16430 matches found
PT-2025-27822 · Unknown · Wpcenter Aibud Wp
Name of the Vulnerable Software and Affected Versions: WPCenter AiBud WP versions 1.8.5 and earlier Description: The issue affects WPCenter AiBud WP, allowing an unrestricted upload of a file with a dangerous type, which enables uploading a web shell to a web server. Recommendations: For versions...
Malicious code in wp-stream (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7bd25807808ab0722baeb487925a65428a1198b9ff17c596ae5c3a7ec1d05161 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-5588 Malicious code in wp-stream (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7bd25807808ab0722baeb487925a65428a1198b9ff17c596ae5c3a7ec1d05161 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2025-3745
The WP Lightbox 2 WordPress plugin before 3.0.6.8 does not correctly sanitize the value of the title attribute of links before using them, which may allow malicious users to conduct XSS attacks...
CVE-2025-3848
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2025-25171. Reason: This candidate is a reservation duplicate of CVE-2025-25171. Notes: All CVE users should reference CVE-2025-25171 instead of this candidate. All references and descriptions in this candidate have been...
CVE-2024-11405 WP Front-end login and register <= 2.1.0 - Reflected Cross-Site Scripting
The WP Front-end login and register plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the email and wpmpresetpasswordtoken parameters in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2025-3848
The WP SmartPay WordPress plugin (versions 1.1.0–2.7.13) is vulnerable to privilege escalation via account takeover due to improper validation in the update() function. An authenticated user with Subscriber level or higher can change arbitrary users’ emails (including admins) and then reset passw...
PT-2025-27585 · WordPress · Wp Smartpay
Name of the Vulnerable Software and Affected Versions: WP SmartPay plugin for WordPress versions 1.1.0 through 2.7.13 Description: The issue is related to privilege escalation via account takeover. This occurs because the plugin does not properly validate a user's identity before updating their...
CVE-2025-3745
The WP Lightbox 2 WordPress plugin before 3.0.6.8 does not correctly sanitize the value of the title attribute of links before using them, which may allow malicious users to conduct XSS attacks...
CVE-2025-3745 WP Lightbox 2 < 3.0.6.8 - Unauthenticated Stored XSS
The WP Lightbox 2 WordPress plugin before 3.0.6.8 does not correctly sanitize the value of the title attribute of links before using them, which may allow malicious users to conduct XSS attacks...
CVE-2025-3745 WP Lightbox 2 < 3.0.6.8 - Unauthenticated Stored XSS
The WP Lightbox 2 WordPress plugin before 3.0.6.8 does not correctly sanitize the value of the title attribute of links before using them, which may allow malicious users to conduct XSS attacks...
CVE-2025-3745
CVE-2025-3745 affects the WordPress plugin WP Lightbox 2, versions prior to 3.0.6.8. Root cause: the title attribute of links is not properly sanitized before use, enabling unauthenticated stored XSS. Impact is as described in public sources; remediation: upgrade to 3.0.6.8 or later (no exploit d...
CVE-2025-6350
The WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘hotspot-hover’ parameter in all versions up to, and including, 8.5.32 due to insufficient input sanitization and output escaping. This makes it possible...
PT-2025-27410 · WordPress · Wp Lightbox 2
Name of the Vulnerable Software and Affected Versions: WP Lightbox 2 versions prior to 3.0.6.8 Description: The issue concerns the incorrect sanitization of the title attribute in links, potentially allowing malicious users to conduct cross-site scripting XSS attacks. Recommendations: For version...
CVE-2025-53253
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Josh WP Edit wp-edit allows Stored XSS.This issue affects WP Edit: from n/a through = 4.0.4...
CVE-2025-53318
Missing Authorization vulnerability in WPManiax WP DB Booster wp-db-booster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP DB Booster: from n/a through = 1.0.1...
CVE-2025-53292
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in samsk WP DataTable wp-datatable allows DOM-Based XSS.This issue affects WP DataTable: from n/a through = 0.2.7...
CVE-2025-53261
Cross-Site Request Forgery CSRF vulnerability in macbookandrew WP YouTube Live wp-youtube-live allows Cross Site Request Forgery.This issue affects WP YouTube Live: from n/a through = 1.10.0...
CVE-2025-53320
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Wp Enhanced Free Downloads EDD allows DOM-Based XSS. This issue affects Free Downloads EDD: from n/a through 1.0.4...