6470 matches found
CVE-2024-13637 Demo Awesome <= 1.0.3 - Missing Authorization to Authenticated (Subscriber+) Plugin Activation
The Demo Awesome plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the installplugin function in all versions up to, and including, 1.0.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...
CVE-2025-3099
The CVE-2025-3099 entry concerns the Advanced Search by My Solr Server WordPress plugin. It is described as vulnerable to Cross-Site Request Forgery in all versions up to 2.0.5 due to missing or incorrect nonce validation on the MySolrServerSettings page. The impact stated is that unauthenticated...
CVE-2025-3099 Advanced Search by My Solr Server <= 2.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
The Advanced Search by My Solr Server plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.5. This is due to missing or incorrect nonce validation on the 'MySolrServerSettings' page. This makes it possible for unauthenticated attackers to upda...
PT-2025-14476 · WordPress · Video Url Plugin
Name of the Vulnerable Software and Affected Versions: Video Url plugin for WordPress versions up to, and including, 1.0.0.3 Description: The issue is related to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to...
CVE-2025-31594 WordPress Auto scroll for reading plugin <= 1.1.4 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPglob Auto scroll for reading allows Reflected XSS. This issue affects Auto scroll for reading: from n/a through 1.1.4...
CVE-2025-31580 WordPress Ni WooCommerce Product Enquiry plugin <= 4.1.8 - Broken Access Control vulnerability
Missing Authorization vulnerability in Anzar Ahmed Ni WooCommerce Product Enquiry ni-woocommerce-product-enquiry allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Ni WooCommerce Product Enquiry: from n/a through = 4.1.8...
CVE-2025-31580 WordPress Ni WooCommerce Product Enquiry plugin <= 4.1.8 - Broken Access Control vulnerability
Missing Authorization vulnerability in Anzar Ahmed Ni WooCommerce Product Enquiry allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Ni WooCommerce Product Enquiry: from n/a through 4.1.8...
CVE-2025-31628
CVE-2025-31628 affects Sliced Invoices (WordPress Invoice Plugin) with a Missing Authorization flaw in versions up to 3.9.5; the WordFence entry indicates the patch status as Unpatched and does not provide exploit vectors or remediation details beyond noting the vulnerability type.
CVE-2025-31561 WordPress Ultimate Push Notifications plugin <= 1.2.0 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in CodeSolz Ultimate Push Notifications ultimate-push-notifications allows SQL Injection.This issue affects Ultimate Push Notifications: from n/a through = 1.2.0...
CVE-2025-31454 WordPress Delete Post Revision plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Arefly Delete Post Revision delete-post-revision allows Reflected XSS.This issue affects Delete Post Revision: from n/a through = 1.1...
CVE-2025-30844
CVE-2025-30844 – Watu Quiz (WordPress) : The connected vulnerability record for Watu Quiz reports a reflected Cross-Site Scripting flaw caused by improper input neutralization during web page generation, affecting Watu Quiz versions from n/a through 3.4.2. The Wordfence entry confirms this CVE wi...
CVE-2025-30825 WordPress WPC Smart Linked Products plugin <= 1.3.5 - Privilege Escalation vulnerability
Missing Authorization vulnerability in WPClever WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce wpc-smart-linked-products allows Privilege Escalation.This issue affects WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce: from n/a through = 1.3.5...
WordPress User Registration & Membership Pro plugin < 5.1.3 - Authentication Bypass vulnerability
Authentication Bypass vulnerability discovered by wesley wcraft in WordPress Plugin User Registration & Membership Pro versions 5.1.3...
WordPress Insert Headers and Footers Code – HT Script plugin <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update vulnerability
Missing Authorization to Authenticated Subscriber+ Limited Options Update vulnerability discovered by kr0d in WordPress Plugin Insert Headers and Footers Code – HT Script versions = 1.1.2...
WordPress SMS Alert Order Notifications – WooCommerce plugin <= 3.7.9 - Unauthenticated Account Takeover/Privilege Escalation vulnerability
Unauthenticated Account Takeover/Privilege Escalation vulnerability discovered by Lucio Sá in WordPress Plugin SMS Alert Order Notifications versions = 3.7.9...
WordPress Limit Max IPs Per User plugin <= 1.5 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by johska in WordPress Plugin Limit Max IPs Per User versions = 1.5...
WordPress News & Blog Designer Pack plugin <= 4.0 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin News & Blog Designer Pack versions = 4.0...
WordPress Enable Media Replace plugin <= 4.1.5 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Enable Media Replace versions = 4.1.5...
WordPress JSON Structuring Markup plugin <= 0.1 - CSRF to Stored XSS vulnerability
CSRF to Stored XSS vulnerability discovered by Abdi Pranata in WordPress Plugin JSON Structuring Markup versions = 0.1...