WordPress Branda - White Label & Branding, Free Login Page Customizer plugin <= 3.4.24 - Unauthenticated Privilege Escalation via Account Takeover vulnerability

WordPress Branda - White Label & Branding, Free Login Page Customizer plugin = 3.4.24 - Unauthenticated Privilege Escalation via Account Takeover vulnerability discovered by Drew Webber mcdruid in WordPress Plugin Branda versions = 3.4.24...

WordPress Headinger for Elementor plugin <= 1.1.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin Headinger for Elementor versions = 1.1.4...

WordPress Accessibility Press plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by HunSec in WordPress Plugin Accessibility Press versions = 1.0.2...

WordPress Minamaze theme <= 1.10.1 - Cross Site Scripting (XSS) vulnerability

Software : Minamaze Type : Theme Vulnerable versions : = 1.10.1 OWASP Top 10 : A3: Injection Classification : Cross Site Scripting XSS CVE ID : CVE-2025-62991 Patchstack priority : Low CVSS severity : 6.5 Required privilege : Contributor Developer : Claim ownership PSID : 8aa231bb7ea9 Credits :...

WordPress Minamaze theme <= 1.10.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Peter Thaleikis in WordPress Theme Minamaze versions = 1.10.1...

WordPress WP Featherlight plugin <= 1.3.4 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Featherlight.js JavaScript Library vulnerability

Authenticated Contributor+ Stored DOM-Based Cross-Site Scripting via Featherlight.js JavaScript Library vulnerability discovered by Webbernaut in WordPress Plugin WP Featherlight versions = 1.3.4...

WordPress eRoom - Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams plugin <= 1.5.6 - Unauthenticated Sensitive Information Exposure vulnerability

WordPress eRoom - Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams plugin = 1.5.6 - Unauthenticated Sensitive Information Exposure vulnerability discovered by Rafshanzani Suhada in WordPress Plugin eRoom versions = 1.5.6...

WordPress Social Media Auto Publish plugin <= 3.6.5 - Reflected Cross-Site Scripting via PostMessage vulnerability

Reflected Cross-Site Scripting via PostMessage vulnerability discovered by Nicolai Hellesnes nico in WordPress Plugin Social Media Auto Publish versions = 3.6.5...

WordPress Simple Download Counter plugin <= 2.2.2 - Authenticated (Administrator+) Arbitrary File Read via Path Traversal vulnerability

Authenticated Administrator+ Arbitrary File Read via Path Traversal vulnerability discovered by ChamlaVic in WordPress Plugin Simple Download Counter versions = 2.2.2...

WordPress WP-SOS-Donate Donation Sidebar Plugin plugin <= 0.9.2 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF'] vulnerability

Reflected Cross-Site Scripting via $SERVER'PHPSELF' vulnerability discovered by Abdulsamad Yusuf 0xVenus - Envorasec in WordPress Plugin WP-SOS-Donate versions = 0.9.2...

WordPress DB Access plugin <= 0.8.7 - Subscriber+ SQLi vulnerability

Subscriber+ SQLi vulnerability discovered by Yousof Nahya in WordPress Plugin DB Access versions = 0.8.7...

WordPress Frontend Admin by DynamiApps plugin <= 3.28.20 - Unauthenticated Arbitrary Options Update vulnerability

Unauthenticated Arbitrary Options Update vulnerability discovered by YCInfosec in WordPress Plugin Frontend Admin by DynamiApps versions = 3.28.20...

WordPress Kallyas Theme <= 4.24.0 is vulnerable to Remote Code Execution (RCE)

Software Kallyas Type Theme Vulnerable versions = 4.24.0 Fixed in N/A OWASP Top 10 A1: Injection Classification Remote Code Execution RCE CVE CVE-2025-6990 Patch priority Medium CVSS severity Medium 8.8 Developer EPC PSID fef69fa1779b Credits stealthcopter Required privilege Contributor Published...

WordPress WoodMart theme < 8.3.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme WoodMart versions 8.3.2...

WordPress Slider Revolution plugin <= 6.7.37 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Read vulnerability

Missing Authorization to Authenticated Contributor+ Arbitrary File Read vulnerability discovered by stealthcopter in WordPress Plugin Slider Revolution versions = 6.7.37...

WordPress Ditty plugin < 3.1.58 - Unauthenticated SSRF vulnerability

Unauthenticated SSRF vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Ditty versions 3.1.58...

