CVE-2025-5340 Music Player for Elementor <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via album_buy_url Parameter

The Music Player for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘albumbuyurl’ parameter in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

WordPress SHOUT plugin <= 3.5.3 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao KhanhVCI - VNPT in WordPress Plugin SHOUT versions = 3.5.3...

CVE-2025-4224

CVE-2025-4224 (wpForo + wpForo Advanced Attachments) affects the WordPress plugin pair and enables Stored Cross-Site Scripting via media upload names due to insufficient input sanitization and output escaping. According to the provided documents, exploitation requires Custom-level access or highe...

CVE-2025-4047 Broken Link Checker <= 2.4.4 - Missing Autorization to Authenticated (Subscriber+) Plugin Status Dashboard View

The Broken Link Checker plugin for WordPress is vulnerable to unauthorized data access due to a missing capability check on the ajaxfullstatus and ajaxdashboardstatus functions in all versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with Subscriber-level...

PT-2025-23595 · WordPress · Wp Plugin Info Card

Name of the Vulnerable Software and Affected Versions: WP Plugin Info Card plugin for WordPress versions up to, and including, 5.3.1 Description: The issue is related to Stored Cross-Site Scripting via the containerid parameter due to insufficient input sanitization and output escaping. This allo...

PT-2025-23602 · WordPress · Popup Maker

Name of the Vulnerable Software and Affected Versions: Popup Maker plugin for WordPress versions up to, and including, 1.20.4 Description: The issue is related to Stored Cross-Site Scripting via the popupID parameter due to insufficient input sanitization and output escaping. This allows...

CVE-2025-3919

The WordPress Comments Import & Export plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the savesettings function in all versions up to, and including, 2.4.3. Additionally, the plugin fails to properly sanitize and escape FTP settings...

CVE-2025-3919

CVE-2025-3919 affects the WordPress plugin WordPress Comments Import & Export. The issue is an unauthorized data modification vulnerability caused by a missing capability check in the save_settings function across versions up to 2.4.3, compounded by improper sanitization/escaping of FTP settings....

CVE-2025-3919 WordPress Comments Import & Export <= 2.4.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting

The WordPress Comments Import & Export plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the savesettings function in all versions up to, and including, 2.4.3. Additionally, the plugin fails to properly sanitize and escape FTP settings...

WordPress Real Cookie Banner Pro plugin < 5.1.6 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin Real Cookie Banner Pro versions 5.1.6...

CVE-2025-4672

The Offsprout Page Builder plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization placed on the permissioncallback function in versions 2.2.1 to 2.15.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to read, create,...

CVE-2025-4103

The WP-GeoMeta plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the wpajaxwpgmstartgeojsonimport function in versions 0.3.4 to 0.3.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their...

CVE-2025-5290

The Borderless – Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2025-4944

The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Compare and Google Maps widgets in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This...

CVE-2025-5286

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘additionalsettings’ parameter in all versions up to, and including, 5.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-4631

The Profitori plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the stocktendobject endpoint in versions 2.0.6.0 to 2.1.1.3. This makes it possible to trigger the saveobjectasuser function for objects whose 'datatype' is set to 'users',. This allows...

CVE-2025-4595

The FastSpring plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fastspring/block-fastspringblocks-complete-product-catalog' block in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping on the 'color' attribute. Thi...

CVE-2025-4607

CVE-2025-4607 concerns the PSW Front-end Login & Registration plugin for WordPress (versions up to and including 1.12). The vulnerability arises from a weak, low-entropy OTP mechanism in the forget() function, enabling unauthenticated attackers to initiate a password reset for any user (including...

CVE-2025-4583

The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-plugin attribute in all versions up to, and including, 6.9.0 Free and 6.8.0 Pro due to insufficient input sanitization and output escaping. This makes it...

PT-2025-23380 · WordPress · The Borderless – Elementor Addons/Templates

Name of the Vulnerable Software and Affected Versions: The Borderless – Elementor Addons and Templates plugin for WordPress versions up to, and including, 1.7.1 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, allowing...