6505 matches found
CVE-2025-6976 Events Manager <= 7.0.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 7.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes ...
WordPress Lana Downloads Manager plugin <= 1.10.0 - Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability
Authenticated Administrator+ Stored Cross-Site Scripting vulnerability discovered by István Márton in WordPress Plugin Lana Downloads Manager versions = 1.10.0...
WordPress Easy Contact Form Lite plugin <= 1.1.28 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Krugov Artyom in WordPress Plugin Easy Contact Form Lite versions = 1.1.28...
CVE-2025-7059
The Simple Featured Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slideshow’ parameter in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2025-7059
CVE-2025-7059 : The Simple Featured Image WordPress plugin (versions
CVE-2025-34084
The CVE CVE-2025-34084 affects the WordPress Total Upkeep (BoldGrid Backup) plugin. Affected versions are up to and including 1.14.9 (and prior to 1.14.10 per RH) and expose sensitive backup information via env-info.php and restore-info.json without authentication. Attackers can locate backup fil...
CVE-2025-4828
The Support Board plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the sbfiledelete function in all versions up to, and including, 3.8.0. This makes it possible for attackers to delete arbitrary files on the server, which can easily lead to...
CVE-2025-4855
The Support Board plugin for WordPress is vulnerable to unauthorized access/modification/deletion of data due to use of hardcoded default secrets in the sbencryption function in all versions up to, and including, 3.8.0. This makes it possible for unauthenticated attackers to bypass authorization...
CVE-2025-4828
The CVE-2025-4828 entry concerns the WordPress Support Board plugin, where arbitrary file deletion is possible due to insufficient file path validation in sb_file_delete across all versions up to 3.8.0. This can lead to remote code execution when critical files (e.g., wp-config.php) are deleted. ...
CVE-2025-4855
CVE-2025-4855 concerns the WordPress plugin Support Board. Multiple sources confirm a vulnerability in all versions up to 3.8.0 where hardcoded default secrets in sb_encryption() enable unauthenticated bypass of authorization and the execution of arbitrary AJAX actions via sb_ajax_execute(). This...
WordPress Simple Featured Image plugin <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via slideshow Parameter vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via slideshow Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin Simple Featured Image versions = 1.3.1...
WordPress Support Board plugin <= 3.8.0 - Unauthenticated Arbitrary File Deletion vulnerability
Unauthenticated Arbitrary File Deletion vulnerability discovered by Foxyyy in WordPress Plugin Support Board versions = 3.8.0...
WordPress Pakke Envíos plugin <= 1.0.2 - SQL Injection Vulnerability
SQL Injection Vulnerability discovered by Nguyen Kim Sang in WordPress Plugin Pakke Envíos versions = 1.0.2...
WordPress Internal Linking of Related Contents plugin <= 1.1.8 - Broken Access Control Vulnerability
Broken Access Control Vulnerability discovered by astra.r3verii Patchstack Alliance in WordPress Plugin Internal Linking of Related Contents versions = 1.1.8...
CVE-2025-7327
CVE-2025-7327 – Widget for Google Reviews (WordPress) is a directory traversal vulnerability in all versions up to and including 1.0.15. An authenticated attacker with Subscriber-level access or higher can abuse the layout parameter to include and execute arbitrary PHP files on the server, enabli...
CVE-2025-5537
The Lightbox & Modal Popup WordPress Plugin – FooBox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alternative texts in all versions up to, and including, 2.7.34 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...