16551 matches found
CVE-2025-32603
CVE-2025-32603 describes an unauthenticated SQL Injection in the WordPress plugin WP Online Users Stats (affected: 1.0.0 and earlier). The CVSSv3.1 base score is 9.3 (CRITICAL) with network attack vector, low attack complexity, and no user interaction. Impact indicators: High confidentiality impa...
CVE-2025-32603 WordPress WP Online Users Stats plugin <= 1.0.0 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in HK WP Online Users Stats wp-online-users-stats allows Blind SQL Injection.This issue affects WP Online Users Stats: from n/a through = 1.0.0...
CVE-2025-32598 WordPress WP Table Builder plugin <= 2.0.5 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Table Builder WP Table Builder wp-table-builder allows Reflected XSS.This issue affects WP Table Builder: from n/a through = 2.0.5...
CVE-2025-32598
CVE-2025-32598 is a Reflected XSS vulnerability in the WordPress plugin WP Table Builder. Affected: WP Table Builder <= 2.0.4 (per initial entry); related Wordfence entry shows a patch in 2.0.5 (and later). Exploitation would involve input that is reflected in the generated web page. Remediati...
CVE-2025-32509 WordPress Simple WP Events plugin <= 1.8.17 - Arbitrary File Deletion vulnerability
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in WPMinds Simple WP Events simple-wp-events allows Path Traversal.This issue affects Simple WP Events: from n/a through = 1.8.17...
CVE-2025-32509 WordPress Simple WP Events plugin <= 1.8.17 - Arbitrary File Deletion vulnerability
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in WPMinds Simple WP Events allows Path Traversal. This issue affects Simple WP Events: from n/a through 1.8.17...
CVE-2025-32509
CVE-2025-32509 affects WordPress plugin Simple WP Events (versions ≤ 1.8.17). The issue is an improper limitation of a pathname to a restricted directory, i.e., a path traversal vulnerability. Some connected sources also indicate the underlying impact as arbitrary file deletion. The vulnerability...
CVE-2025-31028 WordPress WP Hide Categories plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Huseyin Berberoglu WP Hide Categories wp-hide-categories allows Reflected XSS.This issue affects WP Hide Categories: from n/a through = 1.0...
CVE-2025-31040 WordPress WP Food ordering and Restaurant Menu plugin <= 2.7 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Exthemes WP Food ordering and Restaurant Menu wp-food allows PHP Local File Inclusion.This issue affects WP Food ordering and Restaurant Menu: from n/a through = 2.7...
CVE-2025-31028
CVE-2025-31028 is a Reflected XSS in the WordPress plugin WP Hide Categories (affected: WP Hide Categories, up to version 1.0). The vulnerability arises from improper neutralization of input during web page generation. According to Wordfence Intelligence, this entry is currently unpatched (patch ...
CVE-2025-31028 WordPress WP Hide Categories plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Huseyin Berberoglu WP Hide Categories wp-hide-categories allows Reflected XSS.This issue affects WP Hide Categories: from n/a through = 1.0...
CVE-2025-31040
CVE-2025-31040 is an unauthenticated Local File Inclusion in the WordPress plugin “WP Food ordering and Restaurant Menu” (versions up to 1.1). The root cause is improper handling of filenames in PHP include/require, enabling LFI. The Wordfence vulnerability entry notes the flaw in WP Food orderin...
CVE-2024-6860
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating its permalink suffix settings, which could allow attackers to make logged admins perform such action via a CSRF attack...
PT-2025-16053 · Wpminds · Wpminds Simple Wp Events
Name of the Vulnerable Software and Affected Versions: WPMinds Simple WP Events versions 1.8.17 and earlier Description: The issue is related to an improper limitation of a pathname to a restricted directory, also known as 'Path Traversal'. This allows an attacker to traverse the file system and...
PT-2025-16083 · WordPress · Wp Online Users Stats
Name of the Vulnerable Software and Affected Versions: WP Online Users Stats versions prior to 1.0.0 Description: The issue is related to the improper neutralization of special elements used in an SQL command, allowing for Blind SQL Injection. This can be exploited through API endpoints, although...
PT-2025-16088 · WordPress · Wp-Businessdirectory
Name of the Vulnerable Software and Affected Versions: WP-BusinessDirectory versions n/a through 3.1.2 Description: The issue is related to an improper limitation of a pathname to a restricted directory, also known as 'Path Traversal'. This allows unauthorized access to files and directories...
PT-2025-16044 · WordPress · Wp Food Ordering/Restaurant Menu
Name of the Vulnerable Software and Affected Versions: WP Food ordering and Restaurant Menu versions 1.1 and earlier Description: The issue is related to an improper control of filename for include/require statement in PHP program, also known as PHP Remote File Inclusion, which allows PHP Local...
PT-2025-16079 · WordPress · Wp Table Builder
Name of the Vulnerable Software and Affected Versions: WP Table Builder versions 2.0.4 and earlier Description: The issue is related to improper neutralization of input during web page generation, also known as Cross-site Scripting. This allows for Reflected XSS. Recommendations: For WP Table...
