PT-2025-12479 · WordPress · Export/Import Users/Customers

Name of the Vulnerable Software and Affected Versions: Export and Import Users and Customers plugin for WordPress versions prior to 2.6.3 Description: The issue is related to insufficient file path validation in the admin log page function, allowing authenticated attackers with Administrator-leve...

WordPress plugin Motors – Car Dealer, Classifieds & Listing 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2025-12478 · WordPress · Export/Import Users/Customers

Name of the Vulnerable Software and Affected Versions: Export and Import Users and Customers plugin for WordPress versions up to, and including, 2.6.2 Description: The issue is related to PHP Object Injection via deserialization of untrusted input from the form data parameter. This allows...

CVE-2024-13412

The CozyStay theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxhandler function in all versions up to, and including, 1.7.0. This makes it possible for unauthenticated attackers to execute arbitrary actions...

CVE-2024-12922

The Altair theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check within functions.php in all versions up to, and including, 5.2.4. This makes it possible for unauthenticated attackers to update arbitrary...

CVE-2025-1802

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘markertitle’, 'notificationcontent', and 'sttbuttontext' parameters in all versions up to, and including, 2.8.3 due to insufficient input sanitization and output escaping. This...

CVE-2025-2539

The File Away plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax function in all versions up to, and including, 3.9.9.0.1. This makes it possible for unauthenticated attackers, leveraging the use of a reversible weak algorithm, to read...

CVE-2024-13558

The NP Quote Request for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.179 due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read the content of quote requests...

CVE-2024-13920

CVE-2024-13920 affects the WordPress plugin Order Export & Order Import for WooCommerce (

CVE-2025-1802 HT Mega – Absolute Addons For Elementor <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘markertitle’, 'notificationcontent', and 'sttbuttontext' parameters in all versions up to, and including, 2.8.3 due to insufficient input sanitization and output escaping. This...

CVE-2025-2539 File Away <= 3.9.9.0.1 - Missing Authorization to Unauthenticated Arbitrary File Read

The File Away plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax function in all versions up to, and including, 3.9.9.0.1. This makes it possible for unauthenticated attackers, leveraging the use of a reversible weak algorithm, to read...

CVE-2025-2539

The WordPress File Away plugin is vulnerable to unauthenticated arbitrary file read via a missing capability check in the ajax() endpoint in all versions up to 3.9.9.0.1. Authenticated status is not required (ATT&CK: None specified in documents), and the vulnerability allows reading server files ...

CVE-2024-13922

CVE-2024-13922 affects the WordPress plugin Order Export & Order Import for WooCommerce. It is exploitable via admin_log_page() due to insufficient file path validation, enabling authenticated administrators (Admin+ privileges) to delete arbitrary log files on the server in versions up to 2.6.0. ...

CVE-2024-13558

CVE-2024-13558 affects the NP Quote Request for WooCommerce plugin (WordPress). The vulnerability is an Insecure Direct Object Reference caused by missing validation on a user-controlled key, affecting all versions up to 1.9.179. It allows unauthenticated attackers to read the content of quote re...

CVE-2025-2505 Age Gate <= 3.5.3 - Unauthenticated Local PHP File Inclusion via 'lang'

The Age Gate plugin for WordPress is vulnerable to Local PHP File Inclusion in all versions up to, and including, 3.5.3 via the 'lang' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary PHP files on the server, allowing the execution of code in those...

CVE-2024-13880 My Quota <= 1.0.8 - Reflected XSS

The My Quota WordPress plugin through 1.0.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13876

CVE-2024-13876 affects the WordPress plugin mEintopf (versions ≤ 0.2.1). The vulnerability is a reflected Cross-Site Scripting (XSS) caused by the plugin not sanitising and escaping a parameter before outputting it on the page. The impact is described as an XSS that could be used against high-pri...

CVE-2025-1314

CVE-2025-1314 (Custom Twitter Feeds – A Tweets Widget or X Feed Widget for WordPress) is a CSRF vulnerability present in all versions up to and including 2.2.5. The root cause is missing or incorrect nonce validation in the ctf_clear_cache_admin() function, enabling unauthenticated attackers to r...

PT-2025-12005 · WordPress · Eventin

Name of the Vulnerable Software and Affected Versions: Eventin plugin for WordPress versions up to, and including, 4.0.24 Description: The Eventin plugin for WordPress is vulnerable to Local File Inclusion via the style parameter. This allows authenticated attackers with Contributor-level access...

CVE-2025-2511

The AHAthat Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 1.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...