WordPress AdForest Theme <= 6.0.9 is vulnerable to Broken Authentication

Software AdForest Type Theme Vulnerable versions = 6.0.9 Fixed in 6.0.10 OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2025-8359 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID f086df38edf9 Credits Tonn Required...

WordPress Off-Canvas Sidebars & Menus (Slidebars) plugin <= 0.5.8.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nabil Irawan in WordPress Plugin Off-Canvas Sidebars & Menus Slidebars versions = 0.5.8.5...

WordPress Import CDN-Remote Images plugin <= 2.1.2 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Skalucy in WordPress Plugin Import CDN-Remote Images versions = 2.1.2...

WordPress Site Chat on Telegram plugin <= 1.0.4 - PHP Object Injection Vulnerability

PHP Object Injection Vulnerability discovered by Drew / mcdruid in WordPress Plugin Site Chat on Telegram versions = 1.0.4...

WordPress WPBakery Page Builder plugin <= 8.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via Grid Builder vulnerability

Authenticated Author+ Stored Cross-Site Scripting via Grid Builder vulnerability discovered by zer0gh0st in WordPress Plugin WPBakery Page Builder versions = 8.4.1...

WordPress Responsive Blocks plugin <= 2.0.5 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by zaim in WordPress Plugin Responsive Blocks versions = 2.0.5...

WordPress Widget Logic <= 6.0.5 - Remote Code Execution (RCE) Vulnerability

Remote Code Execution RCE Vulnerability discovered by ch4r0n Patchstack Alliance in WordPress Plugin Widget Logic versions = 6.0.5...

WordPress RealHomes Theme <= 4.4.0 is vulnerable to Privilege Escalation

Software RealHomes Type Theme Vulnerable versions = 4.4.0 Fixed in 4.4.1 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2025-4601 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 08bda80a3ca8 Credits Thái An Require...

WordPress CSV Mass Importer plugin <= 1.2 - Admin+ Arbitrary File Upload vulnerability

Admin+ Arbitrary File Upload vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin CSV Mass Importer versions = 1.2...

WordPress Dynamic Pricing and Discount Rules plugin <= 2.2.9 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by luckybuddy Patchstack Alliance in WordPress Plugin Dynamic Pricing and Discount Rules versions = 2.2.9...

WordPress Taskbuilder plugin < 3.0.9 - Admin+ SQL Injection vulnerability

Admin+ SQL Injection vulnerability discovered by Bob Matyas in WordPress Plugin Taskbuilder versions 3.0.9...

WordPress Download Manager plugin <= 3.2.98 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Download Manager versions = 3.2.98...

WordPress Travelfic Toolkit plugin <= 1.2.1 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Travelfic Toolkit versions = 1.2.1...

WordPress Customify Theme <= 0.4.8 is vulnerable to Broken Access Control

Software Customify Type Theme Vulnerable versions = 0.4.8 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2025-26920 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 6338c0e15242 Credits Fariq Fadillah Gusti Insani Required...

WordPress Quiz Organizer plugin <= 2.9.1 - Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting vulnerability discovered by Artem Polynko Artem Polynko in WordPress Plugin Quiz Organizer versions = 2.9.1...

WordPress Bulk Me Now plugin <= 2.0 - Message Deletion via CSRF vulnerability

Message Deletion via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin Bulk Me Now! versions = 2.0...

WordPress HTML5 Video Player – mp4 Video Player Plugin and Block plugin <= 2.5.35 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via heading Parameter vulnerability

Authenticated Contributor+ DOM-Based Stored Cross-Site Scripting via heading Parameter vulnerability discovered by Webbernaut in WordPress Plugin Flash & HTML5 Video versions = 2.5.35...

WordPress Booster for WooCommerce Plugin <= 7.2.3 is vulnerable to Cross Site Scripting (XSS)

Software Booster for WooCommerce Type Plugin Vulnerable versions = 7.2.3 Fixed in 7.2.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9170 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID cb123e14d09e Credits Francesco Carluc...

WordPress ITERAS Plugin <= 1.7.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software ITERAS Type Plugin Vulnerable versions = 1.7.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-53710 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID fe46f5e0e01b Credits SOPROBRO Required privilege...

WordPress Run Contests, Raffles, and Giveaways with ContestsWP Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS)

Software Run Contests, Raffles, and Giveaways with ContestsWP Type Plugin Vulnerable versions = 2.0.3 Fixed in 2.0.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-11456 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID...

