WordPress Omnishop plugin <= 1.0.9 - Cross-Site Request Forgery to Arbitrary User Deletion via /users/delete REST Endpoint vulnerability

Cross-Site Request Forgery to Arbitrary User Deletion via /users/delete REST Endpoint vulnerability discovered by ch4r0n in WordPress Plugin Omnishop versions = 1.0.9...

WordPress Valuation Calculator plugin <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via link Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via link Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin Valuation Calculator versions = 1.3.2...

WordPress Fleetwire Fleet Management Plugin plugin <= 1.0.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via fleetwire_list Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via fleetwirelist Shortcode vulnerability discovered by Gilang in WordPress Plugin Fleetwire Fleet Management versions = 1.0.19...

WordPress Shortcodes Ultimate plugin <= 7.4.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title and Slide Link vulnerability

Authenticated Author+ Stored Cross-Site Scripting via Image Title and Slide Link vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Shortcodes Ultimate versions = 7.4.2...

WordPress Tablesome Table Premium <= 1.1.23 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Jamie Davies in WordPress Plugin Tablesome Table Premium versions = 1.1.23...

CVE-2025-7685

The Like & Share My Site plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2. This is due to missing or incorrect nonce validation on the 'lsmsadmin' page. This makes it possible for unauthenticated attackers to update settings and inject...

CVE-2025-6082

The Birth Chart Compatibility plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0. This is due to insufficient protection against directly accessing the plugin's index.php file, which causes an error exposing the full path. This makes it possible f...

CVE-2025-6187 bSecure 1.3.7 - 1.7.9 - Missing Authorization to Unauthenticated Privilege Escalation via order_info REST Endpoint

The bSecure plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within its orderinfo REST endpoint in versions 1.3.7 through 1.7.9. The plugin registers the /webhook/v2/orderinfo/ route with a permissioncallback that always returns true, effectively bypassing a...

CVE-2025-6082 Birth Chart Compatibility <= 2.0 - Unauthenticated Full Path Exposure

The Birth Chart Compatibility plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0. This is due to insufficient protection against directly accessing the plugin's index.php file, which causes an error exposing the full path. This makes it possible f...

CVE-2025-6082

The CVE-2025-6082 vulnerability affects the Birth Chart Compatibility WordPress plugin (versions up to 2.0). The root cause is an information-disclosure flaw that allows unauthenticated users to directly access the plugin’s index.php, triggering PHP warnings/fatal errors and revealing the server’...

CVE-2025-7687

The CVE-2025-7687 entry concerns the WordPress plugin Latest Post Accordian Slider. A CSRF vulnerability exists in all versions up to 1.3 due to missing/incorrect nonce validation on the lpaccordian page. This enables unauthenticated attackers to update settings and inject malicious scripts throu...

CVE-2025-7687 Latest Post Accordian Slider <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Latest Post Accordian Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3. This is due to missing or incorrect nonce validation on the 'lpaccordian' page. This makes it possible for unauthenticated attackers to update settings and...

CVE-2025-6585

The WP JobHunt plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 7.2 via the csremoveprofilecallback function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2025-5240 CRM and Lead Management by vcita <= 2.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via type Parameter

The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘type’ parameter in all versions up to, and including, 2.7.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2025-30385 · WordPress · Birth Chart Compatibility

Name of the Vulnerable Software and Affected Versions: Birth Chart Compatibility plugin for WordPress versions prior to 2.1 Description: The Birth Chart Compatibility plugin for WordPress is susceptible to full path disclosure due to insufficient protection against direct access to the plugin's...

PT-2025-30378 · WordPress · Wp Jobhunt

Name of the Vulnerable Software and Affected Versions: WP JobHunt versions prior to 7.3 Description: The WP JobHunt plugin for WordPress is susceptible to an Insecure Direct Object Reference issue in all versions up to and including 7.2, specifically within the cs remove profile callback function...

PT-2025-30383 · WordPress · Conditional Fields +3

Name of the Vulnerable Software and Affected Versions: Extensions For CF7 versions up to and including 3.2.8 Description: The Extensions For CF7 Contact form 7 Database, Conditional Fields and Redirection plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path...

PT-2025-30388 · WordPress · Like & Share My Site

Name of the Vulnerable Software and Affected Versions: Like & Share My Site plugin for WordPress versions prior to 0.3 Description: The plugin is susceptible to Cross-Site Request Forgery CSRF due to missing or incorrect nonce validation on the lsms admin page. This allows unauthenticated attacke...

PT-2025-30369 · WordPress · Crm/Lead Management By Vcita

Name of the Vulnerable Software and Affected Versions: CRM and Lead Management by vcita plugin for WordPress versions through 2.7.5 Description: The plugin is susceptible to Stored Cross-Site Scripting through the type parameter due to inadequate input sanitization and output escaping...

WordPress Latest Post Accordian Slider plugin <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability

Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability discovered by johska in WordPress Plugin Latest Post Accordian Slider versions = 1.3...