CVE-2025-2302

CVE-2025-2302 affects the Advanced Woo Search WordPress plugin. It is vulnerable to a Stored Cross-Site Scripting (XSS) via the aws_search_terms shortcode in all versions up to and including 3.28, caused by insufficient input sanitization and output escaping of user-supplied attributes. This allo...

WordPress Amazing service box Addons For WPBakery Page Builder plugin <= 2.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by Avraham Shemesh in WordPress Plugin Amazing service box Addons For WPBakery Page Builder versions = 2.0.0...

CVE-2025-30567 WordPress WP01 plugin <= 2.6.2 - Arbitrary File Download Vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in WP01 WP01 wp01 allows Path Traversal.This issue affects WP01: from n/a through = 2.6.2...

CVE-2025-30567 WordPress WP01 plugin <= 2.6.2 - Arbitrary File Download Vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in WP01 WP01 wp01 allows Path Traversal.This issue affects WP01: from n/a through = 2.6.2...

CVE-2025-2510 Frndzk Expandable Bottom Bar <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via text Parameter

The Frndzk Expandable Bottom Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'text' parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-leve...

CVE-2024-12623

CVE-2024-12623 affects the DICOM Support WordPress plugin. The vulnerability is a Stored XSS via the plugin’s dcm shortcode across all versions up to 0.10.6, caused by insufficient input sanitization and output escaping on user-supplied attributes. Exploitation requires authentication at contribu...

CVE-2025-2252 Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.3.6.1 - Unauthenticated Private Post Title Disclosure

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.6.1 via the eddajaxgetdownloadtitle function. This makes it possible for unauthenticated attackers to extract...

CVE-2025-2224

The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the 'parsequery' function in all versions up to, and including, 8.2. This makes it possible fo...

CVE-2024-10560

The Form Maker by 10Web WordPress plugin before 1.15.30 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-12769 Simple Banner < 3.0.4 - Admin+ Stored XSS

The Simple Banner WordPress plugin before 3.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-12682 Smart Maintenance Mode < 1.5.2 - Admin+ Stored XSS

The Smart Maintenance Mode WordPress plugin before 1.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-10566 Slider by 10Web < 1.2.62 - Contributor+ Stored XSS

The Slider by 10Web WordPress plugin before 1.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-10554

CVE-2024-10554 affects the WordPress plugin WP-Advanced-Search prior to version 3.3.9.3. Root cause: certain settings are not properly sanitised/escaped, enabling Stored XSS by high-privilege users (e.g., admins), even when unfiltered_html is disallowed (notably in multisite setups). Impact is st...

CVE-2025-0845 DesignThemes Core Features <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The DesignThemes Core Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

CVE-2025-0845

CVE-2025-0845 : DesignThemes Core Features (WordPress) allows Stored XSS via shortcode attributes due to insufficient input sanitization and output escaping. Affected versions are “up to and including 4.8.” Exploitation requires authenticated access at contributor+ level, enabling an attacker to ...

Exploit for CVE-2024-31114

CVE-2024-31114 - WordPress Shortcode Addons RCE Exploit Sho...

PT-2025-12738 · WordPress · Job Postings

Name of the Vulnerable Software and Affected Versions: Job Postings WordPress plugin versions prior to 2.7.11 Description: The issue allows high privilege users, such as contributors, to perform Stored Cross-Site Scripting attacks. This is possible because the plugin does not properly sanitise an...

WordPress plugin aoa-downloadable 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security...

CVE-2025-30526

Cross-Site Request Forgery CSRF vulnerability in lucksy Typekit plugin for WordPress typekit allows Cross Site Request Forgery.This issue affects Typekit plugin for WordPress: from n/a through = 1.2.3...

CVE-2025-30619 WordPress SpeakPipe plugin <= 0.2 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in SpeakPipe SpeakPipe speakpipe-voicemail-for-websites allows Cross Site Request Forgery.This issue affects SpeakPipe: from n/a through = 0.2...