CVE-2025-31391

CVE-2025-31391 corresponds to a CSRF-triggered Stored XSS in the WordPress plugin “Script Compressor.” Public docs indicate the affected product is Script Compressor (versions up to 1.7.1 as per initial description) and that the underlying issue combines Cross-Site Request Forgery with stored XSS...

CVE-2025-32482

CVE-2025-32482 affects the WordPress plugin Custom Smilies (vendor/product not specified in the provided docs) with a Cross-Site Request Forgery leading to Stored XSS . The initial entry lists a CVSS v3.1 base score of 7.1 (HIGH) and notes affected versions as “from n/a through 1.2.” The connecte...

CVE-2025-32483 WordPress Request Call Back <= 1.4.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Scott Salisbury Request Call Back allows Stored XSS. This issue affects Request Call Back: from n/a through 1.4.1...

CVE-2025-32483 WordPress Request Call Back plugin <= 1.4.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Scott Salisbury Request Call Back request-call-back allows Stored XSS.This issue affects Request Call Back: from n/a through = 1.4.1...

CVE-2025-32485 WordPress WP Performance Pack <= 2.5.4 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in Bjoern WP Performance Pack allows Cross Site Request Forgery. This issue affects WP Performance Pack: from n/a through 2.5.4...

CVE-2025-32493

CVE-2025-32493 is a stored XSS vulnerability in the WordPress plugin BP Social Connect (affected: up to version 1.6.2). The connected Wordfence entry indicates an authenticated (Administrator+) Stored Cross‑Site Scripting flaw in BP Social Connect

CVE-2025-32492

CVE-2025-32492 is an authenticated, stored XSS vulnerability in the WordPress plugin Admin Menu Post List (affected: Admin Menu Post List

CVE-2025-32492 WordPress Admin Menu Post List <= 2.0.7 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Eliot Akira Admin Menu Post List allows Stored XSS. This issue affects Admin Menu Post List: from n/a through 2.0.7...

CVE-2025-32543 WordPress Canonical Attachments Plugin <= 1.8 - Stored Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in hivedigital Canonical Attachments canonical-attachments allows Reflected XSS.This issue affects Canonical Attachments: from n/a through = 1.8...

CVE-2025-32575

CVE-2025-32575 affects the WordPress plugin WP w3all phpBB (axew3) for WordPress/WP-BB integration. Connected data indicates the issue is described as a Cross-Site Forgery to Stored Cross-Site Scripting (CSRF to S-SCRIPTING) vulnerability affecting WP w3all phpBB up to version 2.9.3. The CVE entr...

CVE-2025-32612

CVE-2025-32612 concerns the WordPress plugin User Session Synchronizer. Connected documentation confirms a CSRF to Stored XSS scenario affecting User Session Synchronizer versions up to 1.4.0, with the CVE rated as HIGH (CVSS 3.1: 7.1 base score: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The Wordfenc...

CVE-2025-32623

The CVE-2025-32623 entry concerns PlainInventory (WordPress plugin) with a CSRF to Stored XSS issue affecting versions up to 3.1.9. The connected Wordfence vulnerability listing confirms the issue and indicates the patch status as Unpatched (no publicly released fix details in the provided docume...

CVE-2025-32642 WordPress Vite Coupon plugin <= 1.0.9 - CSRF to Remote Code Execution (RCE) vulnerability

Cross-Site Request Forgery CSRF vulnerability in appsbd Vite Coupon vite-coupon allows Remote Code Inclusion.This issue affects Vite Coupon: from n/a through = 1.0.9...

CVE-2025-32685 WordPress WP Inquiries plugin <= 0.2.1 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Aristo Rinjuang WP Inquiries wp-inquiries allows SQL Injection.This issue affects WP Inquiries: from n/a through = 0.2.1...

CVE-2025-32691 WordPress PowerPress Podcasting plugin <= 11.12.6 - Server Side Request Forgery (SSRF) Vulnerability

Server-Side Request Forgery SSRF vulnerability in blubrry PowerPress Podcasting powerpress allows Server Side Request Forgery.This issue affects PowerPress Podcasting: from n/a through = 11.12.6...

CVE-2025-3100 WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.22 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload

The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.6.22 due to insufficient input sanitization and output escaping...

PT-2025-15766 · WordPress · Wp-Planification

Name of the Vulnerable Software and Affected Versions: WP-Planification versions prior to 2.3.1 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker could potentially trick a user into performing unintended actions on ...

The vulnerability of the Fresh Framework plugin of the WordPress content management system allows a hacker to execute arbitrary code.

The vulnerability of the Fresh Framework plugin for WordPress content management systems is related to improper code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2025-2876

CVE-2025-2876 affects MelaPress Login Security and MelaPress Login Security Premium for WordPress. Root cause: missing capability check in monitor_admin_actions in version 2.1.0, enabling unauthenticated users to delete any user. Impact from sources: data loss via unauthorized user deletion. Reme...

CVE-2025-3437 Motors – Car Dealership & Classified Listings Plugin <= 1.4.66 - Missing Authorization to Authenticated (Subscriber+) Wizard Set-up

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in the ajaxactions.php file in all versions up to, and including, 1.4.66. This makes it possible for authenticate...