CVE-2025-2257 Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid <= 1.16.10 - Authenticated (Admin+) Command Injection

The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.16.10 via the compressionlevel setting. This is due to the plugin using the compressionlevel setting in procopen withou...

CVE-2025-1784

The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the uagb block in all versions up to, and including, 2.19.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-11847

The wp-svg-upload WordPress plugin, affecting versions through 1.0.0 , is vulnerable to Stored Cross-site Scripting (XSS) . The root cause is a failure to properly sanitize SVG file contents during the upload process. This allows users with at least the author role to upload specially crafted SVG...

CVE-2025-1490

CVE-2025-1490 concerns the WordPress plugin Smart Maintenance Mode . The vulnerability is a Reflected Cross-Site Scripting via the setstatus parameter in all versions up to 1.5.2, due to insufficient input sanitization and output escaping. This could allow unauthenticated attackers to inject scri...

CVE-2025-2276

The Ultimate Dashboard – Custom WordPress Dashboard plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handlemoduleactions function in all versions up to, and including, 3.8.7. This makes it possible for authenticated attackers, with...

PT-2025-12871 · WordPress · Advanced Iframe

Name of the Vulnerable Software and Affected Versions: Advanced iFrame plugin for WordPress versions up to and including 2024.5 Description: The issue allows unauthorized excessive creation of options on the aip map url callback function due to insufficient restrictions. This enables...

WordPress plugin Product Import Export for WooCommerce 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in WordPress...

CVE-2025-2276

CVE-2025-2276 affects Ultimate Dashboard – Custom WordPress Dashboard plugin. Root cause: missing capability check in handle_module_actions across versions up to 3.8.7, enabling authenticated users with Subscriber+ roles to activate/deactivate plugin modules. Documented impact: unauthorized modif...

CVE-2025-2635

CVE-2025-2635 is a reflected XSS in the Digital License Manager plugin for WordPress. Affected: all versions

CVE-2025-2510

The Frndzk Expandable Bottom Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'text' parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-leve...

CVE-2025-2319

The EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 4.11.13 to 5.25.08. This is due to missing or incorrect nonce validation on the 'ELISQLREPORTSmenu' function. This makes it possible for unauthenticated attackers to...

CVE-2024-13710 Estatebud – Properties & Listings <= 5.5.0 - Cross-Site Request Forgery to Settings Update

The Estatebud – Properties & Listings plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.5.0. This is due to missing or incorrect nonce validation on the 'estatebudsettings' page. This makes it possible for unauthenticated attackers to update...

CVE-2025-2510

CVE-2025-2510 concerns the Frndzk Expandable Bottom Bar plugin for WordPress. The vulnerability is described as a Stored Cross-Site Scripting (XSS) via the text parameter in all versions up to and including 1.0, caused by insufficient input sanitization and output escaping. It states that only au...

CVE-2025-2252

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.6.1 via the eddajaxgetdownloadtitle function. This makes it possible for unauthenticated attackers to extract...

CVE-2025-0845

The DesignThemes Core Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

CVE-2024-13123

The AFI WordPress plugin before 1.100.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13617

The aoa-downloadable WordPress plugin through 0.1.0 doesn't validate a parameter in its download function, allowing unauthenticated attackers to download arbitrary files from the server...

CVE-2024-10566

The Slider by 10Web WordPress plugin before 1.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-13618

The aoa-downloadable WordPress plugin (version 0.1.0 ) is vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) . The root cause is a lack of authorization and authentication for requests made to the download.php endpoint, which allows unauthenticated visitors to force the server to...

CVE-2024-12682

The Smart Maintenance Mode WordPress plugin (versions before 1.5.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape certain plugin settings. This flaw allows high-privilege users, such as administrators, to perform XSS attacks, e...