CVE-2025-49332 WordPress WP Time Slots Booking Form plugin <= 1.2.30 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in codepeople WP Time Slots Booking Form wp-time-slots-booking-form allows Cross Site Request Forgery.This issue affects WP Time Slots Booking Form: from n/a through = 1.2.30...

CVE-2025-49317 WordPress WP Page Loading plugin <= 1.0.6 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in NTC WP Page Loading wp-page-loading allows Cross Site Request Forgery.This issue affects WP Page Loading: from n/a through = 1.0.6...

CVE-2025-49317

CVE-2025-49317 describes a CSRF vulnerability in the WordPress plugin "WP Page Loading". Affected versions are from n/a through 1.0.6. The issue is untrusted state-changing requests via CSRF; exploitation details are not provided in the documents. The connected sources indicate this CVE entry has...

CVE-2025-49307 WordPress WP Multilang plugin <= 2.4.19 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Magazine3 WP Multilang wp-multilang allows PHP Local File Inclusion.This issue affects WP Multilang: from n/a through = 2.4.19...

CVE-2025-49307

WP Multilang (WordPress plugin) is affected by CVE-2025-49307, an authenticated Local File Inclusion via PHP Include/Require (PHP Remote File Inclusion) in versions up to 2.4.19. The CVE entry indicates an authenticated context (Contributor+), with exploitation potential linked to LFI, resulting ...

CVE-2025-49307 WordPress WP Multilang <= 2.4.19 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Magazine3 WP Multilang allows PHP Local File Inclusion. This issue affects WP Multilang: from n/a through 2.4.19...

CVE-2025-49308 WordPress WP Travel Engine plugin <= 6.5.1 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in WP Travel Engine WP Travel Engine wp-travel-engine allows PHP Local File Inclusion.This issue affects WP Travel Engine: from n/a through = 6.5.1...

CVE-2025-49308 WordPress WP Travel Engine <= 6.5.1 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in WP Travel Engine WP Travel Engine allows PHP Local File Inclusion. This issue affects WP Travel Engine: from n/a through 6.5.1...

CVE-2025-49308

CVE-2025-49308 affects WP Travel Engine (WordPress plugin) up to version 6.5.1. It is a PHP include/require filename control issue that enables Local File Inclusion (LFI) via a PHP Remote File Inclusion pattern. The entry notes the vulnerability as authenticated LFI and is marked as patched in la...

CVE-2025-49306 WordPress WP Social Widget plugin <= 2.3 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in catchsquare WP Social Widget wp-social-widget allows Stored XSS.This issue affects WP Social Widget: from n/a through = 2.3...

CVE-2025-49306 WordPress WP Social Widget plugin <= 2.3 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in catchsquare WP Social Widget wp-social-widget allows Stored XSS.This issue affects WP Social Widget: from n/a through = 2.3...

CVE-2025-49306

CVE-2025-49306 is a stored XSS in WordPress WP Social Widget due to improper input neutralization during web page generation. Affected: WP Social Widget up to version 2.3 (including). The connected sources (Wordfence WordPress vulnerability report) confirm stored XSS and affected version, but do ...

CVE-2025-49288 WordPress Ultimate WP Mail <= 1.3.5 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Rustaurius Ultimate WP Mail allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ultimate WP Mail: from n/a through 1.3.5...

CVE-2025-49288

CVE-2025-49288 – A Missing Authorization vulnerability in the WordPress plugin Ultimate WP Mail (ultimate-wp-mail) allows Authentication Bypass in versions

CVE-2025-49285 WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 3.8.0 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent allows Cross Site Request Forgery. This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through 3.8.0...

CVE-2025-49286 WordPress WP Table Builder plugin <= 2.0.6 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in WP Table Builder WP Table Builder wp-table-builder allows Cross Site Request Forgery.This issue affects WP Table Builder: from n/a through = 2.0.6...

CVE-2025-49285

CVE-2025-49285 is a CSRF vulnerability in the WP Cookie Notice for GDPR, CCPA & ePrivacy Consent WordPress plugin. Reported as affecting versions from n/a up to 3.8.0. The connected Red Hat and Wordfence records confirm a CSRF issue but do not provide details on exploit vectors beyond the CSRF la...

CVE-2025-49286 WordPress WP Table Builder plugin <= 2.0.6 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in WP Table Builder WP Table Builder wp-table-builder allows Cross Site Request Forgery.This issue affects WP Table Builder: from n/a through = 2.0.6...

CVE-2025-49285 WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 3.8.0 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent gdpr-cookie-consent allows Cross Site Request Forgery.This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through = 3.8.0...

CVE-2025-49286

CVE-2025-49286 is a CSRF vulnerability in WP Table Builder, affecting versions from 0 through 2.0.6. The connected sources specify a CSRF flaw with an overall CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, base score 4.3 (Medium). The vulnerability permits cross-site requests without au...