CVE-2024-12819 Searchie <= 1.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Searchie plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sioembedmedia' shortcode in all versions up to, and including, 1.17.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-12819 Searchie <= 1.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Searchie plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sioembedmedia' shortcode in all versions up to, and including, 1.17.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

PT-2025-1608 · WordPress · Postlists

Name of the Vulnerable Software and Affected Versions: PostLists WordPress plugin versions 2.0.2 and earlier Description: The issue is related to the PostLists WordPress plugin, which does not properly escape the $ SERVER'REQUEST URI' parameter before outputting it back in an attribute. This coul...

CVE-2024-9939

The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.13 via wfufiledownloader.php. This makes it possible for unauthenticated attackers to read files outside of the originally intended directory...

CVE-2024-12855 AdForest - Classified Ads WordPress Theme <= 5.1.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post/Attachment Deletion

The AdForest theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX actions like 'sbremovead' in all versions up to, and including, 5.1.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, ...

CVE-2024-12030

The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to SQL Injection via the 'key' attribute of the 'mdfvalue' shortcode in all versions up to, and including, 1.3.3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2024-56272

CVE-2024-56272 corresponds to a Missing Authorization vulnerability in the WordPress plugin Hide Category by User Role for WooCommerce. Connected Red Hat advisory RH-CVE-2024-56272 repeats the same description for the affected plugin, noting the issue exists for versions up to 2.1.1. The provided...

CVE-2025-22520 WordPress Tock Widget Plugin <= 1.1 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Tock Tock Widget tock-widget allows Cross Site Request Forgery.This issue affects Tock Widget: from n/a through = 1.1...

CVE-2025-22525 WordPress Donation Block For PayPal Plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bharatkambariya Donation Block For PayPal allows Stored XSS.This issue affects Donation Block For PayPal: from n/a through 2.2.0...

CVE-2025-22529 WordPress WE Blocks <= 1.3.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WORDPRESTEEM WE Blocks allows Stored XSS.This issue affects WE Blocks: from n/a through 1.3.5...

CVE-2024-49222 WordPress WPGuppy plugin <= 1.1.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Amento Tech Pvt ltd WPGuppy allows Object Injection.This issue affects WPGuppy: from n/a through 1.1.0...

CVE-2024-56288

CVE-2024-56288 is a Stored XSS in the WP Docs WordPress plugin (Fahad Mahmood). Affected: WP Docs versions up to 2.2.1. Root cause: Improper neutralization of input during web page generation. Impact per sources: cross-site scripting could affect authenticated users; no exploit details provided b...

CVE-2025-22310

CVE-2025-22310 : Stored XSS in TemplatesNext ToolKit (TemplatesNext ToolKit

CVE-2025-22343

CVE-2025-22343 is a wpSOL vulnerability described as a CSRF to Stored XSS affecting wpSOL up to version 1.2.0. The connected Red Hat/Wordfence records confirm the issue exists in wpSOL and state Patch Status: Unpatched. No public exploit details or fixes are provided in the connected documents. A...

CVE-2024-12437

The Marketplace Items plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'envato' shortcode in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-11282 Passster – Password Protect Pages and Content <= 4.2.10 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure

The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.10 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that...

CVE-2024-11282

CVE-2024-11282 affects the WordPress plugin Passster – Password Protect Pages and Content . According to the provided sources, it enables Sensitive Information Exposure via WordPress core search, allowing unauthenticated attackers to access restricted post data. The vulnerability applies to all v...

CVE-2024-11369

The Store credit / Gift cards for woocommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'coupon', 'startdate', and 'enddate' parameters in all versions up to, and including, 1.0.49.46 due to insufficient input sanitization and output escaping. This makes it...

CVE-2024-9697 Social Rocket – Social Sharing Plugin <= 1.3.4 - Missing Authorization to Settings Update

The Social Rocket – Social Sharing Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tweetsettingssave and tweetsettingsupdate functions in all versions up to, and including, 1.3.4. This makes it possible for authenticated...

CVE-2024-11810

CVE-2024-11810 – PayGreen Payment Gateway (WordPress) reflected XSS : The WordPress PayGreen Payment Gateway plugin is vulnerable to Reflected Cross-Site Scripting via the message_id parameter in all versions up to and including 1.0.26 due to insufficient input sanitization and output escaping. T...