CVE-2025-3104

CVE-2025-3104 affects the WP STAGING Pro WordPress Backup Plugin for WordPress (versions up to 6.1.2). The issue arises from missing capability checks in getOutdatedPluginsRequest(), enabling unauthenticated disclosure of outdated installed plugins. Impact is information exposure; CVSS 3.1 base s...

CVE-2025-3104 WP Staging Pro <= 6.1.2 - Unauthenticated Information Exposure via getOutdatedPluginsRequest Function

The WP STAGING Pro WordPress Backup Plugin for WordPress is vulnerable to Information Exposure in all versions up to and including 6.1.2 due to missing capability checks on the getOutdatedPluginsRequest function. This makes it possible for unauthenticated attackers to reveal outdated installed...

PT-2025-16644 · WordPress · Bill Minozzi Wp Tools

Name of the Vulnerable Software and Affected Versions: Bill Minozzi WP Tools versions n/a through 5.18 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Path Traversal. This means an attacker could potentially trick a user into performing unintended actions on...

WordPress plugin WP Tools 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site reques...

PT-2025-16601 · WordPress · Wp Posts Carousel

Name of the Vulnerable Software and Affected Versions: WP Posts Carousel versions 1.3.10 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks. Recommendations: For WP...

WordPress plugin WP-Advanced-Search 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

PT-2025-16604 · WordPress · Wpadverts

Name of the Vulnerable Software and Affected Versions: WPAdverts versions n/a through 2.2.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. Recommendations: For versions n/a through 2.2....

CVE-2025-26906

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ren Ventura WP Delete User Accounts wp-delete-user-accounts allows DOM-Based XSS.This issue affects WP Delete User Accounts: from n/a through = 1.2.3...

CVE-2025-26906

CVE-2025-26906 affects the WordPress plugin WP Delete User Accounts (affected up to version 1.2.3). It enables DOM-based XSS due to improper neutralization during web page generation. Wordfence shows the vulnerability as patched; remediation is to update to the fixed release/version beyond 1.2.3.

WordPress WP Staging Pro plugin <= 6.1.2 - Unauthenticated Information Exposure via getOutdatedPluginsRequest Function vulnerability

Unauthenticated Information Exposure via getOutdatedPluginsRequest Function vulnerability discovered by haidv35 in WordPress Plugin Wp Staging Pro versions = 6.1.2...

CVE-2025-26990

Server-Side Request Forgery SSRF vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Server Side Request Forgery.This issue affects Royal Elementor Addons: from n/a through = 1.7.1006...

CVE-2025-26743

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in TC.K Advance WP Query Search Filter advance-wp-query-search-filter allows Reflected XSS.This issue affects Advance WP Query Search Filter: from n/a through = 1.0.10...

CVE-2025-26990

CVE-2025-26990 is an authenticated SSRF in Royal Elementor Addons for WordPress, affecting up to version 1.7.1006. Wordfence lists it as patched; remediation is to upgrade to a fixed version released by the plugin authors (latest available). Public exploit details are not provided in the connecte...

CVE-2025-26743

CVE-2025-26743 : Reflected XSS in the WordPress plugin Advance WP Query Search Filter (affected from unspecified versions up to 1.0.10). Root cause: Improper Neutralization of Input During Web Page Generation. CVSSv3.1 base score 7.1 (HIGH) with network attack vector, no privileges, user interact...

CVE-2025-2541

The WP Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.6.22 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and...

CVE-2025-32629

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in CMSJunkie - WordPress Business Directory Plugins WP-BusinessDirectory wp-businessdirectory allows Path Traversal.This issue affects WP-BusinessDirectory: from n/a through = 3.1.2...

CVE-2025-32603

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in HK WP Online Users Stats wp-online-users-stats allows Blind SQL Injection.This issue affects WP Online Users Stats: from n/a through = 1.0.0...

CVE-2025-32681

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WP Guru Error Log Viewer error-log-viewer-wp allows Blind SQL Injection.This issue affects Error Log Viewer: from n/a through = 1.0.5...

CVE-2025-32509

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in WPMinds Simple WP Events simple-wp-events allows Path Traversal.This issue affects Simple WP Events: from n/a through = 1.8.17...

CVE-2025-32598

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Table Builder WP Table Builder wp-table-builder allows Reflected XSS.This issue affects WP Table Builder: from n/a through = 2.0.5...