WordPress System Dashboard Plugin < 2.8.15 is vulnerable to Cross Site Scripting (XSS)

Software System Dashboard Type Plugin Vulnerable versions 2.8.15 Fixed in 2.8.15 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-11107 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 948953d35f1c Credits Dogus Demirkiran...

WordPress Ultimate Member Plugin <= 2.8.9 is vulnerable to Broken Access Control

Software Ultimate Member Type Plugin Vulnerable versions = 2.8.9 Fixed in 2.9.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-10528 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 65aa5e86b9d5 Credits tiborisaak Required privilege...

WordPress Pathomation Plugin <= 2.5.1 is vulnerable to Arbitrary File Upload

Software Pathomation Type Plugin Vulnerable versions = 2.5.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-52490 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 9e87ceb4d934 Credits ghsinfosec Required privilege Unauthenticated...

WordPress WooCommerce Product Table Lite Plugin <= 3.8.6 is vulnerable to Cross Site Scripting (XSS)

Software WooCommerce Product Table Lite Type Plugin Vulnerable versions = 3.8.6 Fixed in 3.8.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10899 Patch priority High CVSS severity High 7.3 Developer Claim ownership PSID 3a15e4b0ec96 Credits...

WordPress WPB Popup for Contact Form 7 Plugin <= 1.7.5 is vulnerable to Broken Access Control

Software WPB Popup for Contact Form 7 Type Plugin Vulnerable versions = 1.7.5 Fixed in 1.7.6 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-11038 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 9b3456d161fd Credits Arkadiusz...

WordPress Premium Packages Plugin <= 5.9.5 is vulnerable to SQL Injection

Software Premium Packages Type Plugin Vulnerable versions = 5.9.5 Fixed in N/A OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-52435 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID d5408dddb735 Credits Jorge Diaz ddiax Required privilege Administrator...

WordPress User Extra Fields Plugin <= 16.6 is vulnerable to Privilege Escalation

Software User Extra Fields Type Plugin Vulnerable versions = 16.6 Fixed in 16.7 OWASP Top 10 A5: Broken Access Control Classification Privilege Escalation CVE CVE-2024-10800 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 90d7101cbd67 Credits Tonn Required privilege...

WordPress CF7 Reply Manager Plugin <= 1.2.3 is vulnerable to Arbitrary File Upload

Software CF7 Reply Manager Type Plugin Vulnerable versions = 1.2.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-52404 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID ea9af17f6366 Credits stealthcopter Required privilege...

WordPress WP Githuber MD Plugin <= 1.16.3 is vulnerable to Cross Site Scripting (XSS)

Software WP Githuber MD Type Plugin Vulnerable versions = 1.16.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-52422 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 80930d0544eb Credits Fazle Mawla Required privilege Contribut...

WordPress AJAX Login and Registration modal popup + inline form Plugin <= 2.24 is vulnerable to Cross Site Scripting (XSS)

Software AJAX Login and Registration modal popup + inline form Type Plugin Vulnerable versions = 2.24 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8874 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID...

WordPress Floating Buttons for WooCommerce Plugin <= 2.8.8 is vulnerable to Broken Access Control

Software Floating Buttons for WooCommerce Type Plugin Vulnerable versions = 2.8.8 Fixed in 2.9.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-52395 Patch priority Medium CVSS severity Medium 5.3 Developer Claim ownership PSID 7c8260ec946a Credits Mika...

WordPress OpenCart Product Display Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Software OpenCart Product Display Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51835 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8e702c8effc7 Credits SOPROBRO Required privilege...

WordPress HB AUDIO GALLERY Plugin <= 3.0 is vulnerable to Arbitrary File Upload

Software HB AUDIO GALLERY Type Plugin Vulnerable versions = 3.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-51790 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 40d2c24127c2 Credits stealthcopter Required privilege...

WordPress Ultimate Accordion Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Software Ultimate Accordion Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51797 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID b1fe37ef7d14 Credits SOPROBRO Required privilege Contributor...

WordPress WP Responsive Video Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Software WP Responsive Video Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51940 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 134f33fcccf3 Credits Zlrqh Required privilege Contributor...

