10CentMail <= 2.1.50 - Reflected Cross-Site Scripting

Description The 10CentMail plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.1.50 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...

WordPress plugin WP Extended 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

CVE-2025-22306

CVE-2025-22306 affects Link Whisper Free; reported as an unauthenticated exposure of sensitive information in versions up to 0.7.7. Connected sources indicate the issue is mitigated by the patch release to 0.7.8. Technical details about the exact data exposed or vectors are not provided beyond th...

CVE-2025-22515 WordPress Show Google Analytics widget plugin <= 1.5.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Simon Chuang Show Google Analytics widget allows Stored XSS.This issue affects Show Google Analytics widget: from n/a through 1.5.4...

CVE-2025-22519 WordPress eDoc Easy Tables Plugin <= 1.29 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in jerodmoore eDoc Easy Tables edoc-easy-tables allows SQL Injection.This issue affects eDoc Easy Tables: from n/a through = 1.29...

CVE-2025-22533

CVE-2025-22533 is an SQL Injection in the WOOEXIM – WooCommerce Export Import Plugin for WordPress. The initial description identifies it as an Improper Neutralization of Special Elements used in an SQL Command vulnerability (SQL Injection) affecting WOOEXIM: from n/a through 5.0.0. The connected...

CVE-2025-22546 WordPress jQuery TwentyTwenty plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Obaid Hossain jQuery TwentyTwenty js-twentytwenty allows Stored XSS.This issue affects jQuery TwentyTwenty: from n/a through = 1.0...

CVE-2025-22545 WordPress iframe to embed plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in sw.galati iframe to embed iframe-to-embed allows Stored XSS.This issue affects iframe to embed: from n/a through = 1.2...

CVE-2025-22545 WordPress iframe to embed plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in sw-galati.ro iframe to embed allows Stored XSS.This issue affects iframe to embed: from n/a through 1.2...

CVE-2025-22559 WordPress TubePress.NET Plugin <= 4.0.1 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in tubepress TubePress.NET tubepressnet allows Cross Site Request Forgery.This issue affects TubePress.NET: from n/a through = 4.0.1...

CVE-2025-22591 WordPress 1003 Mortgage Application plugin <= 1.87 - Broken Access Control vulnerability

Missing Authorization vulnerability in Lenderd 1003 Mortgage Application allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 1003 Mortgage Application: from n/a through 1.87...

CVE-2025-22593 WordPress Laika Pedigree Tree plugin <= 1.4 - CSRF to Stored XSS vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in burria Laika Pedigree Tree laika-pedigree-tree allows Stored XSS.This issue affects Laika Pedigree Tree: from n/a through = 1.4...

CVE-2024-12738

CVE-2024-12738 (User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor) is a WordPress plugin vulnerability: stored XSS via several user meta parameters, affecting all versions up to 3.12.9. The issue is unauthenticated and can execute scripts when users view i...

CVE-2024-12532

The BWD Elementor Addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.18 in widgets/bwdeb-content-switcher.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive...

CVE-2024-12316

The Jupiter X Core plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportpopupaction function in all versions up to, and including, 4.8.5. This makes it possible for unauthenticated attackers to export popup templates...

CVE-2024-11826

The CVE-2024-11826 entry refers to The Quill Forms WordPress plugin, where a Stored Cross-Site Scripting vulnerability exists in the quillforms-popup shortcode for all versions up to and including 3.10.0. Exploitation requires authenticated access at contributor level or higher, with the attacker...

CVE-2024-11826 Quill Forms | The Best Typeform Alternative | Create Conversational Multi Step Form, Survey, Quiz, Cost Estimation or Donation Form on WordPress <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Quill Forms | The Best Typeform Alternative | Create Conversational Multi Step Form, Survey, Quiz, Cost Estimation or Donation Form on WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'quillforms-popup' shortcode in all versions up to, and including...

CVE-2024-12033 Jupiter X Core <= 4.8.5 - Missing Authorization to Authenticated Library Sync

The Jupiter X Core plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the synclibraries function in all versions up to, and including, 4.8.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to sync libraries...

CVE-2024-12532 BWD Elementor Addons <= 4.3.18 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates

The BWD Elementor Addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.18 in widgets/bwdeb-content-switcher.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive...

CVE-2024-12532

CVE-2024-12532 affects the WordPress plugin BWD Elementor Addons (WordPress) up to version 4.3.18 . The vulnerability is a Sensitive Information Exposure in the file widgets/bwdeb-content-switcher.php, enabling authenticated attackers with at least Contributor privileges to extract sensitive data...