CVE-2025-9816 WP Statistics <= 14.5.4 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header

The WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the User-Agent Header in all versions up to, and including, 14.5.4 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-9044

The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple fields in versions up to, and including, 1.20.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level permissions and...

PT-2025-39709

Name of the Vulnerable Software and Affected Versions WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin versions through 14.5.4 Description The software is susceptible to Stored Cross-Site Scripting through the User-Agent Header due to inadequate input sanitization and output...

WordPress wp-mpdf Plugin <= 3.9.1 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin wp-mpdf versions = 3.9.1...

CVE-2025-60155

Missing Authorization vulnerability in loopus WP Virtual Assistant VirtualAssistant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Virtual Assistant: from n/a through = 3.0...

CVE-2025-60120

Missing Authorization vulnerability in WPDirectoryKit WP Directory Kit wpdirectorykit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Directory Kit: from n/a through = 1.4.0...

CVE-2025-60040

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in fkrauthan wp-mpdf wp-mpdf allows Stored XSS.This issue affects wp-mpdf: from n/a through = 3.9.1...

CVE-2025-60155

CVE-2025-60155 refers to a missing-authorization vulnerability in WP Virtual Assistant. Connected sources confirm affected software: WP Virtual Assistant (≤3.0). The CVE lists a CVSS v3.1 base score of 5.3 (Medium) with network attack vector, no privileges required, and potential low integrity im...

CVE-2025-60040 WordPress wp-mpdf Plugin <= 3.9.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in fkrauthan wp-mpdf wp-mpdf allows Stored XSS.This issue affects wp-mpdf: from n/a through = 3.9.1...

CVE-2025-9044

The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple fields in versions up to, and including, 1.20.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level permissions and...

CVE-2025-9044 Mapster WP Maps <= 1.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple fields in versions up to, and including, 1.20.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level permissions and...

CVE-2025-9044 Mapster WP Maps <= 1.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple fields in versions up to, and including, 1.20.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level permissions and...

CVE-2025-9044

CVE-2025-9044 : Mapster WP Maps (WordPress plugin) is affected by a Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. Exploitation requires authentication (contributor level or higher) and can allow injection of web scripts on pages viewed by users. Affected ...

PT-2025-39512

Name of the Vulnerable Software and Affected Versions WP-DownloadManager plugin for WordPress versions prior to 1.68.12 Description The WP-DownloadManager plugin for WordPress is susceptible to unrestricted file uploads because of a lack of file type validation within the download-add.php file...

WordPress plugin WP Virtual Assistant 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

WordPress plugin WP Ticket Customer Service Software & Support Ticket System Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which provides the ability to set up a personal blog site on a PHP and MySQL based...

PT-2025-39567

Name of the Vulnerable Software and Affected Versions WP Directory Kit versions through 1.3.8 Description The software contains a missing authorization issue related to incorrectly configured access control security levels. Recommendations Update WP Directory Kit to a version later than 1.3.8...

WordPress plugin wp-mpdf 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to set up personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site...

WordPress plugin Mapster WP Maps 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripti...

WordPress plugin Recaptcha wp 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripti...