WordPress Tutor LMS Pro plugin <= 3.8.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to View/Edit Other Assignments vulnerability

Authenticated Subscriber+ Insecure Direct Object Reference to View/Edit Other Assignments vulnerability discovered by sergioframi in WordPress Plugin Tutor LMS Pro versions = 3.8.3...

WordPress ShopEngine plugin <= 4.8.4 - Incorrect Authorization to Authenticated (Editor+) License Status Update vulnerability

Incorrect Authorization to Authenticated Editor+ License Status Update vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin ShopEngine versions = 4.8.4...

WordPress Product Filter by WBW plugin <= 3.0.0 - Missing Authorization to Unauthenticated Settings Update vulnerability

Missing Authorization to Unauthenticated Settings Update vulnerability discovered by Lucas Montes Nirox in WordPress Plugin Product Filter by WBW versions = 3.0.0...

WordPress Tutor LMS plugin <= 3.8.3 - Missing Authorization to Sensitive Information Exposure vulnerability

Missing Authorization to Sensitive Information Exposure vulnerability discovered by sergioframi in WordPress Plugin Tutor LMS versions = 3.8.3...

WordPress Simple Registration for WooCommerce plugin <= 1.5.8 - Cross-Site Request Forgery to Privilege Escalation via Role Request Approval vulnerability

Cross-Site Request Forgery to Privilege Escalation via Role Request Approval vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Simple Registration for WooCommerce versions = 1.5.8...

WordPress Listeo plugin <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via soundcloud Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via soundcloud Shortcode vulnerability discovered by Craig Webb in WordPress Theme Listeo versions = 2.0.8...

WordPress Gutenberg Blocks – PublishPress Blocks Controls, Visibility, Reusable Blocks plugin <= 3.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zer0gh0st in WordPress Plugin Gutenberg Blocks versions = 3.3.4...

WordPress Testimonial Carousel For Elementor plugin <= 11.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Multiple Widgets vulnerability discovered by zer0gh0st in WordPress Plugin Testimonial Carousel For Elementor versions = 11.6.2...

WordPress User Feedback plugin <= 1.8.0 - Missing Authorization to Information Disclosure vulnerability

Missing Authorization to Information Disclosure vulnerability discovered by Nguyen Ngoc Quang Bach maysbachs in WordPress Plugin User Feedback versions = 1.8.0...

WordPress Open Source Genesis Framework plugin <= 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Multiple Shortcodes vulnerability discovered by Muhammad Yudha - DJ in WordPress Theme Genesis Framework versions = 3.6.0...

WordPress Watu Quiz plugin <= 3.4.4 - Unauthenticated Stored Cross-Site Scripting via HTTP Referer vulnerability

Unauthenticated Stored Cross-Site Scripting via HTTP Referer vulnerability discovered by Naoya Takahashi nakko in WordPress Plugin Watu Quiz versions = 3.4.4...

WordPress Tutor LMS plugin <= 3.8.3 - Missing Authorization to Unauthenticated Payment Status Update vulnerability

Missing Authorization to Unauthenticated Payment Status Update vulnerability discovered by Rafshanzani Suhada in WordPress Plugin Tutor LMS versions = 3.8.3...

WordPress Password Protected plugin <= 2.7.11 - Unauthenticated Authorization Bypass via IP Address Spoofing vulnerability

Unauthenticated Authorization Bypass via IP Address Spoofing vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Password Protected versions = 2.7.11...

WordPress GenerateBlocks plugin <= 2.1.1 - Improper Authorization to Authenticated (Contributor+) Arbitrary Options Disclosure vulnerability

Improper Authorization to Authenticated Contributor+ Arbitrary Options Disclosure vulnerability discovered by Lucas Montes Nirox in WordPress Plugin GenerateBlocks versions = 2.1.1...

