CVE-2025-32513 WordPress Total processing card payments for WooCommerce plugin <= 7.1.6 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in totalprocessing Nomupay Payment Processing Gateway allows Reflected XSS. This issue affects Nomupay Payment Processing Gateway: from n/a through 7.1.6...

CVE-2025-32516

CVE-2025-32516 is a Reflected XSS vulnerability in the WordPress plugin Related Videos for JW Player (supported up to version 1.2.0 and earlier). The flaw arises from improper neutralization of input during web page generation, enabling an attacker to inject scripts via user-controlled input that...

CVE-2025-32530

CVE-2025-32530 describes a Reflected XSS in the WordPress plugin “Wallet System for WooCommerce.” The issue is attributed to improper neutralization of input during web page generation and affects Wallet System for WooCommerce versions up to 2.6.5 (range: from n/a through 2.6.5). The connected Re...

CVE-2025-32548

CVE-2025-32548 describes a Reflected XSS in the WordPress plugin “Hamburger Icon Menu Lite,” caused by improper input neutralization during web page generation. The vulnerability affects the plugin as released up to version 1.0 (listed as affected “from n/a through 1.0”). The initial documents co...

CVE-2025-32578

CVE-2025-32578 is a Reflected XSS in the WordPress plugin Coming Soon Countdown (vulnerable up to and including 2.2). The vulnerability arises during web page generation where user-controlled input is improperly neutralized, enabling reflected scripts. The CVE entry notes the impact as cross-site...

CVE-2025-32583 WordPress PDF 2 Post Plugin <= 2.4.0 - Remote Code Execution (RCE) vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in termel PDF 2 Post pdf2post allows Remote Code Inclusion.This issue affects PDF 2 Post: from n/a through = 2.4.0...

CVE-2025-32590 WordPress Web2application Plugin <= 6.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in tzin111 Web2application web2application allows Reflected XSS.This issue affects Web2application: from n/a through = 6.1...

CVE-2025-32592 WordPress TableOn Plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in RealMag777 TableOn posts-table-filterable allows Stored XSS.This issue affects TableOn: from n/a through = 1.0.3...

CVE-2025-32628 WordPress Crowdfunding for WooCommerce Plugin <= 3.1.12 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Wham Crowdfunding for WooCommerce allows Reflected XSS. This issue affects Crowdfunding for WooCommerce: from n/a through 3.1.12...

CVE-2025-32634

CVE-2025-32634 describes a Reflected XSS in the WordPress plugin Run Contests, Raffles, and Giveaways with ContestsWP (versions n/a through 2.0.6). The vulnerability arises from improper input neutralization during web page generation. Affected software is ContestsWP communications for Run Contes...

CVE-2025-32636 WordPress Local Magic plugin <= 2.9.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in matthewrubin Local Magic local-magic allows SQL Injection.This issue affects Local Magic: from n/a through = 2.9.0...

CVE-2025-32638 WordPress ShopApper plugin <= 0.4.61 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in weptile Mobile App for WooCommerce mobile-app-for-woocommerce allows Stored XSS.This issue affects Mobile App for WooCommerce: from n/a through = 0.4.61...

CVE-2025-32653 WordPress Cart66 Cloud Plugin <= 2.3.7 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Lee Blue Cart66 Cloud allows Reflected XSS. This issue affects Cart66 Cloud: from n/a through 2.3.7...

CVE-2025-32652 WordPress Solace Extra plugin <= 1.3.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in solacewp Solace Extra allows Using Malicious Files. This issue affects Solace Extra: from n/a through 1.3.1...

CVE-2025-32660 WordPress JS Job Manager plugin <= 2.0.2 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in JoomSky JS Job Manager allows Upload a Web Shell to a Web Server. This issue affects JS Job Manager: from n/a through 2.0.2...

CVE-2025-32658

CVE-2025-32658 is a Deserialization of Untrusted Data vulnerability in the WordPress plugin HelpGent (wpWax HelpGent) that allows PHP Object Injection. Affected versions are n/a through 2.2.4. The CVSS 3.1 vector in the document indicates a NETWORK attack with HIGH impact: Confidentiality, Integr...

CVE-2025-32682 WordPress MapSVG Lite plugin <= 8.6.4 - Arbitrary File Upload Vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in RomanCode MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through = 8.6.4...

CVE-2025-39551 WordPress FluentBoards <= 1.47 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in Mahmudul Hasan Arif FluentBoards allows Object Injection. This issue affects FluentBoards: from n/a through 1.47...

CVE-2025-39558 WordPress CRM Perks plugin <= 1.1.7 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CRM Perks CRM Perks support-x allows Reflected XSS.This issue affects CRM Perks: from n/a through = 1.1.7...

CVE-2025-39562

CVE-2025-39562 concerns the WordPress plugin Payment Form for PayPal Pro (codepeople) with a stored XSS vulnerability due to improper input neutralization during web page generation. Public records reference affected versions: 1.1.72 and earlier. Red Hat and CVE databases confirm the flaw and lin...