CVE-2025-1665 Avada Builder <= 3.11.14 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Avada Fusion Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's shortcodes in all versions up to, and including, 3.11.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-13567

CVE-2024-13567 affects the Awesome Support – WordPress HelpDesk & Support Plugin for WordPress. All versions up to and including 6.3.1 expose sensitive information via the /wp-content/uploads/awesome-support directory, allowing unauthenticated attackers to harvest attachments from ticket data. Th...

CVE-2025-2008

The Import Export Suite for CSV and XML Datafeed plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the importsinglepostascsv function in all versions up to, and including, 7.19. This makes it possible for authenticated attackers, with...

CVE-2025-2007

CVE-2025-2007 affects the Import Export Suite for CSV and XML Datafeed WordPress plugin (all versions up to 7.19). The vulnerability arises from insufficient file path validation in the deleteImage() function, enabling authenticated users with Subscriber+ access to delete arbitrary files on the s...

CVE-2025-2008

CVE-2025-2008 affects the Import Export Suite for CSV and XML Datafeed WordPress plugin. The vulnerability allows authenticated users with Subscriber+ privileges to upload arbitrary files due to missing file-type validation in import_single_post_as_csv(), across all versions up to 7.19. This can ...

CVE-2025-2007 Import Export Suite for CSV and XML Datafeed <= 7.19 - Authenticated (Subscriber+) Arbitrary File Deletion

The Import Export Suite for CSV and XML Datafeed plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteImage function in all versions up to, and including, 7.19. This makes it possible for authenticated attackers, with Subscriber-level...

WordPress plugin JS Help Desk SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...

PT-2025-14028 · WordPress · Avada (Fusion) Builder

Name of the Vulnerable Software and Affected Versions: Avada Fusion Builder plugin for WordPress versions up to, and including, 3.11.14 Description: The issue is related to Stored Cross-Site Scripting via several of the plugin's shortcodes due to insufficient input sanitization and output escapin...

PT-2025-14127 · WordPress · Wordpress

Name of the Vulnerable Software and Affected Versions: Footnotes for WordPress versions n/a through 2016.1230 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This enables potential attackers...

PT-2025-14077 · WordPress · Multiple Shipping/Billing Address For Woocommerce

Name of the Vulnerable Software and Affected Versions: Multiple Shipping And Billing Address For Woocommerce versions prior to 1.5 Description: The issue is related to Deserialization of Untrusted Data, allowing Object Injection in the Multiple Shipping And Billing Address For Woocommerce plugin...

PT-2025-14027 · WordPress · Awesome Support

Name of the Vulnerable Software and Affected Versions: The Awesome Support – WordPress HelpDesk & Support Plugin versions up to, and including, 6.3.1 Description: The issue allows unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/awesome-support...

PT-2025-14162 · WordPress · Uptime Robot Plugin

Name of the Vulnerable Software and Affected Versions: Uptime Robot Plugin for WordPress versions n/a through 2.3 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows for Cross Site Request Forgery. Recommendations: For versions n/a through 2.3, update to a...

PT-2025-14221 · Openai · Openai Tools For Wordpress & Woocommerce

Name of the Vulnerable Software and Affected Versions: OpenAI Tools for WordPress & WooCommerce versions 2.1.5 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: Fo...

20,000 WordPress Sites Affected by Arbitrary File Upload and Deletion Vulnerabilities in WP Ultimate CSV Importer WordPress Plugin

📢Did you know Wordfence runs aBug Bounty Program for all WordPress plugins and themes at no cost to vendors? Researchers can earn up to $31,200 per vulnerability , for all in-scope vulnerabilities submitted to our Bug Bounty Program! Find a vulnerability, submit the details directly to us, and we...

CVE-2025-31616

Cross-Site Request Forgery CSRF vulnerability in AdminGeekZ Varnish WordPress varnish-wp allows Cross Site Request Forgery.This issue affects Varnish WordPress: from n/a through = 1.7...

CVE-2025-31597

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in crazycric Ultimate Live Cricket WordPress Lite ultimate-live-cricket-lite allows Stored XSS.This issue affects Ultimate Live Cricket WordPress Lite: from n/a through = 1.4.2...

CVE-2025-31562

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Aphotrax Uptime Robot Plugin for WordPress uptime-robot-monitor allows DOM-Based XSS.This issue affects Uptime Robot Plugin for WordPress: from n/a through = 2.3...

CVE-2025-31615 WordPress Simple Contact Forms plugin <= 1.6.4 - CSRF to Stored XSS vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in owenr88 Simple Contact Forms allows Stored XSS. This issue affects Simple Contact Forms: from n/a through 1.6.4...

CVE-2025-31611 WordPress Auto Post After Image Upload plugin <= 1.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in Shaharia Azam Auto Post After Image Upload auto-post-after-image-upload allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Auto Post After Image Upload: from n/a through = 1.6...

CVE-2025-31586 WordPress Gallery – Photo Albums Plugin plugin <= 1.3.170 - Stored Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in GhozyLab Gallery – Photo Albums Plugin allows Stored XSS. This issue affects Gallery – Photo Albums Plugin: from n/a through 1.3.170...