CVE-2025-28972

CVE-2025-28972 is an SQL injection vulnerability in the WordPress plugin “WP Employee Attendance System” affecting version 3.5 and earlier. The described root cause is improper neutralization of special elements in SQL commands, enabling blind SQL injection. Public references indicate the issue i...

CVE-2025-47452 WordPress WP VR <= 8.5.26 - Arbitrary File Upload Vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in RexTheme WP VR allows Upload a Web Shell to a Web Server. This issue affects WP VR: from n/a through 8.5.26...

CVE-2025-47452 WordPress WP VR plugin <= 8.5.26 - Arbitrary File Upload Vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in RexTheme WP VR wpvr allows Upload a Web Shell to a Web Server.This issue affects WP VR: from n/a through = 8.5.26...

CVE-2025-47452

CVE-2025-47452 concerns RexTheme WP VR (WP VR) with an Unrestricted Upload of File with Dangerous Type vulnerability, allowing a Web Shell upload on servers running WP VR up to version 8.5.26. The vulnerability arises from an unsafe file upload handling in WP VR, affecting versions through 8.5.26...

CVE-2025-48145 WordPress Track, Analyze & Optimize by WP Tao plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Michal Jaworski Track, Analyze & Optimize by WP Tao wp-tao allows Reflected XSS.This issue affects Track, Analyze & Optimize by WP Tao: from n/a through = 1.3...

CVE-2025-48274 WordPress WP Job Portal <= 2.3.2 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in wpjobportal WP Job Portal allows Blind SQL Injection. This issue affects WP Job Portal: from n/a through 2.3.2...

CVE-2025-48274

CVE-2025-48274 affects WP Job Portal

CVE-2025-48145

CVE-2025-48145 affects Track, Analyze & Optimize by WP Tao (WordPress plugin). The issue is a Reflected Cross-Site Scripting (XSS) vulnerability arising from improper neutralization of input during web page generation. Affected versions are from n/a through 1.3. The CVSS 3.1 vector is CVSS:3.1/AV...

CVE-2025-48274 WordPress WP Job Portal plugin <= 2.3.2 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in wpjobportal WP Job Portal wp-job-portal allows Blind SQL Injection.This issue affects WP Job Portal: from n/a through = 2.3.2...

CVE-2025-49234 WordPress WP Dummy Content Generator plugin <= 3.4.6 - Arbitrary User Deletion vulnerability

Missing Authorization vulnerability in Deepak anand WP Dummy Content Generator allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Dummy Content Generator: from n/a through 3.4.6...

CVE-2025-49234

CVE-2025-49234 affects WP Dummy Content Generator (WordPress plugin) up to version 3.4.6. The issue is described as Missing Authorization, enabling exploitation of improperly configured access control to perform Arbitrary User Deletion. The CVE entry and connected sources confirm the vulnerable c...

CVE-2025-49234 WordPress WP Dummy Content Generator plugin <= 3.4.6 - Arbitrary User Deletion vulnerability

Missing Authorization vulnerability in Deepak anand WP Dummy Content Generator wp-dummy-content-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Dummy Content Generator: from n/a through = 3.4.6...

CVE-2025-49859 WordPress WP Views Counter plugin <= 2.0.3 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in etruel WP Views Counter wpecounter allows Stored XSS.This issue affects WP Views Counter: from n/a through = 2.0.3...

CVE-2025-49859 WordPress WP Views Counter plugin <= 2.0.3 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in etruel WP Views Counter wpecounter allows Stored XSS.This issue affects WP Views Counter: from n/a through = 2.0.3...

CVE-2025-49859

CVE-2025-49859 is a stored XSS vulnerability in the WordPress plugin WP Views Counter (versions up to and including 2.0.3). The issue arises from improper input neutralization during web page generation, permitting stored cross-site scripting. Affected software is the WP Views Counter plugin for ...

CVE-2025-49863

CVE-2025-49863 affects the WordPress plugin WP Codeus Advanced Sermons (versions n/a through 3.6). The vulnerability is an improper neutralization of input leading to Stored XSS when generating web pages. Exploitation details are not provided in the connected documents beyond the disclosure of a ...

PT-2025-25692 · WordPress · Wp Dummy Content Generator

Name of the Vulnerable Software and Affected Versions: WP Dummy Content Generator versions 3.4.6 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploitation of incorrectly configured access control security levels. Recommendations: For WP Dumm...

PT-2025-25723 · WordPress · Wp Codeus Advanced Sermons

Name of the Vulnerable Software and Affected Versions: WP Codeus Advanced Sermons versions n/a through 3.6 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

WordPress Backup and Staging by WP Time Capsule plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in the WordPress Backup and Staging by WP Time Capsule plugin that stems from improper input neutralization and can be exploited by a...

PT-2025-25720 · WordPress · Wp Views Counter

Name of the Vulnerable Software and Affected Versions: WP Views Counter versions n/a through 2.0.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Stored XSS. This means that an attacker can injec...