WordPress Posts Navigation Links for Sections and Headings plugin <= 1.0.1 - Cross-Site Request Forgery to Settings Update vulnerability

Cross-Site Request Forgery to Settings Update vulnerability discovered by dayea song - Ahnlab in WordPress Plugin Posts Navigation Links for Sections and Headings versions = 1.0.1...

WordPress WP Carticon plugin <= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting vulnerability

Authenticated Admin+ Stored Cross-Site Scripting vulnerability discovered by dayea song - Ahnlab in WordPress Plugin WP Carticon versions = 1.0.0...

WordPress Label Plugins plugin <= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability

Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability discovered by johska in WordPress Plugin Label Plugins versions = 0.5...

WordPress CE21 Suite plugin <= 2.3.1 - Unauthenticated Sensitive Information Exposure to Privilege Escalation vulnerability

Unauthenticated Sensitive Information Exposure to Privilege Escalation vulnerability discovered by kr0d in WordPress Plugin CE21 Suite versions = 2.3.1...

WordPress ViaAds plugin <= 2.1.1 - Cross-Site Request Forgery to API Key Update vulnerability

Cross-Site Request Forgery to API Key Update vulnerability discovered by Nabil Irawan - Heroes Cyber Security in WordPress Plugin ViaAds versions = 2.1.1...

WordPress WP Global Screen Options plugin <= 0.2 - Cross-Site Request Forgery to Screen Options Update vulnerability

Cross-Site Request Forgery to Screen Options Update vulnerability discovered by Nabil Irawan - Heroes Cyber Security in WordPress Plugin WP Global Screen Options versions = 0.2...

WordPress TablePress plugin <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode Attributes vulnerability discovered by Rafshanzani Suhada in WordPress Plugin TablePress versions = 3.2.4...

WordPress Greenshift plugin <= 12.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Chart Data Attributes vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Chart Data Attributes vulnerability discovered by Webbernaut in WordPress Plugin Greenshift versions = 12.2.7...

WordPress Ohio Extra plugin <= 3.6.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Ohio Extra versions = 3.6.0...

WordPress Kallyas theme <= 4.24.0 - Authenticated (Contributor+) Remote Code Execution vulnerability

Authenticated Contributor+ Remote Code Execution vulnerability discovered by stealthcopter in WordPress Theme KALLYAS versions = 4.24.0...

WordPress Kallyas theme <= 4.23.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by stealthcopter in WordPress Theme KALLYAS versions = 4.23.0...

WordPress Doccure Core plugin < 1.5.4 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Alyudin Nafiie in WordPress Plugin Doccure Core versions 1.5.4...

WordPress Advanced Ads plugin <= 2.0.12 - Unauthenticated Limited Code Execution vulnerability

Unauthenticated Limited Code Execution vulnerability discovered by mikemyers in WordPress Plugin Advanced Ads versions = 2.0.12...

WordPress Tablesome plugin <= 1.1.32 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Talal Nasraddeen in WordPress Plugin Tablesome versions = 1.1.32...

WordPress Delicious Recipes plugin <= 1.9.0 - Authenticated (Contributor+) Arbitrary File Upload vulnerability

Authenticated Contributor+ Arbitrary File Upload vulnerability discovered by stealthcopter and theviper17 in WordPress Plugin WP Delicious versions = 1.9.0...

WordPress Import WP plugin <= 2.14.16 - Authenticated (Admin+) Arbitrary File Read vulnerability

Authenticated Admin+ Arbitrary File Read vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Import WP versions = 2.14.16...

WordPress WP Discourse plugin <= 2.5.9 - Authenticated (Author+) Information Exposure vulnerability

Authenticated Author+ Information Exposure vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin WP Discourse versions = 2.5.9...

WordPress wpForo Forum plugin <= 2.4.9 - Authenticated (Susbscriber+) SQL Injection vulnerability

Authenticated Susbscriber+ SQL Injection vulnerability discovered by YCInfosec in WordPress Plugin wpForo Forum versions = 2.4.9...

WordPress Schema & Structured Data for WP & AMP plugin <= 1.51 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Schema & Structured Data for WP & AMP versions = 1.51...

WordPress Qi Blocks plugin <= 1.4.3 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Update vulnerability

Missing Authorization to Authenticated Contributor+ Plugin Settings Update vulnerability discovered by Adrian Lukita in WordPress Plugin Qi Blocks versions = 1.4.3...

WordPress Employee Spotlight plugin <= 5.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin Employee Spotlight versions = 5.1.2...

WordPress Folderly plugin <= 0.3 - Incorrect Authorization to Authenticated (Author+) Term Deletion vulnerability

Incorrect Authorization to Authenticated Author+ Term Deletion vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin Folderly versions = 0.3...

WordPress Community Events plugin <= 1.5.2 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by ifoundbug in WordPress Plugin Community Events versions = 1.5.2...

WordPress List category posts plugin <= 0.92.0 - Authenticated (Contributor+) Information Exposure vulnerability

Authenticated Contributor+ Information Exposure vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin List category posts versions = 0.92.0...

WordPress Flying Images plugin <= 2.4.14 - Authenticated (Admin+) Stored Cross-Site Scripting vulnerability

Authenticated Admin+ Stored Cross-Site Scripting vulnerability discovered by Karuppiah Sabari Kumar - Mobikwik in WordPress Plugin Flying Images versions = 2.4.14...

WordPress Schema Scalpel plugin <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title in JSON-LD Schema vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Post Title in JSON-LD Schema vulnerability discovered by Peter Thaleikis in WordPress Plugin Schema Scalpel versions = 1.6.1...

