WordPress plugin Ultimate WP Mail SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection...

PT-2025-20090 · Unknown · Wp Gravity Forms Zendesk

Name of the Vulnerable Software and Affected Versions: WP Gravity Forms Zendesk versions 1.1.2 and earlier Description: The issue is related to a URL Redirection to Untrusted Site, also known as an 'Open Redirect' vulnerability, which can be used for Phishing attacks. Recommendations: For WP...

PT-2025-20137 · Unknown · Seb Wp Dpe-Ges

Name of the Vulnerable Software and Affected Versions: Seb WP DPE-GES versions 1.6 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows DOM-Based XSS. This means that an attacker could...

WordPress plugin WP Maintenance 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

PT-2025-20226 · Unknown · Smaily For Wp

Name of the Vulnerable Software and Affected Versions: Smaily for WP versions 3.1.6 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. Recommendations: For versions 3.1.6 and earlier,...

PT-2025-20185 · WordPress · Aharonyan Wp Front Editor +1

Name of the Vulnerable Software and Affected Versions: aharonyan WP Front User Submit / Front Editor versions n/a through 4.9.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS in...

PT-2025-20207 · WordPress · Wp-Recall

Name of the Vulnerable Software and Affected Versions: WP-Recall versions through 16.26.14 Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion in...

PT-2025-20084 · WordPress · Thimpress Wp Hotel Booking

Name of the Vulnerable Software and Affected Versions: ThimPress WP Hotel Booking versions n/a through 2.1.9 Description: A Cross-Site Request Forgery CSRF issue affects ThimPress WP Hotel Booking, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For versions n/...

PT-2025-20144 · Unknown · Aweos Wp Lock

Name of the Vulnerable Software and Affected Versions: AWEOS WP Lock versions 1.4.8 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This enables attackers to inject malicious...

PT-2025-20116 · Unknown · Rustaurius Ultimate Wp Mail

Name of the Vulnerable Software and Affected Versions: Rustaurius Ultimate WP Mail versions 1.3.4 and below Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows unauthorized access and enables...

PT-2025-20214 · WordPress · Thimpress Wp Pipes

Name of the Vulnerable Software and Affected Versions: ThimPress WP Pipes versions 1.4.2 and earlier Description: The issue is a Server-Side Request Forgery SSRF vulnerability, which allows an attacker to perform unauthorized actions on the server. This can lead to various security issues,...

PT-2025-20177 · Appjetty · Appjetty Wp Jquery Datatable

Name of the Vulnerable Software and Affected Versions: AppJetty WP jQuery DataTable versions through 4.1.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

WordPress plugin WP Compress 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request...

WordPress WP SmartPay plugin 1.1.0-2.7.13 - Authenticated (Subscriber+) Information Exposure vulnerability

Authenticated Subscriber+ Information Exposure vulnerability discovered by kr0d in WordPress Plugin WP SmartPay versions 1.1.0-2.7.13...

CVE-2025-3609

The Reales WP STPT plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 2.1.2. This is due to the 'realesusersignupform' AJAX action not verifying if user registration is enabled, prior to registering a user. This makes it possible for...

CVE-2025-3609 Reales WP STPT <= 2.1.2 - Unauthorized User Registration

The Reales WP STPT plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 2.1.2. This is due to the 'realesusersignupform' AJAX action not verifying if user registration is enabled, prior to registering a user. This makes it possible for...

CVE-2025-3609

CVE-2025-3609: Reales WP STPT for WordPress allows unauthenticated user registration via the reales_user_signup_form AJAX action in all versions up to 2.1.2, due to a missing check on whether user registration is enabled. Root cause is the action not verifying the registration state before creati...

CVE-2025-3609 Reales WP STPT <= 2.1.2 - Unauthorized User Registration

The Reales WP STPT plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 2.1.2. This is due to the 'realesusersignupform' AJAX action not verifying if user registration is enabled, prior to registering a user. This makes it possible for...

CVE-2025-3610 Reales WP STPT <= 2.1.2 - Authenticated (Subscriber+) Privilege Escalation via Password Update

The Reales WP STPT plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.1.2. This is due to the plugin not properly validating a user's identity prior to updating their details like password. This makes it possible for authenticat...

CVE-2025-3610 Reales WP STPT <= 2.1.2 - Authenticated (Subscriber+) Privilege Escalation via Password Update

The Reales WP STPT plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.1.2. This is due to the plugin not properly validating a user's identity prior to updating their details like password. This makes it possible for authenticat...