WordPress Cloud SAML SSO - Single Sign On Login <= 1.0.18 - Local File Inclusion Vulnerability

WordPress Cloud SAML SSO - Single Sign On Login = 1.0.18 - Local File Inclusion Vulnerability discovered by timomangcut in WordPress Plugin Cloud SAML SSO - Single Sign On Login versions = 1.0.18...

WordPress The Plus Addons for Elementor Pro plugin < 6.3.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin The Plus Addons for Elementor Pro versions 6.3.7...

WordPress Youtube Vimeo Video Player and Slider <= 3.8 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Youtube Vimeo Video Player and Slider versions = 3.8...

CVE-2025-24759 WordPress WP-BusinessDirectory <= 3.1.3 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in CMSJunkie - WordPress Business Directory Plugins WP-BusinessDirectory allows Blind SQL Injection. This issue affects WP-BusinessDirectory: from n/a through 3.1.3...

CVE-2025-28982

CVE-2025-28982 concerns WordPress plugin WP Pipes (ThimPress WP Pipes). The vulnerability is an SQL Injection caused by improper neutralization of special elements in SQL commands, affecting WP Pipes versions up to 1.4.3. The CVSS data in the primary record indicates a CRITICAL impact with high c...

CVE-2025-47652 WordPress Infility Global plugin <= 2.13.4 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Infility Infility Global infility-global allows Reflected XSS.This issue affects Infility Global: from n/a through = 2.13.4...

CVE-2025-49031 WordPress SMu Manual DoFollow plugin <= 1.8.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Stefan M. SMu Manual DoFollow manuall-dofollow allows Reflected XSS.This issue affects SMu Manual DoFollow: from n/a through = 1.8.1...

CVE-2025-49884 WordPress Internal Linking of Related Contents plugin <= 1.1.8 - Broken Access Control Vulnerability

Missing Authorization vulnerability in alexvtn Internal Linking of Related Contents internal-linking-of-related-contents allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Internal Linking of Related Contents: from n/a through = 1.1.8...

CVE-2025-50028 WordPress Ultimate Push Notifications plugin <= 1.2.0 - Broken Access Control Vulnerability

Missing Authorization vulnerability in CodeSolz Ultimate Push Notifications ultimate-push-notifications allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Push Notifications: from n/a through = 1.2.0...

CVE-2025-49888 WordPress PW WooCommerce On Sale! plugin <= 1.39 - Broken Access Control Vulnerability

Missing Authorization vulnerability in pimwick PW WooCommerce On Sale! allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PW WooCommerce On Sale!: from n/a through 1.39...

CVE-2025-50028 WordPress Ultimate Push Notifications plugin <= 1.2.0 - Broken Access Control Vulnerability

Missing Authorization vulnerability in CodeSolz Ultimate Push Notifications ultimate-push-notifications allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Push Notifications: from n/a through = 1.2.0...

WordPress Formality <= 1.5.9 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by astra.r3verii in WordPress Plugin Formality versions = 1.5.9...

WordPress JetSmartFilters <= 3.6.7 - Sensitive Data Exposure Vulnerability

Sensitive Data Exposure Vulnerability discovered by stealthcopter in WordPress Plugin JetSmartFilters versions = 3.6.7...

CVE-2025-48150

CVE-2025-48150 is a Missing Authorization / Broken Access Control vulnerability affecting the WordPress plugin “Real Estate Property 2024 Create Your Own Fields and Search Bar” (versions through 4.48). Multiple connected sources confirm that improper access control configuration can be exploited ...

CVE-2025-48155

CVE-2025-48155 concerns the WordPress plugin “Residential Address Detection” by enituretechnology. The issue is a Missing Authorization vulnerability that allows accessing functionality not properly constrained by ACLs, affecting versions through 2.5.9. The CVSS v3.1 base score is 5.3 (Medium), w...

CVE-2025-54047 WordPress Cost Calculator plugin <= 7.4 - Broken Access Control Vulnerability

Missing Authorization vulnerability in QuanticaLabs Cost Calculator ql-cost-calculator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cost Calculator: from n/a through = 7.4...

CVE-2025-54047 WordPress Cost Calculator plugin <= 7.4 - Broken Access Control Vulnerability

Missing Authorization vulnerability in QuanticaLabs Cost Calculator allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Cost Calculator: from n/a through 7.4...

CVE-2025-54015 WordPress HT Contact Form 7 plugin <= 2.0.0 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in HT Plugins HT Contact Form 7 ht-contactform allows PHP Local File Inclusion.This issue affects HT Contact Form 7: from n/a through = 2.0.0...

CVE-2025-54013 WordPress Welcart e-Commerce plugin <= 2.11.16 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Stored XSS.This issue affects Welcart e-Commerce: from n/a through = 2.11.16...

CVE-2025-53982

CVE-2025-53982 describes a stored XSS vulnerability in Crocoblock JetElements For Elementor, affecting JetElements For Elementor versions up to 2.7.7. The issue stems from improper neutralization of input during web page generation, enabling stored cross-site scripting. Exploitation could occur i...