WordPress Booster for WooCommerce plugin <= 7.2.4 - Unauthenticated Double Extension Arbitrary File Upload vulnerability

Unauthenticated Double Extension Arbitrary File Upload vulnerability discovered by luckybuddy in WordPress Plugin Booster for WooCommerce versions = 7.2.4...

WordPress PressApps Knowledge Base Contextual Sidebar Addon Plugin <= 4.2.1 - PHP Object Injection Vulnerability

PHP Object Injection Vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin PressApps Knowledge Base Contextual Sidebar Addon versions = 4.2.1...

WordPress Doctreat theme <= 1.6.7 - Content Injection vulnerability

Content Injection vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Doctreat versions = 1.6.7...

WordPress LoginPress Pro plugin <= 5.0.1 - Authentication Bypass via WordPress.com OAuth provider vulnerability

Authentication Bypass via WordPress.com OAuth provider vulnerability discovered by Foxyyy in WordPress Plugin LoginPress Pro versions = 5.0.1...

WordPress Attachment Manager plugin <= 2.1.2 - Unauthenticated Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion vulnerability discovered by johska in WordPress Plugin Attachment Manager versions = 2.1.2...

WordPress Content No Cache plugin <= 0.1.4 - Arbitrary Function Call vulnerability

Arbitrary Function Call vulnerability discovered by HLog in WordPress Plugin Content No Cache versions = 0.1.4...

WordPress Workreap plugin <= 3.3.2 - Authenticated (Subscriber+) Arbitrary File Upload via 'workreap_temp_upload_to_media' vulnerability

Authenticated Subscriber+ Arbitrary File Upload via 'workreaptempuploadtomedia' vulnerability discovered by Foxyyy in WordPress Plugin Workreap theme's plugin versions = 3.3.2...

WordPress Flozen Theme < 1.5.1 is vulnerable to Arbitrary File Upload

Software Flozen Type Theme Vulnerable versions 1.5.1 Fixed in 1.5.1 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2025-49071 Patch priority High CVSS severity High 10 Developer Claim ownership PSID b0bba867fa7b Credits Phat RiO - BlueRock Required privilege Unauthenticat...

WordPress RealHomes Theme <= 4.4.0 is vulnerable to Privilege Escalation

Software RealHomes Type Theme Vulnerable versions = 4.4.0 Fixed in 4.4.1 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2025-4601 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 08bda80a3ca8 Credits Thái An Require...

WordPress SEPA Girocode plugin <= 0.5.1 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Chu The Anh Blue Rock in WordPress Plugin SEPA Girocode versions = 0.5.1...

WordPress BP Profile as Homepage plugin <= 1.1 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability

Cross Site Request Forgery CSRF to Stored XSS vulnerability discovered by johska in WordPress Plugin BP Profile as Homepage versions = 1.1...

WordPress WP User Frontend Pro plugin <= 4.1.3 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by Foxyyy in WordPress Plugin WP User Frontend Pro versions = 4.1.3...

WordPress EG-Series plugin <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by muhammad yudha in WordPress Plugin EG-Series versions = 2.1.1...

WordPress PropertyHive plugin <= 2.1.2 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin PropertyHive versions = 2.1.2...

WordPress WP User Profiles plugin <= 2.6.2 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by astra.r3verii Patchstack Alliance in WordPress Plugin WP User Profiles versions = 2.6.2...

WordPress Paid Member Subscriptions Plugin <= 2.13.0 is vulnerable to Arbitrary Code Execution

Software Paid Member Subscriptions Type Plugin Vulnerable versions = 2.13.0 Fixed in 2.13.1 OWASP Top 10 A3: Injection Classification Arbitrary Code Execution CVE CVE-2024-10261 Patch priority High CVSS severity High 7.3 Developer Claim ownership PSID da8c77c26afb Credits Arkadiusz Hydzik Require...

WordPress MP3 Sticky Player plugin <= 8.0 - Unauthenticated Arbitrary File Read/Download vulnerability

Unauthenticated Arbitrary File Read/Download vulnerability discovered by Tonn in WordPress Plugin MP3 Sticky Player versions = 8.0...

WordPress Parsi Date Plugin <= 5.1.1 is vulnerable to Cross Site Scripting (XSS)

Software Parsi Date Type Plugin Vulnerable versions = 5.1.1 Fixed in 5.1.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-11032 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID be0cd10da0f9 Credits vgo0 Required privileg...

