CVE-2025-7431 Knowledge Base <= 2.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Slug

The Knowledge Base plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin slug setting in all versions up to, and including, 2.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

WordPress Plugin BeeTeam368 Extensions Code Issue Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability exists in the WordPress plugin BeeTeam368 Extensions, which stems from a lack...

PT-2025-29987 · WordPress · Plugin Pengiriman Woocommerce Kurir Reguler

Name of the Vulnerable Software and Affected Versions: Plugin Pengiriman WooCommerce Kurir Reguler, Instan, Kargo – Biteship versions through 3.2.0 Description: The Plugin Pengiriman WooCommerce Kurir Reguler, Instan, Kargo – Biteship for WordPress is susceptible to an Insecure Direct Object...

PT-2025-30002 · WordPress · Terms Descriptions

Name of the Vulnerable Software and Affected Versions: Terms descriptions plugin for WordPress versions prior to 3.4.9 Description: The Terms descriptions plugin for WordPress is susceptible to Stored Cross-Site Scripting through admin settings. Insufficient input sanitization and output escaping...

WordPress Broken Link Notifier plugin code execution vulnerability

WordPress Broken Link Notifier plugin is a plugin for monitoring broken links e.g. 404 errors, timeout links, etc. within a website. A code execution vulnerability exists in the WordPress Broken Link Notifier plugin that stems from the possibility of embedding malicious input when exporting CSV...

WordPress Stop User Enumeration plugin < 1.7.3 - Protection Bypass vulnerability

Protection Bypass vulnerability discovered by Stan, Chin Siang Leow in WordPress Plugin Stop User Enumeration versions 1.7.3...

WordPress Transposh WordPress Translation plugin <= 1.0.7 - Unauthenticated Stored Cross-Site Scripting via 'tp_translation' vulnerability

Unauthenticated Stored Cross-Site Scripting via 'tptranslation' vulnerability discovered by Julien Ahrens in WordPress Plugin Transposh WordPress Translation versions = 1.0.7...

WordPress WooCommerce Shop Page Builder <= 2.27.7 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin WooCommerce Shop Page Builder versions = 2.27.7...

WordPress Apollo - Sticky Full Width HTML5 Audio Player <= 3.4 - Cross Site Scripting (XSS) Vulnerability

WordPress Apollo - Sticky Full Width HTML5 Audio Player = 3.4 - Cross Site Scripting XSS Vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Apollo - Sticky Full Width HTML5 Audio Player versions = 3.4...

CVE-2025-7341

The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the tempfiledelete function in all versions up to, and including, 2.2.1. This makes it possible for...

CVE-2025-7712

The Madara - Core plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wpmangadeletezip function in all versions up to, and including, 2.2.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, whic...

CVE-2025-5396

CVE-2025-5396 affects the Bears Backup plugin for WordPress (all versions up to 2.0.0). Root cause: bbackup_ajax_handle() lacks a capability check and passes unsanitized input directly to call_user_func(), enabling unauthenticated remote code execution. Impact includes potential backdoors or crea...

WordPress Image Wall plugin <= 3.1 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Peter Thaleikis in WordPress Plugin Image Wall versions = 3.1...

WordPress Wallet System for WooCommerce plugin <= 2.6.7 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Wallet System for WooCommerce versions = 2.6.7...

WordPress Newsletters plugin <= 4.10 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Newsletters versions = 4.10...

WordPress CM Pop-Up banners plugin <= 1.8.4 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Bao BlueRock in WordPress Plugin CM Pop-Up banners versions = 1.8.4...

WordPress Videopack plugin <= 4.10.3 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by 63n0 in WordPress Plugin Videopack versions = 4.10.3...

WordPress JetSmartFilters plugin <= 3.6.8 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by stealthcopter in WordPress Plugin JetSmartFilters versions = 3.6.8...

WordPress Bold Page Builder plugin <= 5.4.1 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by theviper17 in WordPress Plugin Bold Page Builder versions = 5.4.1...

WordPress JetFormBuilder plugin <= 3.5.1.2 - PHP Object Injection Vulnerability

PHP Object Injection Vulnerability discovered by Que Thanh Tuan Blue Rock in WordPress Plugin JetFormBuilder versions = 3.5.1.2...