CVE-2025-39568

CVE-2025-39568 (StoreContrl Woocommerce) exposes an improper limitation of a pathname to a restricted directory (path traversal) that enables an unauthenticated arbitrary file download. Affected: StoreContrl Woocommerce versions n/a through 4.1.3. The vulnerability has been patched; remediation i...

CVE-2025-39568 WordPress StoreContrl Woocommerce plugin <= 4.1.3 - Arbitrary File Download Vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Arture B.V. StoreContrl Woocommerce storecontrl-wp-connection allows Path Traversal.This issue affects StoreContrl Woocommerce: from n/a through = 4.1.3...

CVE-2025-39588

CVE-2025-39588 describes a deserialization of untrusted data vulnerability in the WordPress plugin “Ultimate Store Kit – Elementor Addons” (bdthemes) affecting versions up to 2.4.0. The root cause is deserializing untrusted data, enabling PHP object injection. Public details classify the impact a...

CVE-2025-39596 WordPress Quentn WP <= 1.2.8 - Privilege Escalation Vulnerability

Weak Authentication vulnerability in Quentn.com GmbH Quentn WP allows Privilege Escalation. This issue affects Quentn WP: from n/a through 1.2.8...

CVE-2025-22340 WordPress Data Dash plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Think201 Data Dash data-dash allows Stored XSS.This issue affects Data Dash: from n/a through = 1.2.3...

CVE-2025-26968 WordPress Cloak Front End Email <= 1.9.5 - Broken Access Control Vulnerability

Missing Authorization vulnerability in webbernaut Cloak Front End Email allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Cloak Front End Email: from n/a through 1.9.5...

CVE-2025-39417 WordPress Redirect wordpress to welcome or landing page plugin <= 2.0 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Eslam Mahmoud Redirect wordpress to welcome or landing page redirect-to-welcome-or-landing-page allows Stored XSS.This issue affects Redirect wordpress to welcome or landing page: from n/a through = 2.0...

CVE-2025-39421

CVE-2025-39421 describes a CSRF vulnerability in the WordPress plugin WP Sticky Side Buttons (Mustafa KUCUK) that enables stored XSS. The CVE entry states the vulnerability affects WP Sticky Side Buttons versions from n/a up to and including 2.1, with CVSSv3.1 metrics (AV:N/AC:L/PR:N/UI:R/S:C/C:L...

CVE-2025-39429 WordPress Széchenyi 2020 Logo <= 1.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Földesi, Mihály Széchenyi 2020 Logo szechenyi-2020-logo allows PHP Local File Inclusion.This issue affects Széchenyi 2020 Logo: from n/a through = 1.1...

CVE-2025-39436

CVE-2025-39436 concerns the WordPress plugin I Draw (versions n/a through 1.0). The issue is Unrestricted Upload of File with Dangerous Type, allowing arbitrary files to be uploaded and used maliciously. Affected component is the plugin’s file upload functionality, with root cause described as al...

CVE-2025-39439 WordPress wpLike2Get plugin <= 1.2.9 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Markus Drubba wpLike2Get wplike2get allows Retrieve Embedded Sensitive Data.This issue affects wpLike2Get: from n/a through = 1.2.9...

CVE-2025-39441

CVE-2025-39441 describes a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Dashboard Notepads that enables Stored XSS. Publicly disclosed details indicate affected software: Dashboard Notepads versions up to 1.2.1. Root cause and impact are stated in multiple sources as CS...

CVE-2025-3453

The Password Protected – Password Protect your WordPress Site, Pages, & WooCommerce Products – Restrict Content, Protect WooCommerce Category and more plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.7 via the 'passwordprotectedcookie'...

CVE-2025-3479

Forminator Forms – Contact Form, Payment Form & Custom Form Builder for WordPress is vulnerable to an Order Replay flaw (CVE-2025-3479) in versions up to 1.42.0 due to insufficient validation of a user-controlled key in the handle_stripe_single path. This allows an unauthenticated attacker to reu...

CVE-2024-11924

The Icegram Express formerly known as Email Subscribers WordPress plugin before 5.7.52 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for...

CVE-2024-11924

The Icegram Express formerly known as Email Subscribers WordPress plugin before 5.7.52 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for...

CVE-2025-1523

CVE-2025-1523 concerns The Ultimate Dashboard WordPress plugin prior to 3.8.6. The vulnerability is a stored XSS in plugin settings caused by insufficient sanitization/escaping, which could allow a high-privilege user (e.g., an admin) to inject script payloads. Exploitation details (e.g., exact v...

PT-2025-16994 · WordPress · Wp Post To Pdf Enhanced

Name of the Vulnerable Software and Affected Versions: WP Post to PDF Enhanced versions 1.1.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

PT-2025-17061 · WordPress · Wp Asia Myticket Events

Name of the Vulnerable Software and Affected Versions: WP Asia MyTicket Events versions 1.2.4 and earlier Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal'. This allows for Path Traversal in WP Asia MyTicket Events...

PT-2025-17167 · WordPress · Wpfactory Product Excel Import Export & Bulk Edit For Woocommerce

Name of the Vulnerable Software and Affected Versions: WPFactory Product Excel Import Export & Bulk Edit for WooCommerce versions n/a through 4.7 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows...