CVE-2024-12615

CVE-2024-12615 affects the Passwords Manager plugin for WordPress. It enables SQL Injection via the $wpdb->prefix value in several AJAX actions in all versions up to and including 1.4.8 due to insufficient escaping of the user-supplied parameter and inadequate preparation of the SQL query. Exp...

CVE-2024-11452 Chamber Dashboard Business Directory <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Chamber Dashboard Business Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'businesscategories' shortcode in all versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes...

CVE-2024-11452

CVE-2024-11452 affects the Chamber Dashboard Business Directory plugin for WordPress. It enables Stored XSS via the plugin shortcode business_categories in all versions up to and including 3.3.8 due to insufficient input sanitization and output escaping. Exploitation requires authentication at co...

CVE-2024-10970

The The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.4.43. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode...

CVE-2024-10970 Motors – Car Dealer, Classifieds & Listing <= 1.4.43 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Custom Title

The The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.4.43. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode...

CVE-2024-10970 Motors – Car Dealer, Classifieds & Listing <= 1.4.43 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Custom Title

The The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.4.43. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode...

WordPress plugin Stars SMTP Mailer 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-5121 · WordPress · Jprintf Cnzz&51La

Name of the Vulnerable Software and Affected Versions: jprintf CNZZ&51LA for WordPress versions n/a through 1.0.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Cross Site Request Forgery. This means an attacker can trick a user into performing unintended...

WordPress plugin Kapost 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site reques...

CVE-2025-0215

The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the showdata and initiaterestore parameters in all versions up to, and including, 1.24.12 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-0215

The CVE-2025-0215 entry concerns UpdraftPlus: WP Backup & Migration Plugin for WordPress with a Reflected Cross-Site Scripting (XSS) vulnerability via showdata and initiate_restore in all versions up to and including 1.24.12. The issue is caused by insufficient input sanitization and output escap...

CVE-2025-22346

CVE-2025-22346: WordPress Course Migration for LearnDash plugin (versions 1.0.2 through n/a) suffers Server-Side Request Forgery (SSRF). The vulnerability is authenticated (Subscriber+) and is documented in multiple feeds (NVD/RedHat/CVELIST). The CVSS v3.1 base score is 6.4 (Network, Low/Low/No ...

CVE-2025-22724

CVE-2025-22724 is a Stored XSS in MojofyWP Product Carousel For WooCommerce – WoorouSell affecting versions up to 1.1.0. The CVSSv3.1 metric indicates 6.5 base score (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). Public sources (Red Hat and Wordfence) corroborate the vulnerability and note that a fix has...

CVE-2025-22738 WordPress WP ULike plugin <= 4.7.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Alimir WP ULike wp-ulike allows Stored XSS.This issue affects WP ULike: from n/a through = 4.7.6...

CVE-2025-22742 WordPress WP ViewSTL plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in falldeaf WP ViewSTL wp-viewstl allows DOM-Based XSS.This issue affects WP ViewSTL: from n/a through = 1.0...

CVE-2025-22742

CVE-2025-22742 affects the WP ViewSTL plugin for WordPress (falldeaf). It is a DOM-based XSS caused by improper input handling during web-page generation, affecting WP ViewSTL up to version 1.0. The Wordfence entry notes a patch status of Unpatched and provides no exploitation details or remediat...

CVE-2025-22773

CVE-2025-22773 pertains to the WPChill Htaccess File Editor and describes an Insertion of Sensitive Information into an Externally-Accessible File or Directory vulnerability caused by incorrectly configured access controls. The issue affects Htaccess File Editor from version n/a up to 1.0.19. The...

CVE-2025-22776

CVE-2025-22776 — Reflected XSS in the WordPress plugin WP Bulletin Board due to improper input neutralization during web page generation. Affected: WP Bulletin Board

CVE-2025-22782

CVE-2025-22782 affects WR Price List Manager For Woocommerce (WordPress). Unrestricted file upload of dangerous types (authenticated) allows uploading a web shell to the web server, with CVSS 3.1 vector NETWORK/LOW/LOW/UI:N/S:C/C:H/I:H/A:H and a 9.9 base score. Wordfence listing shows this vulner...

CVE-2024-13215 Elementor Addon Elements <= 1.13.10 - Authenticated (Contributor+) Sensitive Information Exposure via Modal Popup

The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.10 via the 'render' function in modules/modal-popup/widgets/modal-popup.php. This makes it possible for authenticated attackers, with Contributor-level acce...