WordPress WPVN plugin <= 0.7.8 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Thi Huyen Trang - Skalucy in WordPress Plugin WPVN versions = 0.7.8...

CVE-2025-46523 WordPress COVID-19 (Coronavirus) Update Your Customers plugin <= 1.5.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in devignstudiosltd COVID-19 Coronavirus Update Your Customers covid-19-alert allows Stored XSS.This issue affects COVID-19 Coronavirus Update Your Customers: from n/a through = 1.5.1...

CVE-2025-39383 WordPress Xews Lite plugin <= 1.0.9 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in codeworkweb Xews Lite xews-lite allows PHP Local File Inclusion.This issue affects Xews Lite: from n/a through = 1.0.9...

CVE-2025-39390 WordPress Booking and Rental Manager plugin <= 2.3.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Booking and Rental Manager: from n/a through 2.3.8...

CVE-2025-39399 WordPress License For Envato plugin <= 1.0.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Ashraful Sarkar Naiem License For Envato license-envato allows PHP Local File Inclusion.This issue affects License For Envato: from n/a through = 1.0.0...

CVE-2025-39408 WordPress BruteGuard – Brute Force Login Protection plugin <= 0.1.4 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in EverPress BruteGuard – Brute Force Login Protection bruteguard allows Reflected XSS.This issue affects BruteGuard – Brute Force Login Protection: from n/a through = 0.1.4...

WordPress Category Posts Widget plugin < 4.9.20 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Category Posts Widget versions 4.9.20...

CVE-2025-3101

The Configurator Theme Core plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.4.7. This is due to the plugin not properly validating user meta fields prior to updating them in the database. This makes it possible for authenticated attackers, with...

CVE-2025-3776 Verification SMS with TargetSMS <= 1.5 - Unauthenticated Limited Remote Code Execution

The Verification SMS with TargetSMS plugin for WordPress is vulnerable to limited Remote Code Execution in all versions up to, and including, 1.5 via the 'targetvrajaxhandler' function. This is due to a lack of validation on the type of function that can be called. This makes it possible for...

CVE-2025-3101

CVE-2025-3101 describes a privilege-escalation vulnerability in the WordPress plugin Configurator Theme Core (versions up to and including 1.4.7). The issue arises because the plugin does not properly validate user meta fields before updating them in the database, enabling an authenticated attack...

1 Decembrie 1918 <= 1.dec.2012 - Cross-Site Request Forgery to Stored Cross-Site Scripting

Description The 1 Decembrie 1918 plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.dec.2012. This is due to missing or incorrect nonce validation on the 1-decembrie-1918/1-decembrie-1918.php page. This makes it possible for unauthenticated...

WordPress WPMasterToolKit (WPMTK) – All in one plugin plugin <= 2.5.2 - Authenticated (Administrator+) to Arbitrary File Read and Write vulnerability

Authenticated Administrator+ to Arbitrary File Read and Write vulnerability discovered by nquangit in WordPress Plugin WPMasterToolKit versions = 2.5.2...

WordPress MangBoard WP plugin <= 1.8.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Board Header And Footer vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting via Board Header And Footer vulnerability discovered by nquangit in WordPress Plugin Mang Board WP versions = 1.8.6...

WordPress WordPress Simple PayPal Shopping Cart plugin <= 5.1.2 - Unauthenticated Product Price Manipulation vulnerability

Unauthenticated Product Price Manipulation vulnerability discovered by Jack Taylor in WordPress Plugin Simple Shopping Cart versions = 5.1.2...

WordPress PowerPress Podcasting <= 11.12.5 - Arbitrary File Upload Vulnerability

Arbitrary File Upload Vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin PowerPress Podcasting versions = 11.12.5...

CVE-2025-3529

The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.2 via the 'fileurl' parameter. This makes it possible for unauthenticated attackers to view potentially sensitive information and download a digital...

CVE-2025-3530

The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to product price manipulation in all versions up to, and including, 5.1.2. This is due to a logic flaw involving the inconsistent use of parameters during the cart addition process. The plugin uses the parameter 'producttmptwo'...

CVE-2025-3472

The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.6. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...

CVE-2025-46244 WordPress Advanced Linked Variations for Woocommerce plugin <= 1.0.3 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Dotstore Advanced Linked Variations for Woocommerce linked-variation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Linked Variations for Woocommerce: from n/a through = 1.0.3...

CVE-2025-2839

The WP Import Export Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpiePreviewData’ function in all versions up to, and including, 3.9.27 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...