CVE-2025-31856 WordPress Export All Post Meta Plugin <= 1.2.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in brainvireinfo Export All Post Meta export-all-post-meta allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Export All Post Meta: from n/a through = 1.2.1...

CVE-2025-31854 WordPress Simple Sticky Add To Cart For WooCommerce plugin <= 1.4.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in Sharaz Shahid Simple Sticky Add To Cart For WooCommerce sticky-add-to-cart-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Sticky Add To Cart For WooCommerce: from n/a through = 1.4.9...

CVE-2025-31847

CVE-2025-31847 affects mFolio Lite (WordPress)

CVE-2025-31844

CVE-2025-31844 is evidenced in the connected data as a stored XSS in the WordPress plugin Magical Blocks (versions up to 1.0.12; initial doc references 1.0.10, but a later entry lists 1.0.12). The vulnerability type is “Authenticated (Contributor+) Stored Cross-Site Scripting” and the affected so...

CVE-2025-31843

Technical details about CVE-2025-31843 are not provided in the supplied documents. No root cause, affected versions, impacts, or fixes are detailed here.

CVE-2025-31820 WordPress Automatic Featured Images from Videos plugin <= 1.2.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in webdevstudios Automatic Featured Images from Videos automatic-featured-images-from-videos allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Automatic Featured Images from Videos: from n/a through = 1.2.4...

CVE-2025-31812 WordPress BuddyPress Members Only plugin <= 3.5.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Tomas BuddyPress Members Only allows Stored XSS. This issue affects BuddyPress Members Only: from n/a through 3.5.3...

CVE-2025-31810 WordPress Question Answer plugin <= 1.2.73 - Broken Access Control vulnerability

Missing Authorization vulnerability in PickPlugins Question Answer question-answer allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Question Answer: from n/a through = 1.2.73...

CVE-2025-31783

CVE-2025-31783 describes a Stored XSS in the Leartes TRY Exchange Rates WordPress plugin. Affected software: Leartes TRY Exchange Rates

CVE-2025-31777

CVE-2025-31777 concerns Clockinator Lite (BeastThemes) with Missing Authorization affecting Clockinator Lite versions up to 1.0.7. The Wordfence vulnerability entry in the connected docs confirms the affected software and the Missing Authorization issue, but detailed root-cause, impacted configur...

CVE-2025-31770 WordPress Content Manager Light plugin <= 3.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in OTWthemes Content Manager Light content-manager-light allows Stored XSS.This issue affects Content Manager Light: from n/a through = 3.2...

CVE-2025-31752 WordPress Bulk Fields Editor plugin <= 1.8.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in termel Bulk Fields Editor bulk-user-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bulk Fields Editor: from n/a through = 1.8.0...

CVE-2025-31750 WordPress Breaking News WP Plugin <= 1.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in doit Breaking News WP breaking-news-wp allows Stored XSS.This issue affects Breaking News WP: from n/a through = 1.3...

CVE-2025-31734 WordPress Simple Post Expiration plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Syed Balkhi Simple Post Expiration simple-post-expiration allows DOM-Based XSS.This issue affects Simple Post Expiration: from n/a through = 1.0.1...

WordPress Ultimate Push Notifications plugin <= 1.2.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Ultimate Push Notifications versions = 1.2.0...

WordPress AI Search Bar plugin <= 2.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by stealthcopter in WordPress Plugin AI Search Bar versions = 2.1...

WordPress Frizzly plugin <= 1.1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Frizzly versions = 1.1.0...

CVE-2025-1512

The PowerPack Elementor Addons Free Widgets, Extensions and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom Cursor Extension in all versions up to, and including, 2.9.0 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2025-2048

The Lana Downloads Manager WordPress plugin (versions prior to 1.10.0 ) is vulnerable to a path traversal attack due to insufficient validation of user input used in a path. This flaw allows users with an admin role to perform path traversal and download arbitrary files from the server. To remedi...

CVE-2025-30971 WordPress XV Random Quotes plugin <= 2.0.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Xavi Ivars XV Random Quotes xv-random-quotes allows SQL Injection.This issue affects XV Random Quotes: from n/a through = 2.0.0...