CVE-2025-22338

CVE-2025-22338 : Reflected XSS in WP-tagMaker (WordPress plugin) due to improper neutralization of input during web page generation. Affects WP-tagMaker versions up to and including 0.2.2 (n/a through 0.2.2). CVSSv3.1 base score 7.1 (High; Network), with user interaction required. Root cause: inp...

CVE-2025-22338 WordPress WP-tagMaker plugin <= 0.2.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in lichwang WP-tagMaker tagmaker allows Reflected XSS.This issue affects WP-tagMaker: from n/a through = 0.2.2...

CVE-2025-22528 WordPress Huurkalender WP Plugin <= 1.5.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Huurkalender Huurkalender WP allows Stored XSS.This issue affects Huurkalender WP: from n/a through 1.5.6...

CVE-2025-22528

CVE-2025-22528 describes a stored cross-site scripting vulnerability in Huurkalender WP. Affected: Huurkalender WP versions up to and including 1.5.6; condition: authenticated attacker with Contributor+ privileges can trigger stored XSS in web page generation. Impact: stored XSS payloads on pages...

CVE-2025-22536 WordPress WP Music Player Plugin <= 1.3 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Hiren Patel WP Music Player allows SQL Injection.This issue affects WP Music Player: from n/a through 1.3...

CVE-2025-22536 WordPress WP Music Player Plugin <= 1.3 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in hiren.sabd WP Music Player wp-music-player allows SQL Injection.This issue affects WP Music Player: from n/a through = 1.3...

CVE-2025-22536

CVE-2025-22536 is an SQL injection vulnerability in the WordPress plugin WP Music Player, described as “Improper Neutralization of Special Elements used in an SQL Command” and affecting WP Music Player versions from n/a through 1.3. The connected Red Hat entry confirms the same CVE ID and descrip...

CVE-2025-22541

CVE-2025-22541 concerns WP Delete Post Copies (WP Delete Post Copies plugin) by Etruel Developments LLC. The description indicates a Missing Authorization vulnerability caused by incorrectly configured access control, enabling exploitation of access level checks when deleting copies of posts. The...

CVE-2025-22543 WordPress ST Gallery WP plugin <= 1.0.8 - Settings Change vulnerability

Missing Authorization vulnerability in Beautiful Templates ST Gallery WP allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ST Gallery WP: from n/a through 1.0.8...

CVE-2025-22579 WordPress WP Header Notification plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Arefly WP Header Notification wp-header-notification allows Stored XSS.This issue affects WP Header Notification: from n/a through = 1.2.7...

CVE-2025-22578 WordPress WP Cookie plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in aazztech WP Cookie wp-cookie allows Stored XSS.This issue affects WP Cookie: from n/a through = 1.0.0...

CVE-2025-22578 WordPress WP Cookie plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in aazztech WP Cookie wp-cookie allows Stored XSS.This issue affects WP Cookie: from n/a through = 1.0.0...

CVE-2025-22579 WordPress WP Header Notification plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Arefly WP Header Notification allows Stored XSS.This issue affects WP Header Notification: from n/a through 1.2.7...

CVE-2025-22578

CVE-2025-22578 describes a stored XSS vulnerability in the WordPress plugin WP Cookie. The initial record states an Improper Neutralization of Input During Web Page Generation vulnerability (stored XSS) affecting WP Cookie versions up to 1.0.0. Red Hat/Wordfence entries corroborate the CVE identi...

CVE-2025-22579

CVE-2025-22579 is a stored XSS in the WordPress plugin WP Header Notification (affected:

CVE-2024-12131

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.5 due to missing validation on a user controlled key. This makes it possible for authenticated...

CVE-2024-12131

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.5 due to missing validation on a user controlled key. This makes it possible for authenticated...

WordPress ST Gallery WP plugin <= 1.0.8 - Settings Change vulnerability

Settings Change vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin ST Gallery WP versions = 1.0.8...

CVE-2024-12131 WP Job Portal – A Complete Recruitment System for Company or Job Board website <= 2.2.5- Authenticated (Subscriber+) Insecure Direct Object Reference

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.5 due to missing validation on a user controlled key. This makes it possible for authenticated...

CVE-2024-12131

CVE-2024-12131 affects the WordPress plugin “WP Job Portal – A Complete Recruitment System for Company or Job Board website” (WordPress plugin). The issue is an Insecure Direct Object Reference caused by missing validation on a user-controlled key, enabling authenticated attackers with Subscriber...