CVE-2025-5533

CVE-2025-5533 affects the WordPress plugin “Knowledge Base” (Knowledge Base) and is exploited via the plugin’s kbalert shortcode . According to the sources, all versions up to and including 2.3.0 are vulnerable due to insufficient input sanitization and output escaping on user-supplied attributes...

CVE-2025-4580

The File Provider WordPress plugin through 1.2.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2025-5733 Modern Events Calendar <= 7.21.9 - Information Exposure

The Modern Events Calendar Lite plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 7.21.9. This is due improper or insufficient validation of the id property when exporting calendars. This makes it possible for unauthenticated attackers to retrieve th...

PT-2025-24183 · WordPress · Wp Live Chat + Chatbots Plugin

Name of the Vulnerable Software and Affected Versions: WP Live Chat + Chatbots Plugin for WordPress – Chaport versions 1.1.5 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored...

PT-2025-24077 · WordPress · Simple History

Name of the Vulnerable Software and Affected Versions: The Simple History plugin for WordPress versions prior to 5.8.1 Description: The issue concerns sensitive data exposure due to improper sanitization within the append debug info to context function when Detective Mode is enabled. This allows...

WordPress plugin Global Translator 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerability...

PT-2025-24035 · WordPress · Wp Email Debug

Name of the Vulnerable Software and Affected Versions: WP Email Debug plugin for WordPress versions 1.0 to 1.1.0 Description: The issue is related to a missing capability check on the WPMDBUG handle settings function. This allows unauthenticated attackers to enable debugging, send all emails to a...

WordPress StageShow plugin <= 10.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via anchor Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via anchor Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin StageShow versions = 10.0.3...

WordPress Hive Support plugin <= 1.2.5 - Cross-Site Request Forgery via hs_update_ai_chat_settings Function vulnerability

Cross-Site Request Forgery via hsupdateaichatsettings Function vulnerability discovered by Vo Thi Ngoc Nhi in WordPress Plugin Hive Support versions = 1.2.5...

Exploit for CVE-2025-0316

CVE-2025-0316-Exploit CVE-2025-0316 Exploit Toolkit 🚨 Auth...

CVE-2025-4671

The Profile Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's usermeta and compare shortcodes in all versions up to, and including, 3.13.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-4392

The Shared Files – Frontend File Upload Form & Secure File Sharing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via html File uploads in all versions up to, and including, 1.7.48 due to insufficient input sanitization and output escaping within the sanitizefile function. This...

CVE-2025-3054

The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadfiles function in all versions up to, and including, 4.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload...

WordPress WP Text Expander plugin <= 1.0.1 - SQL Injection Vulnerability

SQL Injection Vulnerability discovered by Chu The Anh in WordPress Plugin WP Text Expander versions = 1.0.1...

WordPress SEPA Girocode plugin <= 0.5.1 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Chu The Anh Blue Rock in WordPress Plugin SEPA Girocode versions = 0.5.1...

WordPress 6Storage Rentals plugin <= 2.20.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by ghsinfosec in WordPress Plugin 6Storage Rentals versions = 2.20.1...

WordPress No Spam At All plugin <= 1.3 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by ch4r0n in WordPress Plugin No Spam At All versions = 1.3...

WordPress WP Media File Type Manager plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by 0xd4rk5id3 in WordPress Plugin WP Media File Type Manager versions = 2.3.1...

WordPress Recent Posts Slider Responsive plugin <= 1.0.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Recent Posts Slider Responsive versions = 1.0.1...

WordPress Behance Portfolio Manager plugin <= 1.7.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nguyen Tran Tuan Dung domiee13 in WordPress Plugin Behance Portfolio Manager versions = 1.7.5...