WordPress WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress plugin <= 8.5.41 - Improper Authorization to Authenticated (Contributor+) Plugin Settings Update vulnerability

Improper Authorization to Authenticated Contributor+ Plugin Settings Update vulnerability discovered by Rafshanzani Suhada in WordPress Plugin WP VR versions = 8.5.41...

WordPress ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution plugin <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by theviper17y in WordPress Plugin ShopLentor versions = 3.2.4...

WordPress Listeo Theme <= 2.0.8 is vulnerable to Cross Site Scripting (XSS)

Software Listeo Type Theme Vulnerable versions = 2.0.8 Fixed in 2.0.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2025-8413 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 2a561241c24c Credits Craig Webb Required privilege...

WordPress The7 Theme <= 12.9.1 is vulnerable to Cross Site Scripting (XSS)

Software The7 Type Theme Vulnerable versions = 12.9.1 Fixed in 12.9.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2025-11897 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 600f7d8465b6 Credits Muhammad Yudha - DJ Required...

WordPress BackWPup plugin 5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin BackWPup versions 5...

WordPress AI Chatbot Free Models – Customer Support, Live Chat, Virtual Assistant plugin <= 1.6.5 - Unauthenticated CSV Injection vulnerability

Unauthenticated CSV Injection vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin AI Chatbot Free Models versions = 1.6.5...

WordPress WooCommerce Designer Pro plugin <= 1.9.26 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Tonn in WordPress Plugin WooCommerce Designer Pro versions = 1.9.26...

WordPress Jeg Elementor Kit plugin < 2.7.0 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Tony in WordPress Plugin Jeg Elementor Kit versions 2.7.0...

WordPress Orbit Fox plugin < 3.0.2 - Author+ Server-Side Request Forgery vulnerability

Author+ Server-Side Request Forgery vulnerability discovered by Ryan Roth in WordPress Plugin Orbit Fox by ThemeIsle versions 3.0.2...

WordPress PixelYourSite plugin < 11.1.2 - Admin+ LFI vulnerability

Admin+ LFI vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin PixelYourSite – Your smart PIXEL TAG Manager versions 11.1.2...

WordPress Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin <= 2.1.4 - Unauthenticated Server-Side Request Forgery vulnerability

Unauthenticated Server-Side Request Forgery vulnerability discovered by Rafshanzani Suhada in WordPress Plugin PopupKit versions = 2.1.4...

WordPress Slider Templates plugin <= 1.0.3 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Nabil Irawan in WordPress Plugin Slider Templates versions = 1.0.3...

WordPress WPComplete plugin <= 2.9.5.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin WPComplete versions = 2.9.5.3...

WordPress ThemeRain Core plugin <= 1.1.9 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin ThemeRain Core versions = 1.1.9...

WordPress MDTF plugin <= 1.3.3.9 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin MDTF versions = 1.3.3.9...

WordPress Advanced FAQ Manager plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Advanced FAQ Manager versions = 1.5.2...

WordPress ZoloBlocks plugin <= 2.3.11 - Missing Authorization to Unauthenticated Popup Enable/Disable vulnerability

Missing Authorization to Unauthenticated Popup Enable/Disable vulnerability discovered by Jay in WordPress Plugin ZoloBlocks versions = 2.3.11...

WordPress Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin <= 5.2.4 - Authenticated (Admin+) Server-Side Request Forgery via scan-without-login Endpoint vulnerability

Authenticated Admin+ Server-Side Request Forgery via scan-without-login Endpoint vulnerability discovered by SpiderSec in WordPress Plugin Real Cookie Banner versions = 5.2.4...

WordPress URL Shortener Plugin For WordPress plugin <= 3.0.7 - Missing Authorization to Authenticated (Subscriber+) Link Manipulation vulnerability

Missing Authorization to Authenticated Subscriber+ Link Manipulation vulnerability discovered by ifoundbug in WordPress Plugin URL Shortener versions = 3.0.7...

