Wordpress Plugin

CVE-2025-69054 Jan 22, 17:16 HIGH This Week

highwarden Super Logos Showcase superlogoshowcase-wp is affected by cross-site scripting (xss) (CVSS 7.1).

CVE-2025-69053 Jan 22, 17:16 HIGH This Week

LambertGroup Universal Video Player universal-video-player is affected by cross-site scripting (xss) (CVSS 7.1).

CVE-2025-69051 Jan 22, 17:16 HIGH This Week

CridioStudio ListingPro Reviews listingpro-reviews is affected by cross-site scripting (xss) (CVSS 7.1).

CVE-2025-69048 Jan 22, 17:16 HIGH This Week

LambertGroup Universal Video Player universal-video-player is affected by cross-site scripting (xss) (CVSS 7.1).

CVE-2025-69046 Jan 22, 17:16 HIGH This Week

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WebGeniusLab iRecco Core irecco-core allows PHP Local File Inclusion.This issue affects iRecco Core: from n/a through <= 1.3.6. [CVSS 8.1 HIGH]

CVE-2025-69036 Jan 22, 17:16 HIGH This Week

strongholdthemes Tech Life CPT techlife-cpt is affected by deserialization of untrusted data (CVSS 8.8).

CVE-2025-69035 Jan 22, 17:16 HIGH This Week

strongholdthemes Dental Care CPT dentalcare-cpt is affected by deserialization of untrusted data (CVSS 8.8).

CVE-2025-69001 Jan 22, 17:16 MEDIUM This Month

Improper Control of Generation of Code ('Code Injection') vulnerability in Shahjahan Jewel FluentForm fluentform allows Code Injection.This issue affects FluentForm: from n/a through <= 6.1.11. [CVSS 5.3 MEDIUM]

CVE-2025-68999 Jan 22, 17:16 HIGH This Week

HappyMonster Happy Addons for Elementor happy-elementor-addons is affected by sql injection (CVSS 8.5).

CVE-2025-68912 Jan 22, 17:16 HIGH This Week

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Harmonic Design HDForms hdforms allows Path Traversal.This issue affects HDForms: from n/a through <= 1.6.1. [CVSS 8.6 HIGH]

CVE-2025-68906 Jan 22, 17:16 HIGH This Week

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jegtheme JNews - Video jnews-video allows Reflected XSS.This issue affects JNews - Video: from n/a through <= 11.0.2. [CVSS 7.1 HIGH]

CVE-2025-68905 Jan 22, 17:16 HIGH This Week

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jegtheme JNews - Pay Writer jnews-pay-writer allows PHP Local File Inclusion.This issue affects JNews - Pay Writer: from n/a through <= 11.0.0. [CVSS 7.5 HIGH]

CVE-2025-68904 Jan 22, 17:16 HIGH This Week

jegtheme JNews - Frontend Submit jnews-frontend-submit is affected by cross-site scripting (xss) (CVSS 7.1).

CVE-2025-68898 Jan 22, 17:16 MEDIUM This Month

cjjparadoxmax Synergy Project Manager synergy-project-manager is affected by cross-site scripting (xss) (CVSS 5.8).

CVE-2025-68896 Jan 22, 17:16 MEDIUM This Month

Missing Authorization vulnerability in vrpr WDV One Page Docs wdv-one-page-docs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WDV One Page Docs: from n/a through <= 1.2.4. [CVSS 6.5 MEDIUM]

CVE-2025-68894 Jan 22, 17:16 HIGH This Week

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shoutoutglobal ShoutOut shoutout allows Reflected XSS.This issue affects ShoutOut: from n/a through <= 4.0.2. [CVSS 7.1 HIGH]

CVE-2025-68883 Jan 22, 17:16 HIGH This Week

extremeidea bidorbuy Store Integrator bidorbuystoreintegrator is affected by cross-site scripting (xss) (CVSS 7.1).

