CVE-2025-48338

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Kevon Adonis WP Abstracts wp-abstracts-manuscripts-manager allows PHP Local File Inclusion.This issue affects WP Abstracts: from n/a through = 2.7.4...

Exploit for CVE-2025-11534

Raisecomm RAX701-GC-WP-01 SSH Authentication Bypass Exploit C...

CVE-2025-62063 WordPress WP Travel Gutenberg Blocks plugin <= 3.9.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Travel WP Travel Gutenberg Blocks wp-travel-blocks.This issue affects WP Travel Gutenberg Blocks: from n/a through = 3.9.2...

CVE-2025-62063 WordPress WP Travel Gutenberg Blocks plugin <= 3.9.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Travel WP Travel Gutenberg Blocks wp-travel-blocks.This issue affects WP Travel Gutenberg Blocks: from n/a through = 3.9.2...

CVE-2025-62063

CVE-2025-62063 is a cross-site scripting vulnerability in the WordPress plugin WP Travel Gutenberg Blocks (affected: versions ≤ 3.9.2). The issue stems from improper input neutralization during web page generation, enabling XSS. Public references in Wordfence Intelligence and PatchStack confirm t...

CVE-2025-62025 WordPress JobSearch plugin < 3.0.8 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in eyecix JobSearch wp-jobsearch.This issue affects JobSearch: from n/a through 3.0.8...

CVE-2025-62006 WordPress WP SMS plugin <= 7.0.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in VeronaLabs WP SMS wp-sms.This issue affects WP SMS: from n/a through = 7.0.1...

CVE-2025-60227 WordPress WP Pipes plugin <= 1.4.3 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in ThimPress WP Pipes wp-pipes allows Path Traversal.This issue affects WP Pipes: from n/a through = 1.4.3...

CVE-2025-60134

CVE-2025-60134 is a Cross‑Site Request Forgery (CSRF) vulnerability in the WordPress plugin WP Media Categories (wp-media-categories), affecting WP Media Categories from n/a through 2.1.0. The connected Red Hat/NVD entries describe a CSRF issue but do not provide a concrete fix/version or remedia...

CVE-2025-49954 WordPress WP-Click-Tracker Plugin <= 0.7.3 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in mithra62 WP-Click-Tracker wp-click-track allows Reflected XSS.This issue affects WP-Click-Tracker: from n/a through = 0.7.3...

CVE-2025-49948 WordPress WP Super Edit plugin <= 2.5.4 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ahmad Awais WP Super Edit wp-super-edit allows Reflected XSS.This issue affects WP Super Edit: from n/a through = 2.5.4...

CVE-2025-49948 WordPress WP Super Edit plugin <= 2.5.4 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ahmad Awais WP Super Edit wp-super-edit allows Reflected XSS.This issue affects WP Super Edit: from n/a through = 2.5.4...

CVE-2025-48338 WordPress WP Abstracts plugin <= 2.7.4 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Kevon Adonis WP Abstracts wp-abstracts-manuscripts-manager allows PHP Local File Inclusion.This issue affects WP Abstracts: from n/a through = 2.7.4...

CVE-2025-11819

The WP-Thumbnail plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'roboshot' shortcode in all versions up to, and including, 1.1. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

EUVD-2025-35330

The WP Restaurant Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' parameter of the restaurantsummary shortcode in all versions up to, and including, 1.0.2. This is due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-11809 WP-Force Images Download <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The WP-Force Images Download plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpfid' shortcode in all versions up to, and including, 1.8. This is due to insufficient input sanitization and output escaping on the 'class' attribute. This makes it possible for authenticated...

CVE-2025-11809

CVE-2025-11809 refers to the WP-Force Images Download plugin for WordPress (versions up to 1.8). The issue is a Stored XSS via the wpfid shortcode caused by insufficient input sanitization/output escaping on the class attribute. Exploitation requires attacker with contributor+ privileges; the pay...

CVE-2025-11834

The CVE CVE-2025-11834 (WP AD Gallery) affects WordPress WP AD Gallery plugin versions ≤ 1.3, with stored XSS via the startindex parameter in the ad-gallery shortcode. Root cause: insufficient input sanitization and output escaping; authenticated attackers with contributor-level access can inject...

PT-2025-43229

Name of the Vulnerable Software and Affected Versions WP Store Locator versions through 2.2.260 Description The software contains a flaw due to deserialization of untrusted data, which allows for object injection. This issue impacts the wp-store-locator plugin. Recommendations Update WP Store...

PT-2025-43175

Name of the Vulnerable Software and Affected Versions RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter versions through 1.3.3.9 Description The software contains a missing authorization issue due to incorrectly configured access control security levels. This allows for unauthorized access...