WordPress Booster for WooCommerce Plugin <= 7.2.3 is vulnerable to Cross Site Scripting (XSS)

Software Booster for WooCommerce Type Plugin Vulnerable versions = 7.2.3 Fixed in 7.2.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9170 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID cb123e14d09e Credits Francesco Carluc...

WordPress Ahmeti Wp Güzel Sözler plugin <= 4.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by thiennv Patchstack Alliance in WordPress Plugin Ahmeti Wp Güzel Sözler versions = 4.0...

WordPress F4 Improvements Plugin <= 1.9.0 is vulnerable to Cross Site Scripting (XSS)

Software F4 Improvements Type Plugin Vulnerable versions = 1.9.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9442 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 375a420bcdeb Credits Francesco Carlucci Require...

WordPress Pathomation Plugin <= 2.5.1 is vulnerable to Arbitrary File Upload

Software Pathomation Type Plugin Vulnerable versions = 2.5.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-52490 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 9e87ceb4d934 Credits ghsinfosec Required privilege Unauthenticated...

WordPress CM Table Of Contents – WordPress TOC Plugin Plugin < 1.2.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software CM Table Of Contents – WordPress TOC Plugin Type Plugin Vulnerable versions 1.2.3 Fixed in 1.2.3 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-5030 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID bf478e63ad63...

WordPress Post SMTP Plugin <= 2.9.9 is vulnerable to SQL Injection

Software Post SMTP Type Plugin Vulnerable versions = 2.9.9 Fixed in 2.9.10 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-52436 Patch priority Low CVSS severity Low 7.6 Developer WPExperts PSID d90cd284edab Credits Hakiduck Required privilege Administrator Published 15...

WordPress Disable Admin Notices individually Plugin <= 1.3.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software Disable Admin Notices individually Type Plugin Vulnerable versions = 1.3.5 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-52420 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID efd85849f48f Credits...

WordPress Kognetiks Chatbot for WordPress Plugin <= 2.1.7 is vulnerable to Broken Access Control

Software Kognetiks Chatbot for WordPress Type Plugin Vulnerable versions = 2.1.7 Fixed in 2.1.8 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-10530 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 918318d433d6 Credits Tieu Pham Tro...

WordPress MPG Plugin <= 4.0.2 is vulnerable to Path Traversal

Software MPG Type Plugin Vulnerable versions = 4.0.2 Fixed in 4.0.3 OWASP Top 10 A1: Broken Access Control Classification Path Traversal CVE CVE-2024-10672 Patch priority Low CVSS severity Low 2.7 Developer Claim ownership PSID 3c7693c48068 Credits Arkadiusz Hydzik Required privilege Editor...

WordPress Buy one click WooCommerce Plugin <= 2.2.9 is vulnerable to Broken Access Control

Software Buy one click WooCommerce Type Plugin Vulnerable versions = 2.2.9 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-10852 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID a5a826444a0c Credits incognito Required...

WordPress Razorpay Payment Button Elementor Plugin Plugin <= 1.2.5 is vulnerable to Cross Site Scripting (XSS)

Software Razorpay Payment Button Elementor Plugin Type Plugin Vulnerable versions = 1.2.5 Fixed in 1.2.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10850 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 6e305704fc07...

WordPress CYAN Backup Plugin <= 2.5.3 is vulnerable to Arbitrary File Download

Software CYAN Backup Type Plugin Vulnerable versions = 2.5.3 Fixed in 2.5.4 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Download CVE CVE-2024-52390 Patch priority Low CVSS severity Low 4.9 Developer Claim ownership PSID b0f12165e19f Credits Junsu Yeo Required privilege...

WordPress WP Responsive Video Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Software WP Responsive Video Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51940 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 134f33fcccf3 Credits Zlrqh Required privilege Contributor...

WordPress Map Store Locator Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)

Software Map Store Locator Type Plugin Vulnerable versions = 1.2.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51920 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 3bad7bf99174 Credits SOPROBRO Required privilege Contributo...

WordPress WPLMS Theme <= 4.962 is vulnerable to Path Traversal

Software WPLMS Type Theme Vulnerable versions = 4.962 Fixed in 4.963 OWASP Top 10 A3: Injection Classification Path Traversal CVE CVE-2024-10470 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 63557cc0ea32 Credits Foxyyy Required privilege Unauthenticated Published 8...

WordPress RSV 360 View Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Software RSV 360 View Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51906 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 10130673798c Credits SOPROBRO Required privilege Contributor...