CVE-2025-46251 WordPress VikRestaurants Table Reservations and Take-Away plugin <= 1.3.3 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in e4jvikwp VikRestaurants vikrestaurants allows Cross Site Request Forgery.This issue affects VikRestaurants: from n/a through = 1.3.3...

CVE-2025-46232

CVE-2025-46232 affects the WordPress plugin “Alt Text AI” (Download Alt Text AI) and covers versions up to and including 1.9.93. The issue is a Missing/Misconfigured Authorization vulnerability, i.e., broken access control that could enable unauthorized access to protected functionality. The publ...

CVE-2025-2594

The User Registration & Membership WordPress plugin before 4.1.3 does not properly validate data in an AJAX action when the Membership Addon is enabled, allowing attackers to authenticate as any user, including administrators, by simply using the target account's user ID...

PT-2025-17521 · WordPress · Classic Editor +1

Name of the Vulnerable Software and Affected Versions: Ocean Extra plugin for WordPress versions up to, and including, 2.4.6 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping via the ocean gallery id parameter. This allows...

PT-2025-17473 · WordPress · The Greenshift

Name of the Vulnerable Software and Affected Versions: Greenshift – animation and page builder blocks plugin for WordPress versions 11.4 through 11.4.5 Description: The Greenshift plugin is vulnerable to arbitrary file uploads due to missing file type validation in the gspb make proxy api request...

Exploit for CVE-2025-3102

CVE-2025-3102 🛠️ SureTriggers Exploit Script Script ini diguna...

CVE-2025-2010

Summary (CVE-2025-2010): WordPress Plugin JobWP (Job Board/Job Listing/Career Page) versions up to and including 2.3.9 are vulnerable to an unauthenticated SQL Injection via the jobwp_upload_resume parameter. The root cause is insufficient escaping and lack of proper query preparation, enabling a...

EUVD-2025-11919

The JobWP – Job Board, Job Listing, Career Page and Recruitment Plugin plugin for WordPress is vulnerable to SQL Injection via the 'jobwpuploadresume' parameter in all versions up to, and including, 2.3.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparati...

PT-2025-17350 · WordPress · Jobwp

Name of the Vulnerable Software and Affected Versions: The JobWP – Job Board, Job Listing, Career Page and Recruitment Plugin plugin for WordPress versions up to, and including, 2.3.9 Description: The issue is related to SQL Injection via the jobwp upload resume parameter due to insufficient...

PT-2025-17256 · WordPress · The Coupon Affiliates – Affiliate Plugin For Woocommerce

Name of the Vulnerable Software and Affected Versions: The Coupon Affiliates – Affiliate Plugin for WooCommerce plugin for WordPress versions up to, and including, 6.3.0 Description: The issue is related to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping...

PT-2025-17249 · WordPress · Piotnet Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Piotnet Addons For Elementor plugin for WordPress versions up to, and including, 2.4.34 Description: The issue is related to Stored Cross-Site Scripting via the 'PAFE Before After Image Comparison Slider' widget due to insufficient input...

CVE-2025-27302

CVE-2025-27302 : WordPress CHATLIVE plugin (

CVE-2025-32513

CVE-2025-32513 affects the WordPress plugin Nomupay Payment Processing Gateway (Total processing card payments for WooCommerce). The issue is an improper input neutralization in web page generation causing a Reflected XSS . Affected: versions from n/a up to and including 7.1.6. Impact is describe...

CVE-2025-32573

KiotViet Sync WordPress plugin suffers an SQL Injection (CVE-2025-32573) due to improper neutralization of special elements in SQL commands. Affected: KiotViet Sync versions up to 1.8.3 (per CVE details); patched in 1.8.4+ per PatchStack entry. Impact: potential unauthorized data access/manipulat...

CVE-2025-32578 WordPress Coming Soon Countdown Plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Mapro Collins Coming Soon Countdown coming-soon-countdown allows Reflected XSS.This issue affects Coming Soon Countdown: from n/a through = 2.2...

CVE-2025-32666

CVE-2025-32666 concerns the WordPress plugin Hive Support. The vulnerability is a reflected Cross-Site Scripting (XSS) flaw in Hive Support versions up to and including 1.2.2, enabling attacker-controlled input to be reflected in web pages. Public sources in the Connected documents indicate remed...

CVE-2025-32682 WordPress MapSVG Lite plugin <= 8.6.4 - Arbitrary File Upload Vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in RomanCode MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through = 8.6.4...

CVE-2025-39526 WordPress Hotel Booking Plugin <= 3.6 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in nicdark Hotel Booking nd-booking allows PHP Local File Inclusion.This issue affects Hotel Booking: from n/a through = 3.6...

CVE-2025-39417

CVE-2025-39417 describes a CSRF-to-Stored XSS vulnerability in the WordPress plugin “Redirect wordpress to welcome or landing page” (versions n/a through 2.0). Exploitation details are not provided in the connected documents; the root cause is a CSRF flaw that permits storing and triggering XSS p...

CVE-2025-39417 WordPress Redirect wordpress to welcome or landing page plugin <= 2.0 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Eslam Mahmoud Redirect wordpress to welcome or landing page redirect-to-welcome-or-landing-page allows Stored XSS.This issue affects Redirect wordpress to welcome or landing page: from n/a through = 2.0...