12343 matches found
CVE-2025-24730
CVE-2025-24730 is a DOM-based XSS vulnerability in the WordPress plugin WP VR (Rextheme) , caused by improper input neutralization during web page generation. Affected versions are up to and including 8.5.14. Public sources (Wordfence, Patchstack, Red Hat) indicate the issue exists and that remed...
CVE-2025-24728 WordPress Bug Library plugin <= 2.1.4 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Yannick Lefebvre Bug Library bug-library allows Blind SQL Injection.This issue affects Bug Library: from n/a through = 2.1.4...
CVE-2025-24738
CVE-2025-24738 is a CSRF vulnerability in the WordPress Call Now Button plugin (versions
CVE-2025-24724
CVE-2025-24724 refers to a CSRF vulnerability in the Wow-Company Side Menu Lite WordPress plugin, affecting versions up to 5.3.1. The issue enables Cross-Site Request Forgery to trigger settings changes. CVSS metrics shown (3.1 vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) indicate a Medium impact...
CVE-2025-24716 WordPress Herd Effects Plugin <= 6.2.1 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability
Cross-Site Request Forgery CSRF vulnerability in Wow-Company Herd Effects allows Cross Site Request Forgery. This issue affects Herd Effects: from n/a through 6.2.1...
CVE-2025-24713
CVE-2025-24713 is a CSRF vulnerability in the WordPress plugin “Button Generator – easily Button Builder” (Wow-Company Button Generator). Public details indicate the issue affects versions up to 3.1.1 (vulnerability range: n/a through 3.1.1) and is classified as Cross-Site Request Forgery. The CV...
CVE-2025-24709
CVE-2025-24709: Stored XSS in Plethora Plugins Tabs + Accordions (
CVE-2025-24644
CVE-2025-24644 affects WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels (WebToffee) versions up to 4.7.1. Root cause: improper neutralization of input during web page generation, enabling stored XSS. Public references indicate remediation to version 4.7.2 (update requir...
CVE-2025-24634
CVE-2025-24634 affects the Orbisius Simple Notice WordPress plugin (versions ≤ 1.1.3). It is a Stored XSS due to improper input neutralization during web page generation. CVSS 3.1 base score 5.9 (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L). Connected sources indicate patching in version 1.1.3 (patched),...
CVE-2025-24633 WordPress Build Private Store For Woocommerce plugin <= 1.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in silverplugins217 Build Private Store For Woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Build Private Store For Woocommerce: from n/a through 1.0...
CVE-2025-24604
CVE-2025-24604 (VForm plugin for WordPress) : A Missing Authorization vulnerability affects VForm up to version 3.0.5 (WordPress plugin). The root cause is incorrect or insufficient access-control configuration, enabling unauthorized actions under configured security levels. The issue is categori...
CVE-2025-24594 WordPress Linet ERP-Woocommerce Integration plugin <= 3.5.7 - CSRF to Broken Access Control vulnerability
Missing Authorization vulnerability in aribhour Linet ERP-Woocommerce Integration linet-erp-woocommerce-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Linet ERP-Woocommerce Integration: from n/a through = 3.5.7...
CVE-2025-24594
CVE-2025-24594 affects the WordPress plugin Linet ERP-Woocommerce Integration (versions
CVE-2025-24572 WordPress WP Fast Total Search plugin <= 1.78.258 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in Epsiloncool WP Fast Total Search fulltext-search allows Cross Site Request Forgery.This issue affects WP Fast Total Search: from n/a through = 1.78.258...
CVE-2025-24573 WordPress Pagelayer plugin <= 1.9.4 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Softaculous PageLayer pagelayer allows DOM-Based XSS.This issue affects PageLayer: from n/a through = 1.9.4...
CVE-2025-24547 WordPress Caching Compatible Cookie Opt-In plugin <= 0.0.10 - Stored Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in matthias.wagner Caching Compatible Cookie Opt-In and JavaScript caching-compatible-cookie-optin-and-javascript allows Stored XSS.This issue affects Caching Compatible Cookie Opt-In and JavaScript:...
CVE-2025-24589 WordPress JSM Show Post Metadata plugin <= 4.6.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in JS Morisset JSM Show Post Metadata jsm-show-post-meta allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JSM Show Post Metadata: from n/a through = 4.6.0...
CVE-2025-24591 WordPress GDPR CCPA Compliance & Cookie Consent Banner plugin <= 2.7.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Ninja Team GDPR CCPA Compliance Support ninja-gdpr-compliance allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GDPR CCPA Compliance Support: from n/a through = 2.7.1...
CVE-2025-24571
CVE-2025-24571 affects the WordPress plugin WP Fast Total Search (versions 1.78.258 and earlier). The root cause is Missing Authorization / Broken Access Control, described as exploiting incorrectly configured access control security levels. The CVSS metrics indicate network attack vector with lo...