CVE-2025-27361

CVE-2025-27361 concerns the WordPress plugin “Photo Express for Google” (thhake) with versions

CVE-2025-28960

CVE-2025-28960 : The Evangelische Termine WordPress plugin (regibaer) has a reflected XSS due to improper input neutralization during web page generation. Affected versions are n/a through 3.3. CVSS v3.1 base score 7.1 (HIGH). Exploitation status and patch availability are not detailed in the pro...

CVE-2025-28993

CVE-2025-28993 concerns the WordPress plugin Content No Cache . The vulnerability is an Improper Control of Generation of Code (Code Injection) , allowing an arbitrary function call due to flaws in the plugin’s code generation logic. Affected versions are listed as up to 0.1.3 (n/a through 0.1.3)...

CVE-2025-32281

CVE-2025-32281 affects the WordPress plugin WPKit For Elementor, version

CVE-2025-32298

CVE-2025-32298 concerns the WordPress CTUsers plugin (versions through 1.0.0). The vulnerability is an improper control of the filename used with include/require, i.e., a PHP Remote File Inclusion that enables PHP Local File Inclusion. The issue affects CTUsers up to 1.0.0 and is categorized with...

CVE-2025-50052 WordPress Flexo Counter plugin <= 1.0001 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in flexostudio Flexo Counter flexo-countdown allows Reflected XSS.This issue affects Flexo Counter: from n/a through = 1.0001...

CVE-2025-52726

CVE-2025-52726 (CouponXxL Custom Post Types) is an Privilege Escalation in the CouponXxL Custom Post Types plugin affecting versions up to 3.0 due to Incorrect Privilege Assignment. CVSS 3.1 base score 8.6 (HIGH). Exploitation details are not provided in the sources. Wordfence and Patchstack entr...

CVE-2025-52809 WordPress National Weather Service Alerts plugin <= 1.3.5 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in John Russell National Weather Service Alerts national-weather-service-alerts allows PHP Local File Inclusion.This issue affects National Weather Service Alerts: from n/a through ...

CVE-2025-52818

CVE-2025-52818 is a Missing Authorization vulnerability in the WordPress plugin Trusty Whistleblowing . The initial entry indicates impact on versions from unknown (n/a) up to 1.5.2 , with a CVSS v3.1 base score of 8.2 (High) , vulnerability class “Missing Authorization,” and a network attack vec...

CVE-2025-23973 WordPress SpecFit-Virtual Try On Woocommerce plugin <= 8.0.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in dugudlabs SpecFit-Virtual Try On Woocommerce try-on-for-woocommerce allows Stored XSS.This issue affects SpecFit-Virtual Try On Woocommerce: from n/a through = 8.0.3...

CVE-2025-49448 WordPress FW Food Menu plugin <= 6.0.0 - Arbitrary File Deletion Vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Fastw3b LLC FW Food Menu allows Path Traversal. This issue affects FW Food Menu : from n/a through 6.0.0...

WordPress The Pack Elementor addon plugin <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by stealthcopter in WordPress Plugin The Pack Elementor addons versions = 2.1.4...

CVE-2025-5927

The Everest Forms Pro plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteentryfiles function in all versions up to, and including, 1.9.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server,...

WordPress Responsive Lightbox & Gallery plugin < 2.5.2 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Pierre Rudloff in WordPress Plugin Responsive Lightbox versions 2.5.2...

CVE-2025-5194

The WP Map Block WordPress plugin (versions prior to 2.0.3 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly validate and escape certain block options before they are rendered in a page or post. This flaw could be exploited by users with the contribu...

PT-2025-27053 · WordPress · Wp Map Block

Name of the Vulnerable Software and Affected Versions: WP Map Block versions prior to 2.0.3 Description: The issue concerns the WP Map Block WordPress plugin, which does not validate and escape some of its block options before outputting them back in a page or post where the block is embedded. Th...

WordPress eDS Responsive Menu plugin Improper Access Control Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. An improper access control vulnerability exists in the WordPress eDS Responsive Menu plugin, which stems from a lack of authorization, and no detailed vulnerability details are...

WordPress Buying Buddy IDX CRM plugin Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. The WordPress Buying Buddy IDX CRM plugin suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of...

PT-2025-27068 · WordPress · Simple Payment

Name of the Vulnerable Software and Affected Versions: Simple Payment plugin for WordPress versions 1.3.6 through 2.3.8 Description: The issue is related to Authentication Bypass, which occurs because the plugin does not properly verify a user's identity prior to logging them in through the creat...

WordPress VR Calendar plugin <= 2.4.7 - Cross-Site Request Forgery to Calendar Sync vulnerability

Cross-Site Request Forgery to Calendar Sync vulnerability discovered by Nabil Irawan in WordPress Plugin VR Calendar versions = 2.4.7...