CVE-2024-13527

The Philantro – Donations and Donor Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes like 'donate' in all versions up to, and including, 5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes i...

CVE-2025-0321

CVE-2025-0321 affects the WordPress plugin ElementsKit Pro (versions up to and including 3.7.8). The issue is a DOM-based Stored Cross-Site Scripting (XSS) via the plugin’s URL parameter, caused by insufficient input sanitization and output escaping. Exploitation requires authenticated access at ...

CVE-2024-13448

CVE-2024-13448 affects the ThemeREX Addons WordPress plugin via arbitrary file uploads due to missing file type validation in trx_addons_uploads_save_data, affecting all versions up to 2.32.3. Unauthenticated upload could lead to remote code execution. Red Hat and other sources indicate remediati...

CVE-2024-12807

The CVE-2024-12807 entry concerns the WordPress plugin Social Share Buttons for WordPress (versions ≤ 2.7). The issue is a Stored XSS due to the plugin not sanitising/escaping some settings, which could allow high-privilege users (e.g., admins) to execute stored scripts, including in multisite co...

CVE-2025-23574 WordPress CubePM plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jonathan Lau CubePM cubepm allows Reflected XSS.This issue affects CubePM: from n/a through = 1.0...

CVE-2025-24584 WordPress Ultimate Store Kit Elementor Addons plugin <= 2.3.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in bdthemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Store Kit Elementor Addons: from n/a through = 2.3.0...

CVE-2024-13117 Social Share Buttons for WordPress <= 2.7 - Unauthenticated Image Upload & Path Traversal

The Social Share Buttons for WordPress plugin through 2.7 allows an unauthenticated user to upload arbitrary images and change the path where they are uploaded...

CVE-2024-13505

The Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ayssections5questions8title’ parameter in all versions up to, and including, 5.1.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-11641 VikBooking Hotel Booking Engine & PMS <= 1.7.2 - Cross-Site Request Forgery to Authenticated (Subscriber+) Arbitrary File Upload

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.2. This is due to missing or incorrect nonce validation on the 'save' function. This makes it possible for unauthenticated attackers to change plugi...

CVE-2024-13449 Boom Fest <= 2.2.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update

The Boom Fest plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'bfadminaction' function in all versions up to, and including, 2.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to updat...

CVE-2024-12885

The Connections Business Directory plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation when deleting a connections image directory in all versions up to, and including, 10.4.66. This makes it possible for authenticated attackers, with...

CVE-2024-13550

Summary of CVE-2024-13550 (ABC Notation WordPress plugin) The WordPress ABC Notation plugin (versions up to and including 6.1.3) is affected by a path traversal vulnerability exploitable via the file attribute of the abcjs shortcode. The issue permits an authenticated attacker with Contributor-le...

CVE-2024-12885 Connections Business Directory <= 10.4.66 - Authenticated (Admin+) Arbitrary Directory Deletion

The Connections Business Directory plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation when deleting a connections image directory in all versions up to, and including, 10.4.66. This makes it possible for authenticated attackers, with...

CVE-2024-12885

The CVE-2024-12885 entry concerns the WordPress plugin Connections Business Directory. Affected versions: all up to 10.4.66. Root cause: insufficient file path validation when deleting the Connections Images directory, enabling an authenticated attacker with Administrator+ privileges to delete ar...

CVE-2024-12816

CVE-2024-12816 is a Stored Cross-Site Scripting vulnerability in the WordPress plugin “NOTICE BOARD BY TOWKIR” (versions ≤ 3.1). The flaw arises from insufficient input sanitization and output escaping on attributes used by the plugin’s notice-board shortcode. This allows authenticated attackers ...

CVE-2025-0682

The ThemeREX Addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.33.0 via the 'trxscreviews' shortcode 'type' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute...

WordPress plugin Youzify 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

CVE-2025-24727

CVE-2025-24727 affects the WordPress plugin Contact Form Email (CodePeople) up to v1.3.52. The description confirms a stored XSS due to improper input neutralization during web page generation. Multiple sources in the connected set (NVD, CVE lists, Red Hat advisory) corroborate the vulnerability;...

CVE-2025-24663 WordPress Simple Download Monitor plugin <= 3.9.25 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in mra13 Simple Download Monitor simple-download-monitor allows Blind SQL Injection.This issue affects Simple Download Monitor: from n/a through = 3.9.25...

CVE-2025-24623 WordPress Really Simple Security plugin <= 9.1.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Really Simple Plugins Really Simple SSL really-simple-ssl allows Cross Site Request Forgery.This issue affects Really Simple SSL: from n/a through = 9.1.4...