CVE-2025-68882 Jan 22, 17:16 HIGH This Week

Missing Authorization vulnerability in Scalenut Scalenut scalenut allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scalenut: from n/a through <= 1.1.3. [CVSS 7.5 HIGH]

CVE-2025-68881 Jan 22, 17:16 HIGH This Week

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal AppExperts appexperts allows SQL Injection.This issue affects AppExperts: from n/a through <= 1.4.5. [CVSS 8.5 HIGH]

CVE-2025-68871 Jan 22, 17:16 HIGH This Week

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in noCreativity Dooodl dooodl allows Reflected XSS.This issue affects Dooodl: from n/a through <= 2.3.0. [CVSS 7.1 HIGH]

CVE-2025-68869 Jan 22, 17:16 CRITICAL Act Now

LazyTasks project management WordPress plugin has an incorrect privilege assignment vulnerability allowing low-privileged users to escalate to administrator, gaining full site control.

CVE-2025-68866 Jan 22, 17:16 HIGH This Week

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in woofer696 Dinatur dinatur allows Stored XSS.This issue affects Dinatur: from n/a through <= 1.18. [CVSS 7.1 HIGH]

CVE-2025-68864 Jan 22, 17:16 HIGH This Week

Stored cross-site scripting in Infility Global WordPress plugin through version 2.14.50 allows remote attackers to inject malicious scripts that execute in victim browsers. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) indicates unauthenticated attackers can exploit this remotely with low complexity, requiring only victim interaction. EPSS score of 0.04% (12th percentile) suggests low probability of mass exploitation. Patchstack vulnerability database confirms this as a stored XSS vulnerability, meaning injected scripts persist and affect multiple users who view the compromised content.

CVE-2025-68859 Jan 22, 17:16 HIGH This Week

agmorpheus Syntax Highlighter Compress syntax-highlighter-compress is affected by cross-site scripting (xss) (CVSS 7.1).

CVE-2025-68858 Jan 22, 17:16 HIGH This Week

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Casey Bisson wpCAS wpcas allows Reflected XSS.This issue affects wpCAS: from n/a through <= 1.07. [CVSS 7.1 HIGH]

CVE-2025-68857 Jan 22, 17:16 CRITICAL Act Now

Paid Downloads WordPress plugin has a SQL injection vulnerability enabling database compromise through the download management functionality.

CVE-2025-68849 Jan 22, 17:16 HIGH This Week

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Frank Corso Quote Master quote-master allows Reflected XSS.This issue affects Quote Master: from n/a through <= 7.1.1. [CVSS 7.1 HIGH]

CVE-2025-68839 Jan 22, 17:16 HIGH This Week

Remi Corson Easy Theme Options easy-theme-options is affected by cross-site scripting (xss) (CVSS 7.1).

CVE-2025-68838 Jan 22, 17:16 HIGH This Week

expresstechsoftware MemberPress Discord Addon expresstechsoftwares-memberpress-discord-add-on is affected by cross-site scripting (xss) (CVSS 7.1).

CVE-2025-68835 Jan 22, 17:16 HIGH This Week

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in matiskiba Ravpage ravpage allows Reflected XSS.This issue affects Ravpage: from n/a through <= 2.33. [CVSS 7.1 HIGH]

CVE-2025-68558 Jan 22, 17:16 MEDIUM This Month

Missing Authorization vulnerability in averta Depicter Slider depicter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Depicter Slider: from n/a through <= 4.0.4. [CVSS 6.5 MEDIUM]

CVE-2025-68507 Jan 22, 17:16 MEDIUM This Month

Missing Authorization vulnerability in Icegram Icegram icegram allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Icegram: from n/a through <= 3.1.35. [CVSS 6.5 MEDIUM]

CVE-2025-68073 Jan 22, 17:16 MEDIUM This Month

Ninja Team GDPR CCPA Compliance Support ninja-gdpr-compliance is affected by missing authorization (CVSS 6.5).

CVE-2025-68072 Jan 22, 17:16 MEDIUM This Month

Merv Barrett Easy Property Listings easy-property-listings is affected by missing authorization (CVSS 6.5).

