6471 matches found
CVE-2024-13898
CVE-2024-13898 concerns the WordPress plugin “Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website.” The connected documents confirm a Stored Cross-Site Scripting vulnerability caused by insufficient input sanitization and output escapi...
EUVD-2025-9708
The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.0.2. This is due to addrole and userrole functions missing proper capability checks performed through the...
CVE-2025-2075
The CVE concerns the WordPress plugin Uncanny Automator (versions up to and including 6.3.0.2). The root cause is missing capability checks in add_role() and user_role() performed through validate_rest_call(), enabling privilege escalation to administrator. Attackers with an active account can el...
CVE-2025-2779
The Insert Headers and Footers Code – HT Script plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxdismiss function in all versions up to, and including, 1.1.2. This makes it possible for authenticated attackers, with...
WordPress plugin onOffice for WP-Websites SQL注入漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection...
WordPress plugin CMP – Coming Soon & Maintenance 代码问题漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in WordPres...
WordPress Flickr Photostream plugin <= 3.1.8 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by Nguyen Thi Huyen Trang - Skalucy in WordPress Plugin Flickr Photostream versions = 3.1.8...
CVE-2025-31907 WordPress Team Builder plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Labib Ahmed Team Builder team-display allows Reflected XSS.This issue affects Team Builder: from n/a through = 1.3...
CVE-2025-31901 WordPress Digihood HTML Sitemap Plugin <= 3.1.1 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Digihood Digihood HTML Sitemap allows Reflected XSS. This issue affects Digihood HTML Sitemap: from n/a through 3.1.1...
CVE-2025-31893 WordPress Botnet Attack Blocker plugin <= 2.0.0 - Stored Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in cheesefather Botnet Attack Blocker allows Stored XSS. This issue affects Botnet Attack Blocker: from n/a through 2.0.0...
CVE-2025-31841 WordPress FPW Category Thumbnails Plugin <= 1.9.5 - Broken Access Control vulnerability
Missing Authorization vulnerability in Frank P. Walentynowicz FPW Category Thumbnails fpw-category-thumbnails allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FPW Category Thumbnails: from n/a through = 1.9.5...
CVE-2025-31789 WordPress TextMe SMS plugin <= 1.9.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Matat Technologies TextMe SMS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TextMe SMS: from n/a through 1.9.1...
CVE-2025-31626 WordPress Support Helpdesk Ticket System Lite plugin <= 4.5.2 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in M. Ali Saleem Support Helpdesk Ticket System Lite ticket-help-desk-system-lite allows Reflected XSS.This issue affects Support Helpdesk Ticket System Lite: from n/a through = 4.5.2...
CVE-2025-30916 WordPress Residential Address Detection plugin <= 2.5.4 - Broken Access Control vulnerability
Missing Authorization vulnerability in enituretechnology Residential Address Detection residential-address-detection allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Residential Address Detection: from n/a through = 2.5.4...
CVE-2025-30858 WordPress Snow Storm plugin <= 1.4.6 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Tribulant Software Snow Storm snow-storm allows Reflected XSS.This issue affects Snow Storm: from n/a through = 1.4.6...
WordPress Publitio plugin <= 2.2.0 - Arbitrary File Read vulnerability
Arbitrary File Read vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Publitio versions = 2.2.0...
WordPress Small Package Quotes – Worldwide Express Edition plugin <= 5.2.19 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Mika in WordPress Plugin Small Package Quotes – Worldwide Express Edition versions = 5.2.19...
WordPress FPW Category Thumbnails Plugin <= 1.9.5 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin FPW Category Thumbnails versions = 1.9.5...
WordPress TailPress plugin <= 0.4.4 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Anhchangmutrang in WordPress Plugin TailPress versions = 0.4.4...
CVE-2024-9416
The CVE-2024-9416 entry maps to Modula Image Gallery (WordPress) and is a Stored DOM-based Cross-Site Scripting vulnerability via the plugin’s bundled FancyBox JavaScript library (versions up to 5.x). Root cause: insufficient input sanitization and output escaping on user-supplied attributes, ena...