CVE-2025-22261

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marcus aka @msykes WP FullCalendar wp-fullcalendar allows Stored XSS.This issue affects WP FullCalendar: from n/a through = 1.5...

CVE-2025-27328

Cross-Site Request Forgery CSRF vulnerability in queeez WP-PostRatings Cheater wp-postratings-cheater allows Cross Site Request Forgery.This issue affects WP-PostRatings Cheater: from n/a through = 1.5...

CVE-2025-27348

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Daniel WP Social SEO Booster – Knowledge Graph Social Signals SEO wp-social-seo-booster allows Stored XSS.This issue affects WP Social SEO Booster – Knowledge Graph Social Signals SEO: from n/a...

CVE-2025-27294

Missing Authorization vulnerability in platcom WP-Asambleas wp-asambleas allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Asambleas: from n/a through = 2.85.0...

CVE-2025-27323

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jon Bishop WP About Author wp-about-author allows DOM-Based XSS.This issue affects WP About Author: from n/a through = 1.5...

CVE-2025-27298

Cross-Site Request Forgery CSRF vulnerability in cmstactics WP Video Posts wp-video-posts allows OS Command Injection.This issue affects WP Video Posts: from n/a through = 3.5.1...

CVE-2025-27312

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Jenst WP Sitemap wp-sitemap allows SQL Injection.This issue affects WP Sitemap: from n/a through = 1.0...

CVE-2024-12737

The WP BASE Booking of Appointments, Services and Events WordPress plugin before 5.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13632 WP Extra Fields <= 1.0.1 - Reflected XSS

The WP Extra Fields WordPress plugin through 1.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13632 WP Extra Fields <= 1.0.1 - Reflected XSS

The WP Extra Fields WordPress plugin through 1.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13632

CVE-2024-13632 affects the WP Extra Fields WordPress plugin (≤1.0.1). The vulnerability is a Reflected Cross‑Site Scripting caused by insufficient sanitisation/escaping of a parameter before output, potentially affecting high-privilege users (e.g., admin). The CVSSv3.1 base score is 7.1 (HIGH) wi...

CVE-2024-13628 WP Pricing Table <= 1.1 - Reflected XSS

The WP Pricing Table WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13628 WP Pricing Table <= 1.1 - Reflected XSS

The WP Pricing Table WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13628

CVE-2024-13628 concerns the WP Pricing Table WordPress plugin, affected up to version 1.1. The issue is a reflected cross-site scripting (XSS) caused by outputting an unsanitized/unescaped parameter back into the page, which could be exploited against high-privilege users (e.g., admins) by crafti...

CVE-2024-12737 WP BASE Booking of Appointments, Services and Events < 5.0.0 - Reflected XSS

The WP BASE Booking of Appointments, Services and Events WordPress plugin before 5.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-12737 WP BASE Booking of Appointments, Services and Events < 5.0.0 - Reflected XSS

The WP BASE Booking of Appointments, Services and Events WordPress plugin before 5.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-12737

CVE-2024-12737 : WP BASE Booking of Appointments, Services and Events (WordPress)

PT-2025-8679 · WordPress · Wp Extra Fields

Name of the Vulnerable Software and Affected Versions: WP Extra Fields WordPress plugin version 1.0.1 Description: The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitised and escaped before being outputted back in the page. This could be used...

CVE-2025-26975

Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Strong Testimonials: from n/a through = 3.2.3...

CVE-2025-26974

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WPExperts.io WP Multistore Locator wp-multi-store-locator allows Blind SQL Injection.This issue affects WP Multistore Locator: from n/a through = 2.5.1...