16437 matches found
CVE-2025-50022
CVE-2025-50022 is a stored XSS in the WordPress plug‑in WP-FB-AutoConnect. Affected versions are WP-FB-AutoConnect up to 4.6.3 (per NVD/Red Hat/CVE records). Root cause: improper neutralization of input during web page generation leading to stored cross‑site scripting. Public details indicate the...
CVE-2025-50022 WordPress WP-FB-AutoConnect plugin <= 4.6.3 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in justink WP-FB-AutoConnect allows Stored XSS. This issue affects WP-FB-AutoConnect: from n/a through 4.6.3...
CVE-2025-50042 WordPress WP Register Profile With Shortcode plugin <= 3.6.1 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in aviplugins.com WP Register Profile With Shortcode allows Stored XSS. This issue affects WP Register Profile With Shortcode: from n/a through 3.6.1...
CVE-2025-50051
CVE-2025-50051 is a stored XSS in WordPress WP-Members (WP-Members plugin) up to version 3.5.4, caused by improper input neutralization during web page generation. Affected: WP-Members
CVE-2025-50051 WordPress WP-Members plugin <= 3.5.4 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Chad Butler WP-Members allows Stored XSS.This issue affects WP-Members: from n/a through 3.5.4...
CVE-2025-50051 WordPress WP-Members plugin <= 3.5.4 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Chad Butler WP-Members wp-members allows Stored XSS.This issue affects WP-Members: from n/a through = 3.5.4...
CVE-2025-52790 WordPress WP-DownloadCounter plugin <= 1.01 - Cross Site Request Forgery (CSRF) Vulnerability
Cross-Site Request Forgery CSRF vulnerability in r-win WP-DownloadCounter wp-downloadcounter allows Stored XSS.This issue affects WP-DownloadCounter: from n/a through = 1.01...
CVE-2025-52790
CVE-2025-52790 : Cross-Site Request Forgery (CSRF) vulnerability in the WP-DownloadCounter WordPress plugin allows Stored XSS for WP-DownloadCounter versions <= 1.01. The NVD entry lists CVSS 3.1 with base score 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Exploitation status is not provided in ...
CVE-2025-52795
CVE-2025-52795 : CSRF in WordPress plugin “WP Front User Submit / Front Editor” affects versions up to 4.9.4. Root cause is CSRF that can trigger actions without proper authorization. CVSS v3.1 base score 7.1 (HIGH): network vector, low attack complexity, user interaction required, no confidentia...
CVE-2025-52802
CVE-2025-52802 describes a Missing Authorization / Broken Access Control vulnerability in the WordPress plugin “Import YouTube videos as WP Posts” (versions n/a–2.1). The issue arises from incorrectly configured access control, enabling unauthorized actions that affect WP Posts created via the pl...
CVE-2025-52822
CVE-2025-52822 : SQL Injection in WordPress WP Roadmap plugin (
CVE-2025-52822 WordPress WP Roadmap plugin <= 2.1.3 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Iqonic Design WP Roadmap wp-roadmap allows SQL Injection.This issue affects WP Roadmap: from n/a through = 2.1.3...
CVE-2025-52822 WordPress WP Roadmap plugin <= 2.1.3 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Iqonic Design WP Roadmap wp-roadmap allows SQL Injection.This issue affects WP Roadmap: from n/a through = 2.1.3...
PT-2025-26374 · WordPress · Matt Wp Voting Contest
Name of the Vulnerable Software and Affected Versions: Matt WP Voting Contest versions n/a through 5.8 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...
PT-2025-26345 · WordPress · Wp Inventory Manager
Name of the Vulnerable Software and Affected Versions: WP Inventory Manager versions prior to 2.3.4 Description: A Cross-Site Request Forgery CSRF issue affects the WP Inventory Manager, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For versions prior to 2.3....
WordPress plugin WP-Members 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
WordPress plugin WP-FB-AutoConnect 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...
PT-2025-26418 · WordPress · Wp-Downloadcounter
Name of the Vulnerable Software and Affected Versions: WP-DownloadCounter versions 1.01 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application,...
PT-2025-26350 · WordPress · Wp Customer Area
Name of the Vulnerable Software and Affected Versions: WP Customer Area versions 8.2.5 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For WP Customer Area...
PT-2025-26402 · WordPress · Wp-Members
Name of the Vulnerable Software and Affected Versions: WP-Members versions through 3.5.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject malicious...