CVE-2024-13875

CVE-2024-13875 affects the WP-PManager WordPress plugin (≤ 1.2). The vulnerability is a Reflected Cross-Site Scripting caused by not sanitizing/escaping a parameter before output, enabling an attacker to target high-privilege admin users. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:...

CVE-2025-2247

The CVE-2025-2247 entry concerns the WP-PManager WordPress plugin (versions 1.2 and earlier) with a CSRF vulnerability in the settings update functionality. The root cause is a lack of CSRF checks, which could allow an authenticated attacker to cause a logged-in administrator to change settings v...

CVE-2025-2248

Summary (CVE-2025-2248) WP-PManager WordPress plugin (versions ≤ 1.2) exposes a SQL injection risk: a parameter is not sanitized/escaped before use in a SQL statement, enabling admin-level exploitation. The root cause is improper input handling in the plugin’s database query construction. Documen...