WordPress Nexa Blocks plugin <= 1.1.1 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by theviper17 in WordPress Plugin Nexa Blocks versions = 1.1.1...

WordPress Simple Keyword to Link plugin <= 1.5 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Simple Keyword to Link versions = 1.5...

WordPress WP-Recall plugin <= 16.26.14 - CSRF to Privilege Escalation vulnerability

CSRF to Privilege Escalation vulnerability discovered by 0xd4rk5id3 in WordPress Plugin WP-Recall versions = 16.26.14...

WordPress Elite Video Player plugin <= 10.0.5 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Anhchangmutrang in WordPress Plugin Elite Video Player versions = 10.0.5...

WordPress Persian Woocommerce SMS plugin <= 7.0.10 - SQL Injection Vulnerability

SQL Injection Vulnerability discovered by astra.r3verii in WordPress Plugin Persian Woocommerce SMS versions = 7.0.10...

WordPress Search with Typesense plugin <= 2.0.10 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin Search with Typesense versions = 2.0.10...

WordPress Ultimate WP Mail plugin <= 1.3.5 - Account Takeover via Email Log Leak Vulnerability

Account Takeover via Email Log Leak Vulnerability discovered by domiee13 in WordPress Plugin Ultimate WP Mail versions = 1.3.5...

WordPress WP Table Builder plugin <= 2.0.6 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by domiee13 in WordPress Plugin WP Table Builder versions = 2.0.6...

WordPress WP Tools plugin <= 5.24 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin WP Tools versions = 5.24...

WordPress Team Showcase plugin < 25.05.13 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Tran Nguyen Bao KhanhVCI - VNPT in WordPress Plugin Team Showcase versions 25.05.13...

WordPress oik plugin <= 4.15.1 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Aiden in WordPress Plugin oik versions = 4.15.1...

WordPress Print Invoice & Delivery Notes for WooCommerce plugin <= 5.5.0 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by domiee13 in WordPress Plugin Print Invoice & Delivery Notes for WooCommerce versions = 5.5.0...

WordPress Raychat plugin <= 2.1.0 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Raychat versions = 2.1.0...

WordPress File Provider plugin <= 1.2.3 - Item Deletion via CSRF vulnerability

Item Deletion via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin File Provider versions = 1.2.3...

WordPress Stock Locations for WooCommerce plugin <= 2.8.6 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by LVT-tholv2k in WordPress Plugin Stock Locations for WooCommerce versions = 2.8.6...

CVE-2025-4580

CVE-2025-4580 affects the WordPress File Provider plugin (versions

CVE-2025-5539

The Simple Contact Form Plugin for WordPress – WP Easy Contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emdmbmeta' shortcode in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping on user supplied attribute...

CVE-2025-5532

The Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emdmbmeta' shortcode in all versions up to, and including, 1.9.0 due to insufficient input sanitization and output escaping on user...

PT-2025-23743 · WordPress · Wp Easy Contact

Name of the Vulnerable Software and Affected Versions: WP Easy Contact plugin for WordPress versions up to, and including, 4.0.0 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on user-supplied attributes in the emd mb me...

WordPress Bit File Manager plugin <= 6.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Uploads vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting via SVG File Uploads vulnerability discovered by TANG Cheuk Hei siunam in WordPress Plugin Bit File Manager versions = 6.7...