WordPress WP Job Portal plugin <= 2.2.5- Authenticated (Subscriber+) Insecure Direct Object Reference vulnerability

WordPress WP Job Portal plugin = 2.2.5- Authenticated Subscriber+ Insecure Direct Object Reference vulnerability discovered by Apostolos Sakellariou in WordPress Plugin WP Job Portal versions = 2.2.5...

CVE-2024-56270

Missing Authorization vulnerability in SecureSubmit WP SecureSubmit securesubmit allows Retrieve Embedded Sensitive Data.This issue affects WP SecureSubmit: from n/a through = 1.5.20...

CVE-2024-56270 WordPress WP SecureSubmit plugin <= 1.5.16 - Sensitive Data Exposure vulnerability

Missing Authorization vulnerability in SecureSubmit WP SecureSubmit.This issue affects WP SecureSubmit: from n/a through 1.5.16...

CVE-2025-22579

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Arefly WP Header Notification wp-header-notification allows Stored XSS.This issue affects WP Header Notification: from n/a through = 1.2.7...

CVE-2025-22578

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in aazztech WP Cookie wp-cookie allows Stored XSS.This issue affects WP Cookie: from n/a through = 1.0.0...

CVE-2025-22549

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in seinoxygen WP Github wp-github allows Stored XSS.This issue affects WP Github: from n/a through = 1.3.3...

CVE-2025-22541

Missing Authorization vulnerability in etruel WP Delete Post Copies etruel-del-post-copies allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Delete Post Copies: from n/a through = 5.5...

CVE-2025-22543

Missing Authorization vulnerability in beautifultemplates ST Gallery WP st-gallery-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ST Gallery WP: from n/a through = 1.0.8...

CVE-2025-22536

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in hiren.sabd WP Music Player wp-music-player allows SQL Injection.This issue affects WP Music Player: from n/a through = 1.3...

CVE-2025-22528

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Huurkalender.nl Huurkalender WP huurkalender-wp allows Stored XSS.This issue affects Huurkalender WP: from n/a through = 1.5.6...

CVE-2025-22338

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in lichwang WP-tagMaker tagmaker allows Reflected XSS.This issue affects WP-tagMaker: from n/a through = 0.2.2...

CVE-2025-22294

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in theme funda Custom Field For WP Job Manager custom-field-for-wp-job-manager allows Reflected XSS.This issue affects Custom Field For WP Job Manager: from n/a through = 1.3...

CVE-2025-22338

CVE-2025-22338 : Reflected XSS in WP-tagMaker (WordPress plugin) due to improper neutralization of input during web page generation. Affects WP-tagMaker versions up to and including 0.2.2 (n/a through 0.2.2). CVSSv3.1 base score 7.1 (High; Network), with user interaction required. Root cause: inp...

CVE-2025-22338 WordPress WP-tagMaker plugin <= 0.2.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in lichwang WP-tagMaker tagmaker allows Reflected XSS.This issue affects WP-tagMaker: from n/a through = 0.2.2...

CVE-2025-22528 WordPress Huurkalender WP Plugin <= 1.5.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Huurkalender Huurkalender WP allows Stored XSS.This issue affects Huurkalender WP: from n/a through 1.5.6...

CVE-2025-22528

CVE-2025-22528 describes a stored cross-site scripting vulnerability in Huurkalender WP. Affected: Huurkalender WP versions up to and including 1.5.6; condition: authenticated attacker with Contributor+ privileges can trigger stored XSS in web page generation. Impact: stored XSS payloads on pages...

CVE-2025-22536 WordPress WP Music Player Plugin <= 1.3 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Hiren Patel WP Music Player allows SQL Injection.This issue affects WP Music Player: from n/a through 1.3...

CVE-2025-22536 WordPress WP Music Player Plugin <= 1.3 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in hiren.sabd WP Music Player wp-music-player allows SQL Injection.This issue affects WP Music Player: from n/a through = 1.3...

CVE-2025-22536

CVE-2025-22536 is an SQL injection vulnerability in the WordPress plugin WP Music Player, described as “Improper Neutralization of Special Elements used in an SQL Command” and affecting WP Music Player versions from n/a through 1.3. The connected Red Hat entry confirms the same CVE ID and descrip...

CVE-2025-22541

CVE-2025-22541 concerns WP Delete Post Copies (WP Delete Post Copies plugin) by Etruel Developments LLC. The description indicates a Missing Authorization vulnerability caused by incorrectly configured access control, enabling exploitation of access level checks when deleting copies of posts. The...