6505 matches found
WordPress JKDEVKIT plugin <= 1.9.4 - Authenticated (Subscriber+) Arbitrary File Deletion vulnerability
Authenticated Subscriber+ Arbitrary File Deletion vulnerability discovered by Foxyyy in WordPress Plugin JKDEVKIT versions = 1.9.4...
CVE-2025-23968 WordPress AiBud WP plugin <= 1.9 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in WebFactory AiBud WP aibuddy-openai-chatgpt allows Upload a Web Shell to a Web Server.This issue affects AiBud WP: from n/a through = 1.9...
CVE-2025-23968
CVE-2025-23968 affects the WordPress AiBud WP plugin (AiBud OpenAI ChatGPT integration) versions up to 1.8.5. A REST API route at /wp-json/ai-buddy/v1/wp/attachments permits uploading attachments; the renaming logic (via the filename parameter) can change the uploaded file’s name to a PHP extensi...
WordPress Paytiko for WooCommerce plugin <= 1.3.21 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Paytiko for WooCommerce versions = 1.3.21...
WordPress WC Pickup Store plugin <= 1.8.9 - Settings Change Vulnerability
Settings Change Vulnerability discovered by Mika in WordPress Plugin WC Pickup Store versions = 1.8.9...
PT-2025-27805 · WordPress · Wpvivid Backup/Migration
Name of the Vulnerable Software and Affected Versions: Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress versions up to, and including, 0.9.116 Description: The issue is related to arbitrary file uploads due to missing file type validation in the wpvivid upload import...
CVE-2025-2330
CVE-2025-2330 involves the WordPress plugin All-in-One Addons for Elementor – WidgetKit. It presents a Stored Cross-Site Scripting (XSS) in the widget called “button+modal,” due to insufficient input sanitization and output escaping of user-supplied attributes. Affected products: All-in-One Addon...
CVE-2025-6687
The Magic Buttons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's magic-button shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on the 'icon' user supplied attributes. This makes it...
CVE-2025-4381
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the ‘$id’ variable of the getSpace function in all versions up to, and including, 4.89 due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2025-3848
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2025-25171. Reason: This candidate is a reservation duplicate of CVE-2025-25171. Notes: All CVE users should reference CVE-2025-25171 instead of this candidate. All references and descriptions in this candidate have been...
CVE-2025-4689
The CVE-2025-4689 entry concerns Ads Pro Plugin for WordPress (Advertising Manager). The connected sources confirm a vulnerability chain: an unauthenticated Local File Inclusion (LFI) that can lead to Remote Code Execution (RCE), triggered by a prior SQL Injection, within all versions up to 4.89....
PT-2025-27588 · WordPress · Soumettre.Fr
Name of the Vulnerable Software and Affected Versions: Soumettre.fr plugin for WordPress versions up to, and including, 2.1.5 Description: The issue is related to improper authorization checks on the make signature function, allowing unauthorized access and modification of data. This enables...
PT-2025-27592 · WordPress · Drag/Drop Multiple File Upload
Name of the Vulnerable Software and Affected Versions: Drag and Drop Multiple File Upload Pro - WooCommerce plugin for WordPress versions 1.7.1 and earlier Drag and Drop Multiple File Upload Pro - WooCommerce plugin for WordPress versions 5.0 through 5.0.5 when bundled with the PrintSpace theme...
WordPress Forminator plugin <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion vulnerability
Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin Forminator versions = 1.44.2...
WordPress Soumettre.fr plugin <= 2.1.5 - Improper Authorization to Unauthenticated Soumettre Posts Creation/Modification/Deletion vulnerability
Improper Authorization to Unauthenticated Soumettre Posts Creation/Modification/Deletion vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Soumettre.fr versions = 2.1.5...
WordPress CSS3 Vertical Web Pricing Tables plugin <= 1.9 - Cross Site Scripting (XSS) Vulnerability
Cross Site Scripting XSS Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin CSS3 Vertical Web Pricing Tables versions = 1.9...
CVE-2025-49029 WordPress Custom Login And Signup Widget plugin <= 1.0 - Arbitrary Code Execution vulnerability
Improper Control of Generation of Code 'Code Injection' vulnerability in bitto.kazi Custom Login And Signup Widget custom-login-and-signup-widget allows Code Injection.This issue affects Custom Login And Signup Widget: from n/a through = 1.0...
WordPress Custom Login And Signup Widget plugin <= 1.0 - Arbitrary Code Execution vulnerability
Arbitrary Code Execution vulnerability discovered by Bao Patchstack Alliance in WordPress Plugin Custom Login And Signup Widget versions = 1.0...
WordPress SureForms plugin <= 1.7.3 - Unauthenticated Arbitrary File Deletion
Unauthenticated Arbitrary File Deletion vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin SureForms versions = 1.7.3...