6469 matches found
CVE-2025-24556
CVE-2025-24556 affects the WordPress MooWoodle plugin (versions n/a–3.2.4). The issue is an insertion of sensitive information into a log file, enabling retrieval of embedded sensitive data. According to Patchstack metrics, the flaw has CVSS v3.1: 7.5 (HIGH), attack vector NETWORK, no privileges ...
CVE-2025-23582 WordPress Bulk Categories Assign plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Haider Ali Bulk Categories Assign bulk-categories-assign allows Reflected XSS.This issue affects Bulk Categories Assign: from n/a through = 1.0...
CVE-2024-13425
CVE-2024-13425 affects the WP Job Portal – A Complete Recruitment System for Company or Job Board website (WordPress plugin) up to version 2.2.6. The root cause is an Insecure Direct Object Reference via the enforcedelete() function due to missing validation on a user-controlled key, enabling an ...
CVE-2025-0939
CVE-2025-0939 concerns the WordPress plugin MagicForm (WordPress Form Builder) up to version 1.6.2, due to a missing capability check in its AJAX actions. According to Wordfence, authenticated attackers with Subscriber-level access or higher can invoke those AJAX actions to delete or view logs, a...
CVE-2024-12768
The Responsive iframe WordPress plugin through 1.2.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
CVE-2024-13651
The RapidLoad – Optimize Web Vitals Automatically plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxdeactivate function in all versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with...
CVE-2024-11780
The Site Search 360 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ss360-resultblock' shortcode in all versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
CVE-2024-12620
CVE-2024-12620 : The AnimateGL Animations for WordPress – Elementor & Gutenberg Blocks Animations plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the agl_json AJAX action in all versions up to and including 1.4.23 . This allows unauthentic...
CVE-2024-13662
The eHive Objects Image Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ehiveobjectsimagegrid' shortcode in all versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...
CVE-2024-12037 Frontend Content Forms for User Submissions (UGC) <= 2.8.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions UGC plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bfnewsubmissionlink' shortcode in all versions up to, and including, 2.8.13 due to insufficient...
CVE-2024-12037
The CVE-2024-12037 entry concerns the WordPress plugin Post Form (Frontend Content Forms for User Submissions, UGC), with stored XSS via the bf_new_submission_link shortcode in all versions up to 2.8.13. The vulnerability allows authenticated attackers with contributor-level access or higher to i...
CVE-2025-22720
CVE-2025-22720 corresponds to a Missing Authorization vulnerability in MagePeople Team Booking and Rental Manager (WordPress plugin) affecting versions up to 2.2.1. The issue stems from incorrectly configured access control, enabling bypass of authorization. CVSS v3.1 base score is 5.8 (Scope: Ch...
CVE-2024-13717
The Contact Form and Calls To Action by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcitaajaxtoggleae and vcitaajaxtogglecontact functions in all versions up to, and including, 2.7.1. This makes it possible for authenticat...
CVE-2024-13223
CVE-2024-13223 concerns the WordPress Tabulate plugin (
CVE-2024-13225 ECT Home Page Products <= 1.9 - Reflected XSS
The ECT Home Page Products WordPress plugin through 1.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2024-13220 Google Map Professional <= 1.0 - Reflected XSS
The WordPress Google Map Professional Map In Your Language WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2024-13100
The CVE-2024-13100 entry concerns the OPSI Israel Domestic Shipments WordPress plugin (versions <= 2.6.3). The issue is a Reflected Cross-Site Scripting (XSS) vulnerability caused by insufficient sanitisation/escaping of a parameter before it is echoed on the page, potentially impacting high-p...
CVE-2024-13216 HT Event – WordPress Event Manager Plugin for Elementor <= 1.4.7 - Authenticated (Contributor+) Sensitive Information Exposure via HT Event: Sponsor
The HT Event – WordPress Event Manager Plugin for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.7 via the 'render' function in /includes/widgets/hteventsponsor.php. This makes it possible for authenticated attackers, with...
CVE-2024-10867
CVE-2024-10867 refers to the Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg WordPress plugin. The vulnerability is a Stored Cross-Site Scripting (XSS) via SVG file uploads in all versions up to and including 1.5.9, caused by insufficient input sanitization and out...
PT-2025-1999 · WordPress · Opsi Israel Domestic Shipments
Name of the Vulnerable Software and Affected Versions: OPSI Israel Domestic Shipments WordPress plugin versions 2.6.3 and earlier Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputt...