WordPress Popup box plugin <= 5.5.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by ch4r0n in WordPress Plugin Popup box versions = 5.5.4...

Drupal Simple OAuth (OAuth2) & OpenID Connect module 6.0.0-6.0.6 - Unauthenticated Broken Access Control vulnerability

Unauthenticated Broken Access Control vulnerability discovered by coffeemakr in WordPress Module Simple OAuth OAuth2 & OpenID Connect versions 6.0.0-6.0.6...

Anti-Malware Security and Brute-Force Firewall <= 4.23.81 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read

Missing Authorization to Authenticated Subscriber+ Arbitrary File Read vulnerability discovered by Dmitrii Ignatyev - CleanTalk Inc in WordPress Plugin Anti-Malware Security and Brute-Force Firewall versions = 4.23.81...

WordPress Яндекс Доставка (Boxberry) plugin <= 2.34 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin Яндекс Доставка Boxberry versions = 2.34...

WordPress WordPress Contact Form 7 PDF, Google Sheet & Database plugin <= 3.0.0 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by 0xd4rk5id3 in WordPress Plugin WordPress Contact Form 7 PDF, Google Sheet & Database versions = 3.0.0...

WordPress Polylang plugin <= 3.7.3 - Deserialization of untrusted data vulnerability

Deserialization of untrusted data vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin Polylang versions = 3.7.3...

WordPress HUSKY plugin <= 1.3.7.1 - Unauthenticated SQL Injection via `phrase` Parameter vulnerability

Unauthenticated SQL Injection via phrase Parameter vulnerability discovered by LionTree in WordPress Plugin HUSKY versions = 1.3.7.1...

WordPress Auto Featured Image (Auto Post Thumbnail) plugin <= 4.1.7 - Authenticated (Author+) Server-Side Request Forgery vulnerability

Authenticated Author+ Server-Side Request Forgery vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Auto Featured Image Auto Post Thumbnail versions = 4.1.7...

WordPress IDonate plugin < 2.1.13 - Unauthenticated User Deletion vulnerability

Unauthenticated User Deletion vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin IDonate versions 2.1.13...

WordPress FuseWP plugin <= 1.1.23.0 - Cross-Site Request Forgery to Sync Rule Creation vulnerability

Cross-Site Request Forgery to Sync Rule Creation vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin FuseWP versions = 1.1.23.0...

WordPress Advanced Database Cleaner plugin <= 3.1.6 - Cross-Site Request Forgery to Settings Manipulation vulnerability

Cross-Site Request Forgery to Settings Manipulation vulnerability discovered by Bao - BlueRock in WordPress Plugin Advanced Database Cleaner versions = 3.1.6...

WordPress Soledad theme <= 8.7.0 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Soledad versions = 8.7.0...

WordPress Elastic Email Sender plugin <= 1.2.20 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin Elastic Email Sender versions = 1.2.20...

WordPress Mailster plugin < 4.1.14 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Mailster versions 4.1.14...

WordPress Master Slider Pro plugin <= 3.7.12 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Master Slider Pro versions = 3.7.12...

WordPress Media Library File Download plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nabil Irawan in WordPress Plugin Media Library File Download versions = 1.4...

WordPress Create Posts & Terms plugin <= 1.3.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Create Posts & Terms versions = 1.3.1...

WordPress Range Slider Addon for Gravity Forms plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by HunSec in WordPress Plugin Range Slider Addon for Gravity Forms versions = 1.1.6...

WordPress Insert PHP Code Snippet plugin <= 1.4.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Bao - BlueRock in WordPress Plugin Insert PHP Code Snippet versions = 1.4.3...

WordPress Ronneby Theme Core plugin <= 1.5.68 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Ronneby Theme Core versions = 1.5.68...

WordPress Ronneby Theme Core plugin <= 1.5.68 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Ronneby Theme Core versions = 1.5.68...

WordPress WPLMS plugin <= 1.9.9.5.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin WPLMS versions = 1.9.9.5.4...

WordPress Consulting Elementor Widgets plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Consulting Elementor Widgets versions = 1.4.2...

WordPress Consulting Elementor Widgets plugin <= 1.4.2 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Consulting Elementor Widgets versions = 1.4.2...

WordPress Consulting theme < 6.7.5 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Consulting versions 6.7.5...

WordPress Sahifa theme < 5.8.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Sahifa versions 5.8.6...

WordPress wpresidence theme <= 5.3.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme wpresidence versions = 5.3.2...

