WordPress Page Builder by SiteOrigin plugin <= 2.10.15 - Cross-Site Request Forgery (CSRF) vulnerability leading to Reflected Cross-Site Scripting (XSS)

Cross-Site Request Forgery CSRF vulnerability leading to Reflected Cross-Site Scripting XSS discovered by WordFence in WordPress Page Builder by SiteOrigin plugin versions = 2.10.15. Solution Update the WordPress Page Builder by SiteOrigin plugin to the latest available version at least 2.10.16...

WordPress Advanced Access Manager plugin <= 6.6.1 - Authenticated Information Disclosure vulnerability

Authenticated Information Disclosure vulnerability discovered by WordFence in WordPress Advanced Access Manager plugin versions = 6.6.1. Solution Update the WordPress Advanced Access Manager plugin to the latest available version at least 6.6.2...

WordPress Hero Maps Premium plugin <= 2.2.1 - Unauthenticated Cross-Site Scripting (XSS) vulnerability

Unauthenticated Cross-Site Scripting XSS vulnerability discovered by Hooper Labs in WordPress Hero Maps Premium plugin versions = 2.2.1. Solution Update the WordPress Hero Maps Premium plugin to the latest available version at least 2.2.3...

WordPress Advanced Contact form 7 DB plugin <= 1.6.1 - SQL Injection (SQLi) vulnerability

SQL Injection SQLi vulnerability found by Tin Duong in WordPress Advanced Contact form 7 DB plugin versions = 1.6.1. Solution Update the WordPress Advanced Contact form 7 DB plugin to the latest available version at least 1.7.1...

WordPress Comments Import & Export plugin <= 2.3.1 - CSV Injection vulnerability

CSV Injection vulnerability found by Bhushan B. Patil in WordPress Comments Import & Export plugin versions = 2.0.5. No fully patched version available...

WordPress ImageInject plugin 1.15 - Stored Cross-Site Scripting vulnerability

Stored Cross-Site Scripting vulnerability found by wpl0v3r in WordPress ImageInject plugin version 1.15. Vulnerable via the flickrappid parameter to wp-admin/options-general.php. Solution 1/9/2018 - we were unable to find a patched version of the plugin. Dangerous to use...

WordPress Z-URL Preview plugin <= 1.6.2 - Cross-Site Scripting (XSS) vulnerability

A Cross-Site Scripting XSS vulnerability found by Neorichi in WordPress Z-URL Preview plugin versions = 1.6.2. Vulnerable to Cross-Site Scripting via the class.zlinkpreview.php url parameter. Solution Update the WordPress Z-URL Preview plugin to the latest available version at least 2.0.0...

WordPress Captcha plugin <=4.4.4 - Backdoored

Backdoor found by WordFence team in WordPress Captcha plugin versions 4.3.6–4.4.4. Solution WordPress plugin repository team patched the plugin, but you need to decide on your own to use this plugin further or not...

WordPress WP-Testimonials plugin <=3.4.1 - SQL Injection vulnerability

WordPress WP-Testimonials plugin is prone to SQL injection vulnerability. The vulnerability allows an authenticated user to execute arbitrary SQL commands via the "testid" parameter to wp-admin/admin.php Solution WordPress WP-Testimonials plugin removed from WordPress plugin directory. We suggest...

WordPress <= 4.5.2 - BYPASS #3

This vulnerability in WordPress 4.5.2 and previous versions allows an attacker to bypass intended access restrictions and remove a category attribute from a post via unspecified vectors. Related records: http://db.threatpress.com/vulnerability/wordpress/wordpress-4-5-2-bypass...

WordPress Pie Register Plugin <= 2.0.18 - Multiple SQL Injection

An SQL Injection exsist in pie-register/pie-register.php. It allows the administrators to execute arbitrary SQL commands via the 1. selectinvitaioncodebulkoption or 2. invidelid parameter in the pie-invitation-codes page to wp-admin/admin.php. Solution Update the plugin...

WordPress Genericons Plugin <= 4.2.1 - XSS

This vulnerability is in example.html and allows an attacker to inject arbitrary web script or HTML via a fragment identifier. Solution Update the plugin...