CVE-2025-68059 Jan 22, 17:16 HIGH This Week

Missing Authorization vulnerability in e-plugins Hotel Listing hotel-listing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hotel Listing: from n/a through <= 1.4.2. [CVSS 7.6 HIGH]

CVE-2025-68058 Jan 22, 17:16 HIGH This Week

e-plugins Institutions Directory institutions-directory is affected by missing authorization (CVSS 7.6).

CVE-2025-68057 Jan 22, 17:16 HIGH This Week

e-plugins Hospital Doctor Directory hospital-doctor-directory is affected by missing authorization (CVSS 7.6).

CVE-2025-68047 Jan 22, 17:16 HIGH This Week

Deserialization of Untrusted Data vulnerability in Arraytics Eventin wp-event-solution allows Object Injection.This issue affects Eventin: from n/a through <= 4.1.1. [CVSS 8.8 HIGH]

CVE-2025-68046 Jan 22, 17:16 MEDIUM This Month

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeHunk Contact Form & Lead Form Elementor Builder lead-form-builder allows Retrieve Embedded Sensitive Data.This issue affects Contact Form & Lead Form Elementor Builder: from n/a through <= 2.0.1. [CVSS 6.5 MEDIUM]

CVE-2025-68039 Jan 22, 17:16 MEDIUM This Month

Missing Authorization vulnerability in Chris Simmons WP BackItUp wp-backitup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP BackItUp: from n/a through <= 2.0.0. [CVSS 6.5 MEDIUM]

CVE-2025-68035 Jan 22, 17:16 HIGH This Week

Insertion of Sensitive Information Into Sent Data vulnerability in tabbyai Tabby Checkout tabby-checkout allows Retrieve Embedded Sensitive Data.This issue affects Tabby Checkout: from n/a through <= 5.8.4. [CVSS 7.5 HIGH]

CVE-2025-68034 Jan 22, 17:16 CRITICAL Act Now

CleverReach WordPress plugin has a SQL injection vulnerability allowing attackers to extract email marketing data and WordPress credentials from the database.

CVE-2025-68030 Jan 22, 17:16 HIGH This Week

WP Messiah Frontis Blocks frontis-blocks is affected by server-side request forgery (ssrf) (CVSS 7.2).

CVE-2025-68027 Jan 22, 17:16 HIGH This Week

Incorrect Privilege Assignment vulnerability in Themefic Hydra Booking hydra-booking allows Privilege Escalation.This issue affects Hydra Booking: from n/a through <= 1.1.32. [CVSS 7.3 HIGH]

CVE-2025-68020 Jan 22, 17:16 MEDIUM This Month

Missing Authorization vulnerability in WANotifier WANotifier notifier allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WANotifier: from n/a through <= 2.7.12. [CVSS 6.5 MEDIUM]

CVE-2025-68019 Jan 22, 17:16 MEDIUM This Month

Missing Authorization vulnerability in cleverplugins SEO Booster seo-booster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SEO Booster: from n/a through <= 6.1.8. [CVSS 6.5 MEDIUM]

CVE-2025-68017 Jan 22, 17:16 HIGH This Week

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Antideo Antideo Email Validator antideo-email-validator allows Blind SQL Injection.This issue affects Antideo Email Validator: from n/a through <= 1.0.10. [CVSS 7.5 HIGH]

CVE-2025-68015 Jan 22, 17:16 CRITICAL Act Now

Event Tickets with Ticket Scanner WordPress plugin has a code injection vulnerability allowing remote code execution through the event management system.

CVE-2025-68012 Jan 22, 17:16 HIGH This Week

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dmytro Shteflyuk CodeColorer codecolorer allows Stored XSS.This issue affects CodeColorer: from n/a through <= 0.10.1. [CVSS 7.1 HIGH]

CVE-2025-68010 Jan 22, 17:16 HIGH This Week

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in netgsm Netgsm netgsm allows Reflected XSS.This issue affects Netgsm: from n/a through <= 2.9.63. [CVSS 7.1 HIGH]

CVE-2025-68009 Jan 22, 17:16 MEDIUM This Month

Missing Authorization vulnerability in Codeless Slider Templates slider-templates allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Slider Templates: from n/a through <= 1.0.3. [CVSS 6.5 MEDIUM]

CVE-2025-68007 Jan 22, 17:16 MEDIUM This Month

Event Espresso Event Espresso 4 Decaf event-espresso-decaf is affected by missing authorization (CVSS 6.5).