WordPress CSS & JavaScript Toolbox plugin <= 12.0.5 - Authenticated (Admin+) Stored Cross-Site Scripting vulnerability

Authenticated Admin+ Stored Cross-Site Scripting vulnerability discovered by Kyokito - - in WordPress Plugin CSS & JavaScript Toolbox versions = 12.0.5...

WordPress SiteSEO plugin <= 1.3.1 - Missing Authorization to Authenticated (Author+) Plugin Settings Update vulnerability

Missing Authorization to Authenticated Author+ Plugin Settings Update vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin SiteSEO versions = 1.3.1...

WordPress WP Legal Pages plugin <= 3.5.1 - Missing Authorization to Unauthenticated API Disconnect vulnerability

Missing Authorization to Unauthenticated API Disconnect vulnerability discovered by Rafshanzani Suhada in WordPress Plugin WPLegalPages versions = 3.5.1...

WordPress WPCOM Member plugin <= 1.7.14 - Authenticated (Contributor+) Local File Inclusion via Shortcode vulnerability

Authenticated Contributor+ Local File Inclusion via Shortcode vulnerability discovered by Naoya Takahashi nakko in WordPress Plugin WPCOM Member versions = 1.7.14...

WordPress Document Library Lite plugin <= 1.1.6 - Missing Authorization to Sensitive Information Exposure vulnerability

Missing Authorization to Sensitive Information Exposure vulnerability discovered by Avraham Shemesh and Kai Aizen in WordPress Plugin Document Library Lite versions = 1.1.6...

WordPress Inactive Logout plugin <= 3.5.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by shark3y in WordPress Plugin Inactive Logout versions = 3.5.5...

WordPress RealPress plugin < 1.1.0 - Unauthenticated Content Creation/Email Sending via REST vulnerability

Unauthenticated Content Creation/Email Sending via REST vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin RealPress versions 1.1.0...

WordPress Post SMTP plugin <= 3.6.0 - Missing Authorization to Account Takeover via Unauthenticated Email Log Disclosure vulnerability

Missing Authorization to Account Takeover via Unauthenticated Email Log Disclosure vulnerability discovered by netranger in WordPress Plugin Post SMTP versions = 3.6.0...

WordPress WP Snow Effect plugin <= 1.1.19 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin WP Snow Effect versions = 1.1.19...

WordPress North - Required Plugin plugin <= 1.4.2 - Local File Inclusion vulnerability

WordPress North - Required Plugin plugin = 1.4.2 - Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin North - Required Plugin versions = 1.4.2...

WordPress Kallyas Theme <= 4.23.0 is vulnerable to Cross Site Scripting (XSS)

Software Kallyas Type Theme Vulnerable versions = 4.23.0 Fixed in 4.24.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2025-6988 Patch priority Low CVSS severity Low 6.5 Developer EPC PSID e0831bfa42ea Credits stealthcopter Required privilege Contributo...

WordPress Kallyas Theme <= 4.24.0 is vulnerable to Remote Code Execution (RCE)

Software Kallyas Type Theme Vulnerable versions = 4.24.0 Fixed in N/A OWASP Top 10 A1: Injection Classification Remote Code Execution RCE CVE CVE-2025-6990 Patch priority Medium CVSS severity Medium 8.8 Developer EPC PSID fef69fa1779b Credits stealthcopter Required privilege Contributor Published...

WordPress YOP Poll plugin <= 6.5.38 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Que Thanh Tuan - Blue Rock in WordPress Plugin YOP Poll versions = 6.5.38...

WordPress WP Maps plugin <= 4.8.6 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by kr0no in WordPress Plugin WP Maps versions = 4.8.6...

WordPress SmartMag theme <= 10.3.0 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme SmartMag versions = 10.3.0...

WordPress Booking and Rental Manager plugin <= 2.5.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ryan Novotny in WordPress Plugin Booking and Rental Manager versions = 2.5.3...

WordPress SmartMag Theme <= 10.3.0 is vulnerable to Local File Inclusion

Software SmartMag Type Theme Vulnerable versions = 10.3.0 Fixed in 10.3.1 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-64216 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID de6195233272 Credits João Pedro S Alcântara Kinorth Required privileg...

WordPress Bard theme <= 2.229 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mohamad Fattyr in WordPress Theme Bard versions = 2.229...

WordPress Google XML Sitemaps plugin <= 4.1.22 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by NumeX in WordPress Plugin Google XML Sitemaps versions = 4.1.22...

WordPress Popup addon for Ninja Forms plugin <= 3.5.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Kim YunJi in WordPress Plugin Popup addon for Ninja Forms versions = 3.5.1...

WordPress ERI File Library plugin <= 1.1.0 - Missing Authorization to Unauthenticated Protected File Download vulnerability

Missing Authorization to Unauthenticated Protected File Download vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin ERI File Library versions = 1.1.0...

WordPress WPC Name Your Price for WooCommerce plugin <= 2.1.9 - Unauthenticated Price Alteration vulnerability

Unauthenticated Price Alteration vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin WPC Name Your Price for WooCommerce versions = 2.1.9...

WordPress The Events Calendar plugin <= 6.15.9 - Missing Authorization to Authenticated (Subscriber+) Draft Event Title/QR Code Exposure vulnerability

Missing Authorization to Authenticated Subscriber+ Draft Event Title/QR Code Exposure vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan - Knight Squad in WordPress Plugin The Events Calendar versions = 6.15.9...

WordPress OOPSpam Anti-Spam plugin <= 1.2.53 - Unauthenticated IP Header Spoofing vulnerability

Unauthenticated IP Header Spoofing vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin OOPSpam Anti-Spam versions = 1.2.53...