CVE-2024-12599

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...

PT-2025-6798 · WordPress · Simple Video Management System

Name of the Vulnerable Software and Affected Versions: Simple Video Management System WordPress plugin versions 1.0.0 through 1.0.4 Description: The issue allows high privilege users, such as admin, to perform Stored Cross-Site Scripting attacks. This is possible because the plugin does not...

CVE-2024-10322

Brizy – Page Builder for WordPress is affected by CVE-2024-10322: a Stored Cross-Site Scripting vulnerability via REST API SVG file uploads in all versions up to 2.6.8. The root cause is insufficient input sanitization and output escaping, enabling authenticated attackers with Author-level access...

CVE-2024-13477 LTL Freight Quotes – Unishippers Edition <= 2.5.8 - Unauthenticated SQL Injection

The LTL Freight Quotes – Unishippers Edition plugin for WordPress is vulnerable to SQL Injection via the 'editid' parameter in all versions up to, and including, 2.5.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2024-13437

The Book a Room plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.9. This is due to missing or incorrect nonce validation on the 'bookaroomSettings' page. This makes it possible for unauthenticated attackers to update the plugin's settings vi...

CVE-2024-13814

The The Global Gallery - WordPress Responsive Gallery plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 9.1.5. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode...

CVE-2024-12315

CVE-2024-12315 corresponds to the WordPress plugin WP Ultimate Exporter (exports all posts/products/orders/refunds/users). The Wordfence and CVE lists confirm information disclosure in all versions up to 2.9.3 via an unprotected exports directory (/wp-content/uploads/smack_uci_uploads/exports/), ...

CVE-2024-13600

The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.5 via the 'majesticsupportdata' directory. This makes it possible for unauthenticated attackers to extract...

CVE-2024-13601

CVE-2024-13601 affects Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin for WordPress. Description: Insecure Direct Object Reference via exportusereraserequest in all versions up to 1.0.5, enabling authenticated users with Subscriber+ access to export ticket data for any us...

CVE-2024-13714

CVE-2024-13714 affects The All-Images.ai – IA Image Bank and Custom Image creation plugin for WordPress (versions up to 1.0.4). The root cause is missing file type validation in the _get_image_by_url function, allowing authenticated users with Subscriber+ privileges to upload arbitrary files to t...

CVE-2024-13665

The CVE CVE-2024-13665 affects the Admire Extra WordPress plugin (versions up to 1.6). It is a Stored XSS via the space shortcode due to insufficient input sanitization/output escaping for authenticated users with Contributor+ privileges. Impact: arbitrary script injection on pages viewed by user...

Multilang Contact Form Plugin for WordPress Cross-Site Scripting

The WordPress Multilang Contact Form Plugin installed on the remote host is affected by a Cross-Site Scripting XSS vulnerability. Note that the scanner has not tester for these issues but has instead relied only the application's self-reported version number. No source data...

PT-2025-6444 · WordPress · The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin

Name of the Vulnerable Software and Affected Versions: The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress versions up to, and including, 1.0.5 Description: The issue allows unauthenticated attackers to extract sensitive data stored insecurely in the...

CVE-2024-13011

The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'uploadpublisherprofileimage' function in versions up to, and including, 4.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affect...

CVE-2024-13010

The WP Foodbakery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.8 due to insufficient input sanitization and output escaping on the 'searchtype' parameter. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

CVE-2024-13011 WP Foodbakery <= 4.7 - Unauthenticated Arbitrary File Upload

The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'uploadpublisherprofileimage' function in versions up to, and including, 4.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affect...

WordPress CMS Tree Page View Plugin < 1.4 Authorization Bypass Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:cmstreepageviewproject:cmstreepageview"; ifdescription...

WordPress File Manager Plugin < 7.2.6 Directory Traversal Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:webdesi9:filemanager"; if description...

CVE-2024-7425

The WP ALL Export Pro plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to improper user input validation and sanitization in all versions up to, and including, 1.9.1. This makes it possible for authenticated attackers, with Shop...

CVE-2024-9661

The WP All Import Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.9.7. This is due to missing nonce validation on the deleteandedit function. This makes it possible for unauthenticated attackers to delete imported content posts, comment...