6505 matches found
WordPress Photo Express for Google plugin <= 0.3.2 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Photo Express for Google versions = 0.3.2...
WordPress Off-Canvas Sidebars & Menus (Slidebars) plugin <= 0.5.8.4 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by domiee13 in WordPress Plugin Off-Canvas Sidebars & Menus Slidebars versions = 0.5.8.4...
WordPress WP Optimize By xTraffic plugin <= 5.1.6 - PHP Object Injection Vulnerability
PHP Object Injection Vulnerability discovered by timomangcut in WordPress Plugin WP Optimize By xTraffic versions = 5.1.6...
WordPress Drag and Drop Multiple File Upload (Pro) - WooCommerce plugin <= 5.0.6 - Arbitrary File Upload Vulnerability
WordPress Drag and Drop Multiple File Upload Pro - WooCommerce plugin = 5.0.6 - Arbitrary File Upload Vulnerability discovered by Bonds in WordPress Plugin Drag and Drop Multiple File Upload Pro - WooCommerce versions = 5.0.6...
WordPress WPKit For Elementor plugin <= 1.1.0 - Arbitrary Option Update to Privilege Escalation vulnerability
Arbitrary Option Update to Privilege Escalation vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin WPKit For Elementor versions = 1.1.0...
CVE-2025-5125
The Custom Post Carousels with Owl WordPress plugin before 1.4.12 uses the featherlight library and makes use of the data-featherlight attribute without sanitizing before using it...
CVE-2025-4479
The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin image comparison widget's before/after labels in all versions up to, and including, 3.5.2 due to insufficient input sanitization and output escaping on user supplied...
CVE-2025-6086
The CSV Me plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'csvmeoptionspage' function in all versions up to, and including, 2.0. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload...
WordPress Trusty Whistleblowing plugin <= 1.5.4 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Hiro Code016Hiro in WordPress Plugin Trusty Whistleblowing versions = 1.5.4...
WordPress eCommerce Product Catalog plugin <= 3.4.3 - PHP Object Injection Vulnerability
PHP Object Injection Vulnerability discovered by mcdruid in WordPress Plugin eCommerce Product Catalog versions = 3.4.3...
CVE-2025-5143
The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tableonpopupiframebutton shortcode in all versions up to, and including, 1.0.4.1 due to insufficient input sanitization and output escaping on user supplied attributes...
CVE-2025-49973
CVE-2025-49973 is a Missing Authorization vulnerability in GrandPlugins Image Sizes Controller, Create Custom Image Sizes, and Disable Image Sizes for WordPress. Affected versions range from 1.0.0 through 1.0.9 (and affected components include Image Sizes Controller, Create Custom Image Sizes, Di...
CVE-2025-49973 WordPress Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes plugin <= 1.0.10 - Broken Access Control Vulnerability
Missing Authorization vulnerability in GrandPlugins Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes image-sizes-controller allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Sizes Controller, Create Custom Image Sizes, Disable...
CVE-2025-49974 WordPress UpStream: a Project Management Plugin for WordPress plugin <= 2.1.1 - Broken Access Control Vulnerability
Missing Authorization vulnerability in upstreamplugin UpStream: a Project Management Plugin for WordPress upstream allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UpStream: a Project Management Plugin for WordPress: from n/a through = 2.1.1...
CVE-2025-49985 WordPress Auto Upload Images plugin <= 3.3.2 - Server Side Request Forgery (SSRF) Vulnerability
Server-Side Request Forgery SSRF vulnerability in Ali Irani Auto Upload Images auto-upload-images allows Server Side Request Forgery.This issue affects Auto Upload Images: from n/a through = 3.3.2...
CVE-2025-49986 WordPress Video List Manager plugin <= 1.7 - Broken Access Control Vulnerability
Missing Authorization vulnerability in thanhtungtnt Video List Manager video-list-manager allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Video List Manager: from n/a through = 1.7...
CVE-2025-49988 WordPress Contact Form 7 AWeber Extension plugin <= 0.1.40 - Broken Access Control vulnerability
Missing Authorization vulnerability in Renzo Johnson Contact Form 7 AWeber Extension integrate-contact-form-7-and-aweber allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form 7 AWeber Extension: from n/a through = 0.1.40...
CVE-2025-49990 WordPress ContentStudio plugin <= 1.3.7 - Broken Access Control vulnerability
Missing Authorization vulnerability in contentstudio Contentstudio contentstudio allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Contentstudio: from n/a through = 1.3.7...
CVE-2025-49991 WordPress WP-Recall plugin <= 16.26.14 - Broken Access Control Vulnerability
Missing Authorization vulnerability in tggfref WP-Recall allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects WP-Recall: from n/a through 16.26.14...