CVE-2024-7419

The WP ALL Export Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.9.1 via the custom export fields. This is due to the missing input validation and sanitization of user-supplied data. This makes it possible for unauthenticated attackers to...

CVE-2024-9661 WP All Import Pro <= 4.9.7 - Cross-Site Request Forgery to Imported Content Deletion

The WP All Import Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.9.7. This is due to missing nonce validation on the deleteandedit function. This makes it possible for unauthenticated attackers to delete imported content posts, comment...

CVE-2024-7419 WP All Export Pro <= 1.9.1 - Unauthenticated Remote Code Execution via Custom Export Fields

The WP ALL Export Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.9.1 via the custom export fields. This is due to the missing input validation and sanitization of user-supplied data. This makes it possible for unauthenticated attackers to...

CVE-2024-9661

CVE-2024-9661 refers to WP All Import Pro for WordPress, vulnerable to Cross-Site Request Forgery due to missing nonce validation in the delete_and_edit function. This allows unauthenticated attackers to delete imported content (posts, comments, users, etc.) by tricking an administrator into a fo...

CVE-2024-7419

CVE-2024-7419: WP All Export Pro for WordPress (versions up to 1.9.1) is vulnerable to unauthenticated remote code execution via the custom export fields due to missing input validation/sanitization of user-provided data. This can allow an attacker to inject PHP code that executes on the server d...

CVE-2024-9661 WP All Import Pro <= 4.9.7 - Cross-Site Request Forgery to Imported Content Deletion

The WP All Import Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.9.7. This is due to missing nonce validation on the deleteandedit function. This makes it possible for unauthenticated attackers to delete imported content posts, comment...

CVE-2024-7419 WP All Export Pro <= 1.9.1 - Unauthenticated Remote Code Execution via Custom Export Fields

The WP ALL Export Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.9.1 via the custom export fields. This is due to the missing input validation and sanitization of user-supplied data. This makes it possible for unauthenticated attackers to...

CVE-2025-25159

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in robertkolatzek WP doodlez wpdoodlez allows Stored XSS.This issue affects WP doodlez: from n/a through = 1.0.10...

CVE-2025-25139

Cross-Site Request Forgery CSRF vulnerability in Cynob IT Consultancy WP Custom Post RSS Feed wp-custom-post-rss-feed allows Stored XSS.This issue affects WP Custom Post RSS Feed: from n/a through = 1.0.0...

CVE-2025-25111

Cross-Site Request Forgery CSRF vulnerability in WP Spell Check WP Spell Check wp-spell-check allows Cross Site Request Forgery.This issue affects WP Spell Check: from n/a through = 9.21...

CVE-2025-25088

Cross-Site Request Forgery CSRF vulnerability in blackus3r WP Keyword Monitor wp-keyword-monitor allows Cross Site Request Forgery.This issue affects WP Keyword Monitor: from n/a through = 1.0.5...

CVE-2025-25085

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in mattmcbrien WP SimpleWeather wp-simpleweather allows Stored XSS.This issue affects WP SimpleWeather: from n/a through = 0.2.5...

CVE-2025-25073

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Vasilis Triantafyllou Easy WP Tiles easy-wp-tiles allows Stored XSS.This issue affects Easy WP Tiles: from n/a through = 1...

CVE-2025-25074

Cross-Site Request Forgery CSRF vulnerability in Nirmal Kumar Ram WP Social Stream wp-social-stream allows Stored XSS.This issue affects WP Social Stream: from n/a through = 1.1...

CVE-2025-25072

Cross-Site Request Forgery CSRF vulnerability in thunderbax WP Admin Custom Page wp-admin-custom-page allows Stored XSS.This issue affects WP Admin Custom Page: from n/a through = 1.5.0...

CVE-2025-25159

CVE-2025-25159 affects the WordPress plugin WP doodlez. The vulnerability is a Stored Cross-Site Scripting (XSS) due to improper input neutralization during web page generation, impacting WP doodlez versions up to 1.0.10. The available connected documents confirm affected software and the XSS nat...

CVE-2025-25159 WordPress WP doodlez plugin <= 1.0.10 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in robertkolatzek WP doodlez wpdoodlez allows Stored XSS.This issue affects WP doodlez: from n/a through = 1.0.10...

CVE-2025-25139

CVE-2025-25139 concerns the WordPress plugin “WP Custom Post RSS Feed” (versions

CVE-2025-25088

CVE-2025-25088 corresponds to a Cross-Site Request Forgery to Stored XSS vulnerability in the WordPress plugin WP Keyword Monitor (affected versions: up to 1.0.5). The connected sources describe the issue as CSRF that allows stored XSS, but do not provide concrete details about specific vulnerabl...

CVE-2025-25088 WordPress WP Keyword Monitor Plugin <=1.0.5 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in blackus3r WP Keyword Monitor allows Stored XSS. This issue affects WP Keyword Monitor: from n/a through 1.0.5...