WordPress Web Accessibility By accessiBe plugin <= 2.10 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin Web Accessibility By accessiBe versions = 2.10...

WordPress Sahifa Theme < 5.8.6 is vulnerable to Cross Site Scripting (XSS)

Software Sahifa Type Theme Vulnerable versions 5.8.6 Fixed in 5.8.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2025-64202 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 32bb45fc3f37 Credits João Pedro S Alcântara Kinorth Required privilege...

WordPress wpresidence Theme <= 5.3.2 is vulnerable to Broken Access Control

Software wpresidence Type Theme Vulnerable versions = 5.3.2 Fixed in 5.3.2.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2025-64199 Patch priority Low CVSS severity Low 5.3 Developer sc Internet Vivoo PSID 1c3b4381448c Credits João Pedro S Alcântara Kinorth...

WordPress Easy Social Share Buttons plugin < 10.7.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Easy Social Share Buttons versions 10.7.1...

WordPress Shortcodes and extra features for Phlox theme plugin <= 2.17.15 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Bao - BlueRock in WordPress Plugin Shortcodes and extra features for Phlox theme versions = 2.17.15...

WordPress DoFollow Case by Case plugin <= 3.5.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nabil Irawan in WordPress Plugin DoFollow Case by Case versions = 3.5.1...

WordPress SimpLy Gallery plugin <= 3.3.2.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Peter Thaleikis in WordPress Plugin SimpLy Gallery versions = 3.3.2.1...

WordPress WPMobile.App plugin <= 11.71 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by ? in WordPress Plugin WPMobile.App versions = 11.71...

WordPress FileBird Pro plugin <= 6.5.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin FileBird Pro versions = 6.5.1...

WordPress Gutenberg plugin <= 21.8.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Peter Thaleikis in WordPress Plugin Gutenberg versions = 21.8.2...

WordPress HAPPY plugin <= 1.0.7 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by mcdruid in WordPress Plugin HAPPY versions = 1.0.7...

WordPress The7 theme <= 12.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'the7_fancy_title_css' vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'the7fancytitlecss' vulnerability discovered by Muhammad Yudha - DJ in WordPress Theme The7 versions = 12.9.1...

WordPress Product Filter by WBW plugin <= 2.9.7 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by mikemyers in WordPress Plugin Product Filter by WBW versions = 2.9.7...

WordPress Stripe Payment Forms plugin <= 8.3.1 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by mikemyers in WordPress Plugin WP Full Stripe Free versions = 8.3.1...

WordPress Fast Velocity Minify plugin <= 3.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting vulnerability

Authenticated Admin+ Stored Cross-Site Scripting vulnerability discovered by Cody Sixteen in WordPress Plugin Fast Velocity Minify versions = 3.5.1...

WordPress Password Policy Manager plugin <= 2.0.5 - Missing Authorization to Authenticated (Subscriber+) Configuration Log Out vulnerability

Missing Authorization to Authenticated Subscriber+ Configuration Log Out vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Password Policy Manager versions = 2.0.5...

WordPress Widget Options plugin <= 4.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Nguyen Ngoc Quang Bach maysbachs in WordPress Plugin Widget Options versions = 4.1.2...

WordPress Social Feed Gallery plugin <= 4.9.2 - Missing Authorization to Unauthenticated Information Exposure vulnerability

Missing Authorization to Unauthenticated Information Exposure vulnerability discovered by 3r1c e in WordPress Plugin WP Social Feed Gallery versions = 4.9.2...

WordPress SpendeOnline.org plugin <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Gilang - DJ in WordPress Plugin SpendeOnline.org versions = 3.0.1...

WordPress wpForo Forum plugin <= 2.4.8 - Unauthenticated SQL Injection via get_members Function vulnerability

Unauthenticated SQL Injection via getmembers Function vulnerability discovered by mikemyers in WordPress Plugin wpForo Forum versions = 2.4.8...

WordPress Discussion Board – WordPress Forum Plugin plugin <= 2.5.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution vulnerability

Authenticated Subscriber+ Arbitrary Shortcode Execution vulnerability discovered by Kishan Vyas in WordPress Plugin Discussion Board versions = 2.5.5...

WordPress Charitable plugin <= 1.8.8.4 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Rafshanzani Suhada in WordPress Plugin Charitable versions = 1.8.8.4...

WordPress Directorist plugin <= 8.4.8 - Authenticated (Subscriber+) Arbitrary File Move vulnerability

Authenticated Subscriber+ Arbitrary File Move vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin Directorist versions = 8.4.8...