CVE-2025-68006 Jan 22, 17:16 MEDIUM This Month

Insertion of Sensitive Information Into Sent Data vulnerability in Deetronix Booking Ultra Pro booking-ultra-pro allows Retrieve Embedded Sensitive Data.This issue affects Booking Ultra Pro: from n/a through <= 1.1.23. [CVSS 6.5 MEDIUM]

CVE-2025-68004 Jan 22, 17:16 HIGH This Week

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kapil Chugh My Post Order my-posts-order allows Reflected XSS.This issue affects My Post Order: from n/a through <= 1.2.1.1. [CVSS 7.1 HIGH]

CVE-2025-68003 Jan 22, 17:16 MEDIUM This Month

Missing Authorization vulnerability in renatoatshown Shown Connector shown-connector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shown Connector: from n/a through <= 1.2.10. [CVSS 6.5 MEDIUM]

CVE-2025-68001 Jan 22, 17:16 CRITICAL Act Now

g-FFL Checkout WordPress plugin has an unrestricted file upload vulnerability allowing attackers to upload web shells for remote code execution.

CVE-2025-67967 Jan 22, 17:16 HIGH This Week

Missing Authorization vulnerability in e-plugins Lawyer Directory lawyer-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lawyer Directory: from n/a through <= 1.3.3. [CVSS 7.6 HIGH]

CVE-2025-67966 Jan 22, 17:16 HIGH This Week

Incorrect Privilege Assignment vulnerability in e-plugins Lawyer Directory lawyer-directory allows Privilege Escalation.This issue affects Lawyer Directory: from n/a through <= 1.3.3. [CVSS 8.8 HIGH]

CVE-2025-67964 Jan 22, 17:16 HIGH This Week

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Homey Core homey-core allows Reflected XSS.This issue affects Homey Core: from n/a through <= 2.4.3. [CVSS 7.1 HIGH]

CVE-2025-67963 Jan 22, 17:16 HIGH This Week

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ovatheme Movie Booking movie-booking allows Path Traversal.This issue affects Movie Booking: from n/a through <= 1.1.5. [CVSS 8.6 HIGH]

CVE-2025-67961 Jan 22, 17:16 MEDIUM This Month

Server-Side Request Forgery (SSRF) vulnerability in Marco van Wieren WPO365 wpo365-login allows Server Side Request Forgery.This issue affects WPO365: from n/a through <= 40.0. [CVSS 6.4 MEDIUM]

CVE-2025-67960 Jan 22, 17:16 HIGH This Week

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in purethemes WorkScout-Core workscout-core allows Reflected XSS.This issue affects WorkScout-Core: from n/a through <= 1.7.06. [CVSS 7.1 HIGH]

CVE-2025-67957 Jan 22, 17:16 HIGH This Week

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TangibleWP Listivo Core listivo-core allows PHP Local File Inclusion.This issue affects Listivo Core: from n/a through <= 2.3.77. [CVSS 8.1 HIGH]

CVE-2025-67956 Jan 22, 17:16 HIGH This Week

Missing Authorization vulnerability in wpeverest User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through <= 4.4.6. [CVSS 8.2 HIGH]

CVE-2025-67955 Jan 22, 17:16 HIGH This Week

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TangibleWP MyHome Core myhome-core allows PHP Local File Inclusion.This issue affects MyHome Core: from n/a through <= 4.1.0. [CVSS 7.5 HIGH]

CVE-2025-67954 Jan 22, 17:16 MEDIUM This Month

Dimitri Grassi Salon booking system salon-booking-system contains a security vulnerability (CVSS 6.5).

CVE-2025-67953 Jan 22, 17:16 HIGH This Week

Booking Activities Team Booking Activities booking-activities contains a security vulnerability (CVSS 8.1).