WordPress WPML Plugin <= 3.1.8 - XSS

This vulnerability allows an attacker to inject arbitrary web script or HTML via the "target" parameter in a reminderpopup action to the default URI. Solution Update the plugin...

WordPress Pixabay Images Plugin 2.3 - Multiple Vulnerabilities

WordPress Pixarbay Images plugin is prone to multiple vulnerabilities, such as authentication bypass, arbitrary file upload, path traversal and cross-site scripting XSS vulnerabilities. Solution Upgrade the plugin...

WordPress <= 4.0.0 - XSS #1

Because of this vulnerability, the attackers can inject arbitrary web script or HTML via a crafted Cascading Style Sheets CSS token sequence in a post. Related records: http://db.threatpress.com/vulnerability/wordpress/wordpress-4-0-0-xss-2...

WordPress <= 3.9.2 - XSS

This vulnerability is in the "wptexturize" function. It allows the attackers to inject arbitrary web script or HTML via crafted use of shortcode brackets in a text field, as demonstrated by a comment or a post. Solution Update WordPress...

WordPress Symposium Plugin <= 14.10 - Multiple XSS

Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML via the 4 parameters: "composetext" in a sendMail action to ajax/mailfunctions.php, "text" in an addComment action to ajax/profilefunctions.php, "comment" in an addcomment action to ajax/loungefunctions.php, o...

WordPress Pods Plugin <= 2.4 - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "id" parameter in the pods page to wp-admin/admin.php. Solution Update the plugin...

WordPress WP Google Maps Plugin <= 6.0.26 - Multiple XSS

Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML via the "polyid" parameter. Solution Update the plugin...

WordPress Mulitple Themes - Arbitrary File Download

Multiple WordPress themes are prone to an arbitrary file download vulnerability. It allows an attacker to download arbitrary files from the web server and get potentially sensitive information. Solution Upgrade themes...

WordPress Random Banner Plugin <= 1.1.2.1 - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "buffercodeRBannerurlbanner1" parameter in an update action to wp-admin/options.php. Solution Update the plugin...

WordPress Yahoo! Updates Plugin <= 1.0 - Multiple XSS

Because of these multiple vulnerabilities in yupdatesapplication.php, the attackers can inject arbitrary web script or HTML via the 3 parameters: "secret", appid" or "key". Solution Update the plugin...

WordPress VideoWhisper Live Streaming Integration Plugin <= 4.29.4 - Multiple XSS

Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...

WordPress WP Forum Server Plugin <= 1.7.3 - SQL Injection

Because of this vulnerability in fs-admin/fs-admin.php, the attackers can execute arbitrary SQL commands via the "groupid" parameter in an editgroup action. Solution Update the plugin...

WordPress Related Posts Plugin <= 2.6.1 - CSRF

Because of this vulnerability, the attackers can hijack the authentication of users for requests that change settings via unspecified vectors. Solution Update the plugin...

WordPress Kish Guest Posting Plugin <= 1.2 - Unrestricted File Upload

Because of this vulnerability in uploadify/scripts/uploadify.php, the attackers can execute arbitrary code by uploading a file with a double extension. After that they access it via a direct request to the file in the directory specified by the "folder" parameter. Solution Update the plugin...

WordPress Count Per Day Plugin <= 3.1 - Multiple XSS

Because of these vulnerabilities in userperspan.php, the attackers can inject arbitrary web script or HTML via 3 parameters: "page", "datemax" or "datemin". Solution Update the plugin...

WordPress <= 3.4.0 - CSRF

Because of this vulnerability, the attackers can hijack the authentication of unspecified victims via unknown vectors. Solution Update WordPress...

WordPress <= 3.3.1 - Multiple XSS

Because of these vulnerabilities in wp-admin/setup-config.php, the attackers can inject arbitrary web script or HTML. Solution Update WordPress...

WordPress Lanoba Social Plugin 1.0 - Cross Site Scripting

WordPress Lanoba Social plugin's "action" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal...

WordPress Photoracer Plugin 1.0 - SQL Injection Vulnerability

SQL injection vulnerability found in viewimg.php line 16. It allows the attacker to execute arbitrary commands via the 'imgid' parameter against the database. Solution Update plugin...