WordPress Narnoo Commerce Manager Plugin <= 1.6.0 is vulnerable to Cross Site Scripting (XSS)

Software Narnoo Commerce Manager Type Plugin Vulnerable versions = 1.6.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51708 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 1daa09058da0 Credits João Pedro S Alcântara...

WordPress Photo Gallery by 10Web Plugin <= 1.8.30 is vulnerable to Cross Site Scripting (XSS)

Software Photo Gallery by 10Web Type Plugin Vulnerable versions = 1.8.30 Fixed in 1.8.31 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9878 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID e0cf77477c6f Credits tmrswrr Require...

WordPress Naver Blog Plugin <= 1.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Naver Blog Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-51639 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 5f89994a572e Credits SOPROBRO Required privilege...

WordPress Flash Show And Hide Box Plugin <= 1.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software Flash Show And Hide Box Type Plugin Vulnerable versions = 1.6 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-51656 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 61be485fbb22 Credits SOPROBRO Requir...

WordPress BBP Core - Expand bbPress powered forums with useful features Plugin <= 1.2.5 is vulnerable to Cross Site Scripting (XSS)

Software BBP Core - Expand bbPress powered forums with useful features Type Plugin Vulnerable versions = 1.2.5 Fixed in 1.2.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9896 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownershi...

WordPress Download Manager Plugin < 3.3.00 is vulnerable to Cross Site Scripting (XSS)

Software Download Manager Type Plugin Vulnerable versions 3.3.00 Fixed in 3.3.00 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8444 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 72a55938734a Credits Miguel Xavier Penha Net...

WordPress Plug your WooCommerce into the largest catalog of customized print products from Helloprint Plugin <= 2.0.2 is vulnerable to Arbitrary File Upload

Software Plug your WooCommerce into the largest catalog of customized print products from Helloprint Type Plugin Vulnerable versions = 2.0.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-50525 Patch priority High CVSS severity High 10 Developer Claim...

WordPress Events Manager Pro – extended Plugin <= 0.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Events Manager Pro – extended Type Plugin Vulnerable versions = 0.1 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-50532 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 6e38b5b027b3 Credits SOPROBRO...

WordPress Woocommerce Product Design Plugin <= 1.0.0 is vulnerable to Arbitrary File Download

Software Woocommerce Product Design Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Download CVE CVE-2024-50508 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 6ce68eabacf0 Credits ghsinfosec...

WordPress 1-Click Login: Passwordless Authentication Plugin 1.4.5 is vulnerable to Broken Authentication

Software 1-Click Login: Passwordless Authentication Type Plugin Vulnerable versions 1.4.5 Fixed in N/A OWASP Top 10 A4: Insecure Design Classification Broken Authentication CVE CVE-2024-50478 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 2b1c10f4ccc7 Credits...

WordPress Uix Shortcodes Plugin <= 1.9.9 is vulnerable to Arbitrary Code Execution

Software Uix Shortcodes Type Plugin Vulnerable versions = 1.9.9 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary Code Execution CVE CVE-2024-9772 Patch priority High CVSS severity High 7.3 Developer Claim ownership PSID a42f828d9a99 Credits Francesco Carlucci Required privilege...

WordPress AMP for WP Plugin <= 1.0.99.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software AMP for WP Type Plugin Vulnerable versions = 1.0.99.1 Fixed in 1.0.99.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-9598 Patch priority Low CVSS severity Low 8.8 Developer Claim ownership PSID 79afb46366eb Credits David Gallagher...

WordPress WordPress Meta Data and Taxonomies Filter (MDTF) Plugin <= 1.3.3.4 is vulnerable to Bypass Vulnerability

Software WordPress Meta Data and Taxonomies Filter MDTF Type Plugin Vulnerable versions = 1.3.3.4 Fixed in 1.3.3.5 OWASP Top 10 A3: Injection Classification Bypass Vulnerability CVE CVE-2024-50450 Patch priority High CVSS severity High 7.3 Developer Claim ownership PSID 932ab0156d80 Credits Dimas...

WordPress Survey Maker Plugin <= 5.0.2 is vulnerable to Cross Site Scripting (XSS)

Software Survey Maker Type Plugin Vulnerable versions = 5.0.2 Fixed in 5.0.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-50426 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 335af01ef67c Credits Marek Mikita Required privilege...

WordPress CWD 3D Image Gallery Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Software CWD 3D Image Gallery Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49632 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID ff9d4857fb07 Credits João Pedro S Alcântara Kinorth...