CVE-2025-53290 WordPress WP Visual Sitemap plugin <= 1.0.2 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in MS WP Visual Sitemap wp-visual-sitemap allows Stored XSS.This issue affects WP Visual Sitemap: from n/a through = 1.0.2...

CVE-2025-53288

CVE-2025-53288 corresponds to a Missing Authorization vulnerability in the WordPress plugin “PlatiOnline Payments” (versions up to 6.3.2). The issue arises from misconfigured access control, enabling unauthorized access due to insufficient authorization checks. Public details in Patchstack/Red Ha...

CVE-2025-53280

CVE-2025-53280 : Stored Cross-Site Scripting in the WordPress plugin Football Pool (AntoineH)

CVE-2025-53278 WordPress WP AdCenter plugin <= 2.6.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPeka WP AdCenter allows Stored XSS. This issue affects WP AdCenter: from n/a through 2.6.0...

CVE-2025-53274 WordPress WP Permalink Translator plugin <= 1.7.6 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in Hossin Asaadi WP Permalink Translator wp-permalink-translator allows Stored XSS.This issue affects WP Permalink Translator: from n/a through = 1.7.6...

CVE-2025-53269 WordPress My Wp Brand plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in imw3 My Wp Brand my-wp-brand allows Cross Site Request Forgery.This issue affects My Wp Brand: from n/a through = 1.1.3...

CVE-2025-53262 WordPress Writesonic plugin <= 1.0.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Writesonic Writesonic writesonic allows Cross Site Request Forgery.This issue affects Writesonic: from n/a through = 1.0.5...

CVE-2025-53261 WordPress WP YouTube Live plugin <= 1.10.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in macbookandrew WP YouTube Live wp-youtube-live allows Cross Site Request Forgery.This issue affects WP YouTube Live: from n/a through = 1.10.0...

CVE-2025-53260 WordPress File Manager Plugin For Wordpress plugin <= 7.5 - Arbitrary File Upload Vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in getredhawkstudio File Manager Plugin For Wordpress file-manager-plugin-for-wordpress allows Upload a Web Shell to a Web Server.This issue affects File Manager Plugin For Wordpress: from n/a through = 7.5...

CVE-2025-53255 WordPress HurryTimer plugin <= 2.13.1 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Nabil Lemsieh HurryTimer hurrytimer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HurryTimer: from n/a through = 2.13.1...

CVE-2025-53255

CVE-2025-53255 affects HurryTimer (WordPress plugin)

CVE-2025-25171 WordPress WP SmartPay plugin <= 2.7.13 - Account Takeover vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in ThemesGrove WP SmartPay allows Authentication Abuse. This issue affects WP SmartPay: from n/a through 2.7.13...

CVE-2025-25173

CVE-2025-25173 is a stored XSS in WordPress plugin FastBook (FasterThemes)

CVE-2025-27361

CVE-2025-27361 concerns the WordPress plugin “Photo Express for Google” (thhake) with versions

CVE-2025-28960

CVE-2025-28960 : The Evangelische Termine WordPress plugin (regibaer) has a reflected XSS due to improper input neutralization during web page generation. Affected versions are n/a through 3.3. CVSS v3.1 base score 7.1 (HIGH). Exploitation status and patch availability are not detailed in the pro...

CVE-2025-28993

CVE-2025-28993 concerns the WordPress plugin Content No Cache . The vulnerability is an Improper Control of Generation of Code (Code Injection) , allowing an arbitrary function call due to flaws in the plugin’s code generation logic. Affected versions are listed as up to 0.1.3 (n/a through 0.1.3)...

CVE-2025-32298

CVE-2025-32298 concerns the WordPress CTUsers plugin (versions through 1.0.0). The vulnerability is an improper control of the filename used with include/require, i.e., a PHP Remote File Inclusion that enables PHP Local File Inclusion. The issue affects CTUsers up to 1.0.0 and is categorized with...

CVE-2025-32281

CVE-2025-32281 affects the WordPress plugin WPKit For Elementor, version

CVE-2025-50052 WordPress Flexo Counter plugin <= 1.0001 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in flexostudio Flexo Counter flexo-countdown allows Reflected XSS.This issue affects Flexo Counter: from n/a through = 1.0001...

CVE-2025-52726

CVE-2025-52726 (CouponXxL Custom Post Types) is an Privilege Escalation in the CouponXxL Custom Post Types plugin affecting versions up to 3.0 due to Incorrect Privilege Assignment. CVSS 3.1 base score 8.6 (HIGH). Exploitation details are not provided in the sources. Wordfence and Patchstack entr...