PT-2025-36209

Name of the Vulnerable Software and Affected Versions: DeBAAT WP-GraphViz versions through 1.5.1 Description: The DeBAAT WP-GraphViz plugin contains a DOM-Based Cross-Site Scripting XSS issue. This improper neutralization of input during web page generation allows for potential exploitation...

CVE-2025-58625

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Spiffy Plugins WP Flow Plus wp-imageflow2 allows Stored XSS.This issue affects WP Flow Plus: from n/a through = 5.2.5...

CVE-2025-58615

CVE-2025-58615 is a Server-Side Request Forgery (SSRF) vulnerability in the WordPress plugin WP Bannerize Pro. Public records in connected sources indicate affected versions are from n/a through 1.10.0. The vulnerability stems from improper handling of server-side requests, enabling an attacker t...

CVE-2025-58605 WordPress WP Delicious Plugin <= 1.8.7 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Delicious WP Delicious delicious-recipes allows Stored XSS.This issue affects WP Delicious: from n/a through = 1.8.7...

CVE-2025-58605 WordPress WP Delicious Plugin <= 1.8.7 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Delicious WP Delicious delicious-recipes allows Stored XSS.This issue affects WP Delicious: from n/a through = 1.8.7...

PT-2025-35749

Name of the Vulnerable Software and Affected Versions: WP Bannerize Pro versions n/a through 1.10.0 Description: A Server-Side Request Forgery SSRF vulnerability exists in WP Bannerize Pro. This issue allows Server Side Request Forgery. Recommendations: Update WP Bannerize Pro to a version later...

PT-2025-35739

Name of the Vulnerable Software and Affected Versions: WP Delicious versions through 1.8.7 Description: WP Delicious is susceptible to a cross-site scripting XSS issue due to improper neutralization of input during web page generation. This allows for stored XSS attacks. Recommendations: Update W...

WordPress plugin WP Bannerize Pro 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A code issue...

WordPress plugin WP Delicious 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-35758

Name of the Vulnerable Software and Affected Versions: WP Flow Plus versions through 5.2.5 Description: The software contains an Improper Neutralization of Input During Web Page Generation issue, which allows for Stored Cross-site Scripting XSS. Recommendations: Update WP Flow Plus to a version...

CVE-2025-52761

Deserialization of Untrusted Data vulnerability in manfcarlo WP Funnel Manager wp-funnel-manager allows Object Injection.This issue affects WP Funnel Manager: from n/a through = 1.4.0...

CVE-2025-48312

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in 文派翻译（WP Chinese Translation） WPAvatar wpavatar allows Stored XSS.This issue affects WPAvatar: from n/a through = 1.9.4...

CVE-2025-53572 WordPress WP Easy Contact Plugin <= 4.0.1 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in emarket-design WP Easy Contact wp-easy-contact allows Object Injection.This issue affects WP Easy Contact: from n/a through = 4.0.1...

CVE-2025-48327

CVE-2025-48327 corresponds to a Missing Authorization vulnerability in the WP Mailgun SMTP plugin (versions up to 1.0.7). Affected product: WP Mailgun SMTP. Root cause: lack of proper ACL enforcement allows accessing functionality not properly constrained. Public references in connected sources c...

PT-2025-35078

Name of the Vulnerable Software and Affected Versions: WpEvently versions through 4.4.8 Description: Deserialization of untrusted data in WpEvently allows for object injection. Recommendations: Update WpEvently to a version later than 4.4.8...

PT-2025-34960

Name of the Vulnerable Software and Affected Versions: WP ULike Pro versions prior to 1.9.4 Description: The WP ULike Pro plugin for WordPress is susceptible to arbitrary file uploads due to inadequate file type validation within the WP Ulike Pro File Uploader class. This allows unauthenticated...

PT-2025-35019

Name of the Vulnerable Software and Affected Versions: AutoWP versions through 2.2.2 Description: A missing authorization flaw exists in Neuralabz LTD AutoWP, allowing exploitation due to incorrectly configured access control security levels. Recommendations: AutoWP versions prior to 2.2.3 are...

WordPress plugin WP Easy Contact 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

Linux Distros Unpatched Vulnerability : CVE-2023-22622

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes...

CVE-2025-8490 All-in-One WP Migration and Backup <= 7.97 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Import in all versions up to, and including, 7.97 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-lev...