6475 matches found
CVE-2025-5565
The Hide It plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'hideit' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...
CVE-2025-5586
The WordPress Ajax Load More and Infinite Scroll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...
CVE-2025-5538
The BNS Featured Category plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bnsfc' shortcode in all versions up to, and including, 2.8.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...
CVE-2025-5018
The Hive Support plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the hsupdateaichatsettings and hivelitesupportgetallbinbox functions in all versions up to, and including, 1.2.5. This makes it possible for authenticated...
CVE-2025-5486 WP Email Debug 1.0 - 1.1.0 - Missing Authorization to Unauthenticated Privilege Escalation via Password Reset
The WP Email Debug plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the WPMDBUGhandlesettings function in versions 1.0 to 1.1.0. This makes it possible for unauthenticated attackers to enable debugging and send all emails to an attacker controlled...
CVE-2025-5565 Hide It <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Hide It plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'hideit' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...
CVE-2025-5541
CVE-2025-5541 (Runners Log, WordPress) Stored XSS vulnerability in the Runners Log plugin (shortcode runnerslog) is present in all versions up to 3.9.2 due to insufficient input sanitization and output escaping of user-supplied attributes. It allows authenticated attackers with contributor-level ...
CVE-2025-5565
The CVE-2025-5565 entry concerns the WordPress plugin Hide It. It is reported as a Stored XSS vulnerability affecting all versions up to 1.0.1 via the hideit shortcode due to insufficient input sanitization and output escaping. Exploitation requires authenticated access at contributor level or hi...
CVE-2025-4964
CVE-2025-4964 applies to WP Online Users Stats for WordPress, with a time-based SQL Injection via the table_name parameter in all versions up to 1.0.0. The root cause is insufficient escaping and lack of proper preparation in the existing SQL query, enabling authenticated attackers with Editor-le...
CVE-2025-5538
The CVE-2025-5538 entry corresponds to a Stored Cross-Site Scripting vulnerability in the WordPress plugin BNS Featured Category, affecting all versions up to 2.8.2. The flaw arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin’s bnsfc shortcod...
CVE-2025-5018
CVE-2025-5018 affects the WordPress Hive Support plugin (<= 1.2.4; Patch references include
CVE-2025-5586
CVE-2025-5586 concerns the WordPress Ajax Load More and Infinite Scroll plugin. The vulnerability is a stored XSS via the id parameter in all versions up to 1.6.0. It requires authentication at Contributor level or higher to inject arbitrary scripts, which then execute in pages loaded by other us...
CVE-2025-5586 WordPress Ajax Load More and Infinite Scroll <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
The WordPress Ajax Load More and Infinite Scroll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...
CVE-2025-5533
CVE-2025-5533 affects the WordPress plugin “Knowledge Base” (Knowledge Base) and is exploited via the plugin’s kbalert shortcode . According to the sources, all versions up to and including 2.3.0 are vulnerable due to insufficient input sanitization and output escaping on user-supplied attributes...
CVE-2025-4580
The File Provider WordPress plugin through 1.2.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
CVE-2025-5733 Modern Events Calendar <= 7.21.9 - Information Exposure
The Modern Events Calendar Lite plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 7.21.9. This is due improper or insufficient validation of the id property when exporting calendars. This makes it possible for unauthenticated attackers to retrieve th...
PT-2025-24035 · WordPress · Wp Email Debug
Name of the Vulnerable Software and Affected Versions: WP Email Debug plugin for WordPress versions 1.0 to 1.1.0 Description: The issue is related to a missing capability check on the WPMDBUG handle settings function. This allows unauthenticated attackers to enable debugging, send all emails to a...
WordPress plugin Global Translator 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerability...
PT-2025-24183 · WordPress · Wp Live Chat + Chatbots Plugin
Name of the Vulnerable Software and Affected Versions: WP Live Chat + Chatbots Plugin for WordPress – Chaport versions 1.1.5 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored...
PT-2025-24077 · WordPress · Simple History
Name of the Vulnerable Software and Affected Versions: The Simple History plugin for WordPress versions prior to 5.8.1 Description: The issue concerns sensitive data exposure due to improper sanitization within the append debug info to context function when Detective Mode is enabled. This allows...