WordPress - Cross Site Scripting

This vulnerability is in sidebar.php. It allows the attackers to inject arbitrary web script or HTML via the query string. Solution Update WordPress...

WordPress <= 2.1.1 - Multiple Vulnerabilities

The attackers can execute arbitrary commands via an eval injection vulnerability in the "ix" parameter to wp-includes/feed.php. Also, there is command execution backdoor vulnerability. Solution Update the WordPress to the latest available version at least 2.1.2...

WordPress Admin Panel Plugin <= 2.1.1 - CSRF

Because of this vulnerability, the attackers can perform privileged actions as administrators, as demonstrated using the delete action in wp-admin/post.php. Solution Update the WordPress Admin Panel plugin to the latest version at least 2.1.2...

WordPress <=1.2 - Multiple Cross-Site Scripting (XSS) vulnerabilities

Because of these vulnerabilities, attackers can inject arbitrary web script or HTML. Solution Update WordPress to the latest possible version...

WordPress Charitable plugin <= 1.8.12.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Noman Riffat in WordPress Plugin Charitable versions = 1.8.12.1...

WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Tin Pham aka TF1T in WordPress Plugin Elementor Pro versions = 4.2.1...

NPM: piscina: Prototype Pollution Gadget → RCE via inherited options.filename

NPM: piscina: Prototype Pollution Gadget → RCE via inherited options.filename vulnerability discovered by ? in WordPress Npm piscina versions = 4.9.2...

WordPress WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.4 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Frissi0n in WordPress Plugin WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms versions = 1.1.4...

WordPress Fermentio theme <= 1.5.0 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Fermentio versions = 1.5.0...

WordPress CBX 5 Star Rating & Review plugin <= 1.0.7 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Julian Chibuike Nwadinobi Wackydawg - streamio in WordPress Plugin CBX 5 Star Rating & Review versions = 1.0.7...

NPM: brace-expansion: Large numeric range defeats documented `max` DoS protection

NPM: brace-expansion: Large numeric range defeats documented max DoS protection vulnerability discovered by ? in WordPress Npm brace-expansion versions = 5.0.0, 5.0.6...

WordPress AIWU plugin <= 1.4.21 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Kazuma Matsumoto - GMO Cybersecurity by IERAE, Inc. in WordPress Plugin AIWU versions = 1.4.21...

WordPress Betheme theme <= 28.4 - Authenticated (Author+) Arbitrary File Upload to Remote Code Execution vulnerability

Authenticated Author+ Arbitrary File Upload to Remote Code Execution vulnerability discovered by Wordfence in WordPress Theme Betheme versions = 28.4...

WordPress WP Responsive Recent Post Slider/Carousel plugin <= 3.7.1 - Backdoor vulnerability

Backdoor vulnerability discovered by ? in WordPress Plugin WP Responsive Recent Post Slider/Carousel versions = 3.7.1...

WordPress WP FOFT Loader plugin <= 2.1.39 - Authenticated (Author+) Arbitrary File Upload vulnerability

Authenticated Author+ Arbitrary File Upload vulnerability discovered by Williwollo CybrX in WordPress Plugin WP FOFT Loader versions = 2.1.39...

WordPress WP JobHunt plugin <= 7.7 - Authenticated (Candidate+) Insecure Direct Object Reference vulnerability

Authenticated Candidate+ Insecure Direct Object Reference vulnerability discovered by meghnine islem - CYBEARS in WordPress Plugin WP JobHunt versions = 7.7...

WordPress WP Job Portal plugin <= 2.4.0 - Authenticated (Subscriber+) Arbitrary File Read vulnerability

Authenticated Subscriber+ Arbitrary File Read vulnerability discovered by Long Nguyen in WordPress Plugin WP Job Portal versions = 2.4.0...

WordPress All-in-One Video Gallery plugin <= 4.5.7 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by kr0d in WordPress Plugin All-in-One Video Gallery versions = 4.5.7...

WordPress MagOne Theme <= 8.5 is vulnerable to Cross Site Scripting (XSS)

Software MagOne Type Theme Vulnerable versions = 8.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2025-39488 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 150089f804cf Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunit...