CVE-2025-53261

Cross-Site Request Forgery CSRF vulnerability in macbookandrew WP YouTube Live wp-youtube-live allows Cross Site Request Forgery.This issue affects WP YouTube Live: from n/a through = 1.10.0...

CVE-2025-53320

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Wp Enhanced Free Downloads EDD allows DOM-Based XSS. This issue affects Free Downloads EDD: from n/a through 1.0.4...

CVE-2025-53278

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPeka WP AdCenter wpadcenter allows Stored XSS.This issue affects WP AdCenter: from n/a through = 2.6.0...

CVE-2025-53306

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in lucidcrew WP Forum Server forum-server allows SQL Injection.This issue affects WP Forum Server: from n/a through = 1.8.2...

CVE-2025-53314

Cross-Site Request Forgery CSRF vulnerability in sh1zen WP Optimizer wp-optimizer allows SQL Injection.This issue affects WP Optimizer: from n/a through = 2.5.0...

CVE-2025-53274

Cross-Site Request Forgery CSRF vulnerability in Hossin Asaadi WP Permalink Translator wp-permalink-translator allows Stored XSS.This issue affects WP Permalink Translator: from n/a through = 1.7.6...

CVE-2025-53269

Cross-Site Request Forgery CSRF vulnerability in imw3 My Wp Brand my-wp-brand allows Cross Site Request Forgery.This issue affects My Wp Brand: from n/a through = 1.1.3...

CVE-2025-53290

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in anonymized-15272943 WP Visual Sitemap wp-visual-sitemap allows Stored XSS.This issue affects WP Visual Sitemap: from n/a through = 1.0.2...

CVE-2025-53305

Cross-Site Request Forgery CSRF vulnerability in lucidcrew WP Forum Server forum-server allows Stored XSS.This issue affects WP Forum Server: from n/a through = 1.8.2...

CVE-2025-25171

Authentication Bypass Using an Alternate Path or Channel vulnerability in Convers Lab WP SmartPay smartpay allows Authentication Abuse.This issue affects WP SmartPay: from n/a through = 2.7.13...

CVE-2025-28988

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in aharonyan WP Front User Submit / Front Editor front-editor allows Reflected XSS.This issue affects WP Front User Submit / Front Editor: from n/a through = 4.9.3...

CVE-2025-28970

Deserialization of Untrusted Data vulnerability in pep.vn WP Optimize By xTraffic wp-optimize-by-xtraffic allows Object Injection.This issue affects WP Optimize By xTraffic: from n/a through = 5.1.6...

CVE-2025-6381

The BeeTeam368 Extensions plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.4 via the handleremovetempfile function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform actions on files outside of...

CVE-2025-6379

The BeeTeam368 Extensions Pro plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.4 via the handlelivefn function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform actions on files outside of the...

CVE-2025-6350

CVE-2025-6350 corresponds to a stored XSS vulnerability in the WordPress plugin “WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress.” The issue affects all versions up to and including 8.5.32 and arises from insufficient input sanitization and output escaping in the hotspot-hover pa...

CVE-2025-6350 WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress <= 8.5.32 - Authenticated (Contributor+) Stored Cross-Site Scripting

The WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘hotspot-hover’ parameter in all versions up to, and including, 8.5.32 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2025-6258

The WP SoundSystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpsstm-track shortcode in all versions up to, and including, 3.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-6383

The WP-PhotoNav plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's photonav shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

PT-2025-27284 · WordPress · Wp Vr – 360 Panorama/Free Virtual Tour Builder For Wordpress

Name of the Vulnerable Software and Affected Versions: WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress versions up to, and including, 8.5.32 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows...

PT-2025-27286 · WordPress · Beeteam368 Extensions

Name of the Vulnerable Software and Affected Versions: BeeTeam368 Extensions plugin for WordPress versions up to, and including, 2.3.4 Description: The issue allows authenticated attackers with Subscriber-level access and above to perform actions on files outside of the originally intended...