WordPress AdMail plugin <= 1.7.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mika in WordPress Plugin AdMail – Multilingual Back in-Stock Notifier for WooCommerce versions = 1.7.0...

WordPress Variable Inspector plugin <= 2.6.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Variable Inspector versions = 2.6.3...

WordPress Salon booking system plugin <= 10.30.18 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by NAWardRox in WordPress Plugin Salon booking system versions = 10.30.18...

WordPress TableOn plugin <= 1.0.4.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Abdi Pranata in WordPress Plugin TableOn versions = 1.0.4.4...

WordPress Spider Elements – Addons for Elementor plugin <= 1.6.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Khalid Yusuf in WordPress Plugin Spider Elements versions = 1.6.5...

CVE-2025-31405

CVE-2025-31405 is a PHP Local File Inclusion/Remote File Inclusion issue affecting the WordPress plugin Fami WooCommerce Compare . Affected versions are listed as from n/a through 1.0.5. Root cause per the CVE description: improper control of filename for include/require statements in PHP, enabli...

WordPress SurveyJS plugin <= 1.12.20 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by theviper17 in WordPress Plugin SurveyJS versions = 1.12.20...

WordPress Doppler Forms plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Doppler Forms versions = 2.5.1...

WordPress Beds24 Online Booking plugin <= 2.0.28 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro Soares de Alcântara Kinorth in WordPress Plugin Beds24 Online Booking versions = 2.0.28...

WordPress VG WooCarousel plugin <= 1.3 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by muhammad yudha in WordPress Plugin VG WooCarousel versions = 1.3...

WordPress Daisycon prijsvergelijkers plugin <= 4.8.4 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Daisycon prijsvergelijkers versions = 4.8.4...

WordPress Posts Footer Manager plugin <= 2.2.0 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by timomangcut in WordPress Plugin Posts Footer Manager versions = 2.2.0...

CVE-2024-12410

The Front End Users plugin for WordPress is vulnerable to SQL Injection via the 'UserSearchField' parameter in all versions up to, and including, 3.2.32 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVE-2025-3063

The Shopper Approved Reviews plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the ajaxcallbackupdatesaoption function in versions 2.0 to 2.1. This makes it possible for authenticated attackers, with...

CVE-2025-2005

The Front End Users plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the file uploads field of the registration form in all versions up to, and including, 3.2.32. This makes it possible for unauthenticated attackers to upload arbitrary files on t...

CVE-2025-3105

The Vehica Core plugin for WordPress, used by the Vehica - Car Dealer & Listing WordPress Theme, is vulnerable to privilege escalation in all versions up to, and including, 1.0.97. This is due to the plugin not properly validating user meta fields prior to updating them in the database. This make...

CVE-2025-2836

The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘paymentmethod’ parameter in all versions up to, and including, 6.0.4.3 due to insufficient input sanitization and output escapin...

CVE-2024-13645

The tagDiv Composer plugin for WordPress is vulnerable to PHP Object Instantiation in all versions up to, and including, 5.3 via module parameter. This makes it possible for unauthenticated attackers to Instantiate a PHP Object. No known POP chain is present in the vulnerable software, which mean...

CVE-2025-2270

CVE-2025-2270 affects the Countdown, Coming Soon, Maintenance – Countdown & Clock WordPress plugin (all versions up to 2.8.9.1). Root cause: Local File Inclusion via createCdObj, enabling unauthenticated file inclusion and potential PHP code execution. Impact reported as code execution and data a...

CVE-2025-2270 Countdown, Coming Soon, Maintenance – Countdown & Clock <= 2.8.9.1 - Unauthenticated Limited Local File Inclusion

The Countdown, Coming Soon, Maintenance – Countdown & Clock plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.9.1 via the createCdObj function. This makes it possible for unauthenticated attackers to include and execute files with the specific...