WordPress Microsoft Azure Storage for WordPress plugin <= 4.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Media Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Media Deletion vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Microsoft Azure Storage for WordPress versions = 4.5.1...

WordPress Multi Item Responsive Slider plugin <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability

Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Multi Item Responsive Slider versions = 1.0...

WordPress Disable Content Editor For Specific Template plugin <= 2.0 - Cross-Site Request Forgery to Template Configuration Update vulnerability

Cross-Site Request Forgery to Template Configuration Update vulnerability discovered by Nabil Irawan in WordPress Plugin Disable Content Editor For Specific Template versions = 2.0...

WordPress RapidResult plugin <= 1.2 - Authenticated (Contributor+) SQL Injection vulnerability

Authenticated Contributor+ SQL Injection vulnerability discovered by John Lee in WordPress Plugin RapidResult versions = 1.2...

WordPress NGINX Cache Optimizer plugin <= 1.1 - Missing Authorization to Authenticated (Subscriber+) Dynamic Caching Exclusion Update vulnerability

Missing Authorization to Authenticated Subscriber+ Dynamic Caching Exclusion Update vulnerability discovered by Legion Hunter in WordPress Plugin NGINX Cache Optimizer versions = 1.1...

WordPress AIO Forms plugin <= 1.3.18 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by tmrswrr in WordPress Plugin AIO Forms versions = 1.3.18...

WordPress Check Plagiarism plugin <= 2.0 - Missing Authorization to Authenticated (Subscriber+) Settings Update vulnerability

Missing Authorization to Authenticated Subscriber+ Settings Update vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Check Plagiarism versions = 2.0...

WordPress IndieAuth plugin <= 4.5.4 - Cross-Site Request Forgery to Account Takeover via Stolen OAuth Tokens vulnerability

Cross-Site Request Forgery to Account Takeover via Stolen OAuth Tokens vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin IndieAuth versions = 4.5.4...

WordPress LLM Hubspot Blog Import plugin <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Hubspot Import vulnerability

Missing Authorization to Authenticated Subscriber+ Hubspot Import vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin LLM Hubspot Blog Import versions = 1.0.1...

WordPress VNPAY for Woocommerce plugin <= 1.0.0 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin VNPAY Payment gateway versions = 1.0.0...

WordPress qnotsquiz plugin <= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting vulnerability

Authenticated Admin+ Stored Cross-Site Scripting vulnerability discovered by dayea song in WordPress Plugin qnotsquiz versions = 1.0.0...

WordPress Supervisor plugin <= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update vulnerability

Missing Authorization to Authenticated Subscriber+ Settings Update vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Supervisor versions = 1.3.2...

WordPress Time Clock plugin <= 1.3.1 - Authenticated (Custom+) Stored Cross-Site Scripting vulnerability

Authenticated Custom+ Stored Cross-Site Scripting vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Time Clock versions = 1.3.1...

WordPress Simple Excel Pricelist for WooCommerce plugin <= 1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by Peter Thaleikis in WordPress Plugin Simple Excel Pricelist for WooCommerce versions = 1.13...

WordPress Quickcreator – AI Blog Writer plugin 0.0.9-0.1.17 - Unauthenticated API Key Exposure vulnerability

Unauthenticated API Key Exposure vulnerability discovered by kr0d in WordPress Plugin Quickcreator – AI Blog Writer versions 0.0.9-0.1.17...

WordPress Originality.ai AI Checker plugin <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'ai_get_table' vulnerability

Missing Authorization to Authenticated Subscriber+ Sensitive Information Disclosure via 'aigettable' vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Originality.ai AI Checker versions = 1.0.12...

WordPress Originality.ai AI Checker plugin <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) Scan Log Deletion via ' ai_scan_result_remove' vulnerability

Missing Authorization to Authenticated Subscriber+ Scan Log Deletion via ' aiscanresultremove' vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Originality.ai AI Checker versions = 1.0.12...