CVE-2025-7725

The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the comment feature in all versions up to, and including, 26.1.0 due to...

CVE-2025-7710

CVE-2025-7710 affects the Brave Conversion Engine (PRO) WordPress plugin. The vulnerability is an authentication bypass arising from improper restriction of a claimed identity during Facebook authentication, enabling unauthenticated attackers to log in as other users, including administrators, in...

CVE-2025-8488

The Ultimate Addons for Elementor Formerly Elementor Header & Footer Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the savehfecompatibilityoptioncallback function in all versions up to, and including, 2.4.6. This makes it...

CVE-2025-8400

The Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will...

CVE-2025-8391 Magic Edge – Lite <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via height Parameter

The Magic Edge – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘height’ parameter in all versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2025-6832

CVE-2025-6832 describes a reflected cross-site scripting vulnerability in the WordPress plugin "All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier" (versions up to 2.0). According to Wordfence and CVE sources, the issue stems from insufficient input sanitization and output ...

CVE-2025-8317

The Custom Word Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘angle’ parameter in all versions up to, and including, 0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

PT-2025-31730 · WordPress · The Magic Edge – Lite

Name of the Vulnerable Software and Affected Versions: The Magic Edge – Lite plugin for WordPress versions up to and including 1.1.6 Description: The Magic Edge – Lite plugin for WordPress is susceptible to Stored Cross-Site Scripting via the height parameter due to insufficient input sanitizatio...

WordPress All in One Time Clock Lite plugin <= 2.0 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin All in One Time Clock Lite versions = 2.0...

CVE-2025-4684

The BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site Imports, No Coding Needed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML attributes of Image Carousel and Image...

CVE-2025-4684 BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites <= 3.2.13.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Carousel and Image Slider Widgets

The BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site Imports, No Coding Needed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML attributes of Image Carousel and Image...

CVE-2025-5921

The SureForms WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against both authenticated and unauthenticated users...

CVE-2025-5954

The Service Finder SMS System plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0. This is due to the plugin not restricting user role selection at the time of registration through the aonesmsfnsavedataaftersignup function...

PT-2025-31603 · WordPress · Youtube +8

Name of the Vulnerable Software and Affected Versions: Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI plugin for WordPress versions prior to 26.1.0 Description: The WordPress plugin is susceptib...

WordPress Sina Extension for Elementor plugin <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via `Sina Posts`, `Sina Blog Post` and `Sina Table` Widgets vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Sina Posts, Sina Blog Post and Sina Table Widgets vulnerability discovered by stealthcopter in WordPress Plugin Sina Extension for Elementor versions = 3.7.0...

WordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zer0gh0st in WordPress Plugin The Plus Addons for Elementor Page Builder Lite versions = 6.3.10...

WordPress HT Mega plugin <= 2.9.1 - Authenticated (Author+) Sensitive Information Exposure vulnerability

Authenticated Author+ Sensitive Information Exposure vulnerability discovered by wesley wcraft in WordPress Plugin HT Mega versions = 2.9.1...

WordPress HT Mega plugin <= 2.9.1 - Improper Authorization to Authenticated (Contributor+) Limited Administrator Actions vulnerability

Improper Authorization to Authenticated Contributor+ Limited Administrator Actions vulnerability discovered by wesley wcraft in WordPress Plugin HT Mega versions = 2.9.1...

WordPress Auteur Framework plugin <= 7.1 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting

Missing Authorization to Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Lucio Sá in WordPress Plugin Auteur Framework versions = 7.1...

WordPress Benaa Framework plugin <= 4.0.0 - Missing Authorization to Authenticated (Subscriber+) Settings Updates vulnerability

Missing Authorization to Authenticated Subscriber+ Settings Updates vulnerability discovered by Lucio Sá in WordPress Plugin Benaa Framework versions = 4.0.0...