WordPress plugin Bookingor 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2025-14849 · WordPress · Product Filter By Wbw

Name of the Vulnerable Software and Affected Versions: Product Filter by WBW plugin for WordPress versions up to, and including, 2.7.9 Description: The issue allows unauthenticated attackers to perform time-based SQL Injection via the filtersDataBackend parameter due to insufficient escaping of...

PT-2025-14861 · WordPress · Woffice Core

Name of the Vulnerable Software and Affected Versions: Woffice Core plugin for WordPress versions up to, and including, 5.4.21 Description: The issue is related to arbitrary file uploads due to missing file type validation in the saveFeaturedImage function. This allows authenticated attackers, wi...

PT-2025-14862 · WordPress · Woffice Core

Name of the Vulnerable Software and Affected Versions: Woffice Core plugin for WordPress versions up to and including 5.4.21 Description: The issue is due to missing or incorrect nonce validation on the woffice handle user approval actions function, making it possible for unauthenticated attacker...

WordPress Vehica Core plugin <= 1.0.97 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by Alyudin Nafiie in WordPress Plugin Vehica Core versions = 1.0.97...

CVE-2025-31776

Cross-Site Request Forgery CSRF vulnerability in Aphotrax Uptime Robot Plugin for WordPress uptime-robot-monitor allows Cross Site Request Forgery.This issue affects Uptime Robot Plugin for WordPress: from n/a through = 2.3...

CVE-2025-31735

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in C. Johnson Footnotes for WordPress footnotes-for-wordpress allows Stored XSS.This issue affects Footnotes for WordPress: from n/a through = 2016.1230...

CVE-2025-31893 WordPress Botnet Attack Blocker plugin <= 2.0.0 - Stored Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in cheesefather Botnet Attack Blocker botnet-attack-blocker allows Stored XSS.This issue affects Botnet Attack Blocker: from n/a through = 2.0.0...

CVE-2025-31827 WordPress Fonto plugin <= 1.2.2 - Arbitrary File Download vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in vlad.olaru Fonto fonto allows Path Traversal.This issue affects Fonto: from n/a through = 1.2.2...

CVE-2025-31554 WordPress Docxpresso plugin <= 2.6 - Arbitrary File Download vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in docxpresso Docxpresso docxpresso allows Absolute Path Traversal.This issue affects Docxpresso: from n/a through = 2.6...

CVE-2025-30616 WordPress Latest Custom Post Type Updates plugin <= 1.3.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Wood Latest Custom Post Type Updates latest-custom-post-type-updates allows Reflected XSS.This issue affects Latest Custom Post Type Updates: from n/a through = 1.3.0...

CVE-2025-30596 WordPress include-file plugin <= 1 - Arbitrary File Download Vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in tstafford include-file include-file allows Path Traversal.This issue affects include-file: from n/a through = 1...

CVE-2025-2299

The LuckyWP Table of Contents plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.10. This is due to missing or incorrect nonce validation on the 'ajaxEdit' function. This makes it possible for unauthenticated attackers to inject arbitrary we...

CVE-2025-2299 LuckyWP Table of Contents <= 2.1.10 - Cross-Site Request Forgery to Reflected Cross-Site Scripting

The LuckyWP Table of Contents plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.10. This is due to missing or incorrect nonce validation on the 'ajaxEdit' function. This makes it possible for unauthenticated attackers to inject arbitrary we...

CVE-2024-12189

The WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom widgets in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This...

CVE-2024-13567

The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.3.1 via the 'awesome-support' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored...

CVE-2025-1663

The CVE-2025-1663 entry concerns the Unlimited Elements For Elementor plugin for WordPress. Concrete details from connected sources show a Stored Cross-Site Scripting (XSS) vulnerability in multiple widgets, caused by insufficient input sanitization and output escaping, affecting all versions up ...

CVE-2025-1663 Unlimited Elements For Elementor <= 1.5.142 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 1.5.142 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-13673

CVE-2024-13673 affects the Big Boom Directory plugin for WordPress. It is a Stored XSS via the plugin's bbd-search shortcode in all versions up to 2.5.0, caused by insufficient input sanitization and output escaping. Authenticated users with contributor-level access can inject scripts that execut...

CVE-2024-13673 Big Boom Directory <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Big Boom Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bbd-search' shortcode in all versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...