avatar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in a function. This makes it possible for...

PT-2025-17287 · WordPress · Download Manager

Name of the Vulnerable Software and Affected Versions: Download Manager plugin for WordPress versions up to, and including, 3.3.12 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows...

CVE-2025-23855 WordPress SpiderDisplay plugin <= 1.9.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in fyljp SpiderDisplay spiderdisplay allows Reflected XSS.This issue affects SpiderDisplay: from n/a through = 1.9.1...

CVE-2025-24553

The CVE-2025-24553 entry concerns the WordPress plugin Shipping with Venipak for WooCommerce (Akadrama Shipping with Venipak for WooCommerce) and is caused by improper input neutralization during web page generation, leading to Reflected XSS. Affected versions are 1.22.3 and earlier. Multiple con...

CVE-2025-24583

CVE-2025-24583 affects the WordPress plugin “12 Step Meeting List” up to version 3.16.5. The vulnerability is described as a Missing Authorization issue that allows exploitation due to incorrectly configured access control security levels. Documented impact: baseline CVSSv3.1 score around 6.5 (Me...

CVE-2025-24637 WordPress Beacon Lead Magnets and Lead Capture Plugin <= 1.5.7 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Syed Balkhi Beacon Lead Magnets and Lead Capture beacon-by allows Reflected XSS.This issue affects Beacon Lead Magnets and Lead Capture: from n/a through = 1.5.7...

CVE-2025-24655

CVE-2025-24655 affects the WordPress Plugin Wishlist (PickPlugins Wishlist). Vulnerability: Reflected Cross-Site Scripting (XSS) caused by improper neutralization of input during web page generation. Affected versions: 1.0.0 through 1.0.39. Impact: potential for attackers to inject client-side sc...

CVE-2025-27282 WordPress Theme File Duplicator Plugin <= 1.3 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in rockgod100 Theme File Duplicator theme-file-duplicator allows Using Malicious Files.This issue affects Theme File Duplicator: from n/a through = 1.3...

CVE-2025-27284 WordPress Flagged Content Plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in divspark Flagged Content flagged-content allows Reflected XSS.This issue affects Flagged Content: from n/a through = 1.0.2...

CVE-2025-27291 WordPress Photo Gallery – Image Gallery Plugin <= 2.0.4 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in uxgallery WordPress Photo Gallery – Image Gallery photo-image-gallery allows Reflected XSS.This issue affects WordPress Photo Gallery – Image Gallery: from n/a through = 2.0.4...

CVE-2025-27292 WordPress WPYog Documents Plugin <= 1.3.5 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PoppinsDigital.com WPYog Documents wpyog-documents allows Reflected XSS.This issue affects WPYog Documents: from n/a through = 1.3.5...

CVE-2025-27299 WordPress MyTicket Events plugin <= 1.2.4 - Non-Arbitrary File Read vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in WP Asia MyTicket Events myticket-events allows Path Traversal.This issue affects MyTicket Events: from n/a through = 1.2.4...

CVE-2025-27299

CVE-2025-27299 is about WP Asia MyTicket Events. A path restriction flaw allows unauthenticated file read (path traversal) in MyTicket Events versions 1.2.4 and earlier. The Red Hat/RedHat-affiliate listing and CVE records confirm the vulnerability and note no public details on a fix version; the...

CVE-2025-27337 WordPress Fontsampler Plugin <= 0.4.14 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in kontur Fontsampler fontsampler allows Reflected XSS.This issue affects Fontsampler: from n/a through = 0.4.14...

CVE-2025-27337 WordPress Fontsampler Plugin <= 0.4.14 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in kontur Fontsampler fontsampler allows Reflected XSS.This issue affects Fontsampler: from n/a through = 0.4.14...

CVE-2025-31030

CVE-2025-31030 affects Ray Enterprise Translation (WordPress plugin Lingotek Translation): Improper filename control enables PHP Local File Inclusion via Include/Require; affects Ray Enterprise Translation from n/a through 1.7.0. Connected docs do not provide a patch/version beyond 1.7.0; exploit...

CVE-2025-31030 WordPress Ray Enterprise Translation plugin <= 1.7.0 - Local File Inclusion via CSRF Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Jiro Sasamoto Ray Enterprise Translation lingotek-translation allows PHP Local File Inclusion.This issue affects Ray Enterprise Translation: from n/a through = 1.7.0...