6474 matches found
CVE-2025-4855
The Support Board plugin for WordPress is vulnerable to unauthorized access/modification/deletion of data due to use of hardcoded default secrets in the sbencryption function in all versions up to, and including, 3.8.0. This makes it possible for unauthenticated attackers to bypass authorization...
CVE-2025-4828
The Support Board plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the sbfiledelete function in all versions up to, and including, 3.8.0. This makes it possible for attackers to delete arbitrary files on the server, which can easily lead to...
CVE-2025-4828
The CVE-2025-4828 entry concerns the WordPress Support Board plugin, where arbitrary file deletion is possible due to insufficient file path validation in sb_file_delete across all versions up to 3.8.0. This can lead to remote code execution when critical files (e.g., wp-config.php) are deleted. ...
CVE-2025-4855
CVE-2025-4855 concerns the WordPress plugin Support Board. Multiple sources confirm a vulnerability in all versions up to 3.8.0 where hardcoded default secrets in sb_encryption() enable unauthenticated bypass of authorization and the execution of arbitrary AJAX actions via sb_ajax_execute(). This...
WordPress Simple Featured Image plugin <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via slideshow Parameter vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via slideshow Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin Simple Featured Image versions = 1.3.1...
WordPress Support Board plugin <= 3.8.0 - Unauthenticated Arbitrary File Deletion vulnerability
Unauthenticated Arbitrary File Deletion vulnerability discovered by Foxyyy in WordPress Plugin Support Board versions = 3.8.0...
WordPress Pakke Envíos plugin <= 1.0.2 - SQL Injection Vulnerability
SQL Injection Vulnerability discovered by Nguyen Kim Sang in WordPress Plugin Pakke Envíos versions = 1.0.2...
WordPress Internal Linking of Related Contents plugin <= 1.1.8 - Broken Access Control Vulnerability
Broken Access Control Vulnerability discovered by astra.r3verii Patchstack Alliance in WordPress Plugin Internal Linking of Related Contents versions = 1.1.8...
CVE-2025-7327
CVE-2025-7327 – Widget for Google Reviews (WordPress) is a directory traversal vulnerability in all versions up to and including 1.0.15. An authenticated attacker with Subscriber-level access or higher can abuse the layout parameter to include and execute arbitrary PHP files on the server, enabli...
CVE-2025-5537
The Lightbox & Modal Popup WordPress Plugin – FooBox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alternative texts in all versions up to, and including, 2.7.34 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
CVE-2025-5957
The Guest Support – Complete customer support ticket system for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'deleteMassTickets' function in all versions up to, and including, 1.2.2. This makes it possible for unauthenticated...
CVE-2025-5570
The AI Engine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the mwaichatbot shortcode 'id' parameter in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
WordPress Guest Support plugin <= 1.2.2 - Missing Authorization to Unauthenticated Ticket Deletion vulnerability
Missing Authorization to Unauthenticated Ticket Deletion vulnerability discovered by Amin Beheshti in WordPress Plugin Guest Support versions = 1.2.2...
WordPress WP Human Resource Management plugin 2.0.0-2.2.17 - Missing Authorization to Authenticated (Employee+) Privilege Escalation vulnerability
Missing Authorization to Authenticated Employee+ Privilege Escalation vulnerability discovered by kr0d in WordPress Plugin WP Human Resource Management versions 2.0.0-2.2.17...
WordPress Ultimate Push Notifications plugin <= 1.2.0 - Broken Access Control Vulnerability
Broken Access Control Vulnerability discovered by astra.r3verii in WordPress Plugin Ultimate Push Notifications versions = 1.2.0...
WordPress Pay with Contact Form 7 plugin <= 1.0.4 - Cross Site Scripting (XSS) Vulnerability
Cross Site Scripting XSS Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Pay with Contact Form 7 versions = 1.0.4...
WordPress SMu Manual DoFollow plugin <= 1.8.1 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by Nguyen Xuan Chien Patchstack Alliance in WordPress Plugin SMu Manual DoFollow versions = 1.8.1...
WordPress Site Chat on Telegram plugin <= 1.0.4 - PHP Object Injection Vulnerability
PHP Object Injection Vulnerability discovered by Drew / mcdruid in WordPress Plugin Site Chat on Telegram versions = 1.0.4...