CVE-2025-39418 WordPress RSS Manager plugin <= 0.06 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in ajayver RSS Manager allows Stored XSS. This issue affects RSS Manager: from n/a through 0.06...

CVE-2025-39444 WordPress MaxButtons plugin <= 9.8.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in maxfoundry MaxButtons maxbuttons allows Stored XSS.This issue affects MaxButtons: from n/a through = 9.8.3...

PT-2025-16934 · WordPress · Wp Editor

Name of the Vulnerable Software and Affected Versions: WP Editor plugin for WordPress versions up to, and including, 1.2.9.1 Description: The issue allows authenticated attackers with Administrator-level access and above to read arbitrary files on the affected site's server, potentially revealing...

PT-2025-17110 · WordPress · Push Notification For Wp

Name of the Vulnerable Software and Affected Versions: All push notification for WP versions 1.5.3 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that also allows Reflected XSS. This means an attacker could potentially trick a user into performing...

WordPress Wanderland Theme <= 1.7.1 is vulnerable to Local File Inclusion

Software Wanderland Type Theme Vulnerable versions = 1.7.1 Fixed in 1.7.2 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-39467 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID cc767e365da0 Credits Bonds Required privilege Unauthenticated...

CVE-2025-39524

CVE-2025-39524 is a stored XSS vulnerability in the WordPress Html5 Audio Player plugin. The issue arises from improper neutralization of script-related HTML tags in the plugin and affects Html5 Audio Player versions up to and including 2.2.28. If exploited, an attacker could inject scripted cont...

CVE-2025-39577 WordPress PropertyHive <= 2.1.2 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Property Hive PropertyHive allows Stored XSS. This issue affects PropertyHive: from n/a through 2.1.2...

CVE-2025-39582 WordPress WP Data Access plugin <= 5.5.36 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Passionate Programmer Peter WP Data Access wp-data-access allows DOM-Based XSS.This issue affects WP Data Access: from n/a through = 5.5.36...

CVE-2025-39589 WordPress Essential Addons for Elementor plugin <= 6.1.9 - Sensitive Data Exposure Vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Retrieve Embedded Sensitive Data.This issue affects Essential Addons for Elementor: from n/a through = 6.1.9...

CVE-2024-9230

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.9.18 does not sanitise and escape some of its settings when adding a podcast, which could allow author and above users to perform Stored Cross-Site Scripting attacks...

CVE-2024-10680

The CVE CVE-2024-10680 pertains to the Form Maker by 10Web WordPress plugin (versions before 1.15.32). The issue arises from inadequate sanitization/escaping of several plugin settings, enabling Stored Cross-Site Scripting (XSS) where a high-privilege user (e.g., an admin) can inject scripts even...

CVE-2025-26959 WordPress Administrator Z <= 2025.03.24 - Privilege Escalation Vulnerability

Missing Authorization vulnerability in Quý Lê 91 Administrator Z administrator-z allows Privilege Escalation.This issue affects Administrator Z: from n/a through = 2025.03.24...

CVE-2025-3470

CVE-2025-3470 describes an authenticated SQL Injection in the WordPress plugin TS Poll – Survey, Versus Poll, Image Poll, Video Poll, affecting versions up to and including 2.4.6. The root cause is insufficient escaping of the user-supplied s parameter and inadequate preparation in the existing S...

CVE-2025-2719

The Swatchly – WooCommerce Variation Swatches for Products product attributes: Image swatch, Color swatches, Label swatches plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxdismiss function in versions 1.2.8 to 1.4.0. This makes ...

PT-2025-16167 · WordPress · User Registration & Membership

Name of the Vulnerable Software and Affected Versions: User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress versions up to, and including, 4.1.3 Description: The issue allows unauthenticated attackers to update any user's membership to any...

WordPress Royal Elementor Addons plugin <= 1.7.1006 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Marek Mikita Patchstack Alliance in WordPress Plugin Royal Elementor Addons versions = 1.7.1006...

WordPress SKT Blocks – Gutenberg based Page Builder plugin <= 1.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by zaim Patchstack Alliance in WordPress Plugin SKT Blocks versions = 1.8...

PT-2025-16114 · WordPress · Everest Forms

Name of the Vulnerable Software and Affected Versions: The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress versions up to, and including, 3.1.1 Description: The issue is related to Reflected Cross-Site Scripting via the form id parameter due to...

Exploit for SQL Injection in Wpfastestcache Wp_Fastest_Cache

PoC for CVE-2023-6063: WP Fastest Cache 1.2.2 Unauthenticated...

CVE-2025-2882

The GreenPaytm by Green.Money plugin for WordPress is vulnerable to Sensitive Information Exposure in versions between 3.0.0 and 3.0.9 through the publicly accessible phpinfo.php script. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in th...