CVE-2025-49982

Missing Authorization vulnerability in aguilatechnologies WP Customer Area customer-area allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Customer Area: from n/a through = 8.3.4...

CVE-2025-49980

Missing Authorization vulnerability in WP Event Manager WP User Profile Avatar wp-user-profile-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Profile Avatar: from n/a through = 1.0.6...

CVE-2025-49977

Cross-Site Request Forgery CSRF vulnerability in WP Inventory WP Inventory Manager wp-inventory-manager allows Cross Site Request Forgery.This issue affects WP Inventory Manager: from n/a through = 2.3.4...

CVE-2025-49977

CVE-2025-49977: CSRF vulnerability in the WordPress WP Inventory Manager plugin (affected: ≤2.3.4). Root cause is CSRF allowing unauthorized actions. Exploitation details are not provided in the documents; patches exist as of 2024–2026, and the fix is included in a newer version. Affected product...

CVE-2025-49977

Cross-Site Request Forgery CSRF vulnerability in WP Inventory WP Inventory Manager wp-inventory-manager allows Cross Site Request Forgery.This issue affects WP Inventory Manager: from n/a through = 2.3.4...

CVE-2025-49977 WordPress WP Inventory Manager plugin <= 2.3.4 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in WP Inventory WP Inventory Manager allows Cross Site Request Forgery. This issue affects WP Inventory Manager: from n/a through 2.3.4...

CVE-2025-49977 WordPress WP Inventory Manager plugin <= 2.3.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in WP Inventory WP Inventory Manager wp-inventory-manager allows Cross Site Request Forgery.This issue affects WP Inventory Manager: from n/a through = 2.3.4...

CVE-2025-49980 WordPress WP User Profile Avatar plugin <= 1.0.6 - Broken Access Control Vulnerability

Missing Authorization vulnerability in WP Event Manager WP User Profile Avatar wp-user-profile-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Profile Avatar: from n/a through = 1.0.6...

CVE-2025-49980

CVE-2025-49980 concerns the WordPress plugin WP User Profile Avatar (affected: versions up to 1.0.6) and is a Missing Authorization / broken access control vulnerability. The CVE describes an exposure where access control is misconfigured, enabling exploitation via unauthorized actions. Public so...

CVE-2025-49980 WordPress WP User Profile Avatar plugin <= 1.0.6 - Broken Access Control Vulnerability

Missing Authorization vulnerability in WP Event Manager WP User Profile Avatar allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP User Profile Avatar: from n/a through 1.0.6...

CVE-2025-49982

Missing Authorization vulnerability in aguilatechnologies WP Customer Area customer-area allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Customer Area: from n/a through = 8.3.4...

CVE-2025-49982

CVE-2025-49982 concerns the WordPress plugin WP Customer Area (aguilatechnologies) with a missing/incorrect authorization issue leading to broken access control in versions up to 8.2.5. The vulnerability’s impact is described as unauthorized access due to misconfigured access control levels. Publ...

CVE-2025-49991

CVE-2025-49991 is a Missing Authorization/broken access control vulnerability in the WordPress plugin WP-Recall (versions up to and including 16.26.14). The issue permits accessing functionality not properly constrained by ACLs. Public details confirm WP-Recall versions before 16.26.14 are affect...

CVE-2025-49991 WordPress WP-Recall plugin <= 16.26.14 - Broken Access Control Vulnerability

Missing Authorization vulnerability in tggfref WP-Recall allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects WP-Recall: from n/a through 16.26.14...

CVE-2025-49996 WordPress WP Visitor Statistics (Real Time Traffic) plugin <= 8.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in osama.esh WP Visitor Statistics Real Time Traffic wp-stats-manager allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Visitor Statistics Real Time Traffic: from n/a through = 8.4...

CVE-2025-49996

CVE-2025-49996 affects the WordPress plugin WP Visitor Statistics (Real Time Traffic) (WP-Stats-Manager). The issue is Missing Authorization / Broken Access Control, allowing access to functionality not properly constrained by ACLs. Public records indicate affected versions range to 7.8 (per CVE/...

CVE-2025-50017 WordPress WP Voting Contest plugin <= 5.8 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Matt WP Voting Contest wp-voting-contest allows Stored XSS.This issue affects WP Voting Contest: from n/a through = 5.8...

CVE-2025-50017 WordPress WP Voting Contest plugin <= 5.8 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Matt WP Voting Contest wp-voting-contest allows Stored XSS.This issue affects WP Voting Contest: from n/a through = 5.8...

CVE-2025-50017

CVE-2025-50017 is a stored XSS in the WordPress plugin WP Voting Contest (versions n/a through 5.8). The issue stems from improper input neutralization during web page generation, enabling attacker-supplied input to be stored and later reflected to users. According to sources, the vulnerability a...

CVE-2025-50022

CVE-2025-50022 is a stored XSS in the WordPress plug‑in WP-FB-AutoConnect. Affected versions are WP-FB-AutoConnect up to 4.6.3 (per NVD/Red Hat/CVE records). Root cause: improper neutralization of input during web page generation leading to stored cross‑site scripting. Public details indicate the...