CVE-2025-67947 Jan 22, 17:16 HIGH This Week

scriptsbundle AdForest Elementor adforest-elementor is affected by cross-site scripting (xss) (CVSS 7.1).

CVE-2025-67944 Jan 22, 17:16 CRITICAL Act Now

Nelio AB Testing WordPress plugin has a code injection vulnerability allowing attackers to execute arbitrary code through the A/B testing functionality.

CVE-2025-67943 Jan 22, 17:16 HIGH This Week

wphocus My auctions allegro my-auctions-allegro-free-edition is affected by cross-site scripting (xss) (CVSS 7.1).

CVE-2025-67942 Jan 22, 17:16 MEDIUM This Month

peachpayments Peach Payments Gateway wc-peach-payments-gateway is affected by missing authorization (CVSS 6.5).

CVE-2025-67939 Jan 22, 17:16 MEDIUM This Month

Missing Authorization vulnerability in Tickera Tickera tickera-event-ticketing-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tickera: from n/a through <= 3.5.6.2. [CVSS 6.5 MEDIUM]

CVE-2025-67923 Jan 22, 17:16 HIGH This Week

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Reflected XSS.This issue affects JetEngine: from n/a through <= 3.7.7. [CVSS 7.1 HIGH]

CVE-2025-66143 Jan 22, 17:16 MEDIUM This Month

Missing Authorization vulnerability in merkulove Crumber crumber-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Crumber: from n/a through <= 1.0.10. [CVSS 5.4 MEDIUM]

CVE-2025-66142 Jan 22, 17:16 MEDIUM This Month

merkulove Comparimager for Elementor comparimager-elementor is affected by missing authorization (CVSS 5.4).

CVE-2025-66141 Jan 22, 17:16 MEDIUM This Month

Missing Authorization vulnerability in merkulove Scroller scroller allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scroller: from n/a through <= 2.0.2. [CVSS 5.4 MEDIUM]

CVE-2025-66140 Jan 22, 17:16 MEDIUM This Month

Missing Authorization vulnerability in merkulove Uper for Elementor uper-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uper for Elementor: from n/a through <= 1.0.5. [CVSS 5.4 MEDIUM]

CVE-2025-66139 Jan 22, 17:16 MEDIUM This Month

Missing Authorization vulnerability in merkulove Audier For Elementor audier-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Audier For Elementor: from n/a through <= 1.0.9. [CVSS 5.4 MEDIUM]

CVE-2025-66138 Jan 22, 17:16 MEDIUM This Month

merkulove Motionger for Elementor motionger-elementor is affected by missing authorization (CVSS 8.8).

CVE-2025-66137 Jan 22, 17:16 MEDIUM This Month

Missing Authorization vulnerability in merkulove Searcher for Elementor searcher-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Searcher for Elementor: from n/a through <= 1.0.3. [CVSS 8.8 HIGH]

CVE-2025-66136 Jan 22, 17:16 MEDIUM This Month

Missing Authorization vulnerability in merkulove Carter for Elementor carter-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Carter for Elementor: from n/a through <= 1.0.2. [CVSS 8.8 HIGH]

CVE-2025-66135 Jan 22, 17:16 MEDIUM This Month

Missing Authorization vulnerability in merkulove Imager for Elementor imager-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Imager for Elementor: from n/a through <= 2.0.4. [CVSS 8.8 HIGH]

CVE-2025-64252 Jan 22, 17:16 MEDIUM This Month

Marco Milesi ANAC XML Viewer anac-xml-viewer is affected by server-side request forgery (ssrf) (CVSS 4.9).

CVE-2025-63051 Jan 22, 17:15 MEDIUM This Month

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in sizam REHub Framework rehub-framework allows Retrieve Embedded Sensitive Data.This issue affects REHub Framework: from n/a through < 19.9.9.4. [CVSS 4.3 MEDIUM]

CVE-2025-63026 Jan 22, 17:15 MEDIUM This Month

ThemeGoods Grand Restaurant Theme Elements for Elementor grandrestaurant-elementor is affected by cross-site scripting (xss) (CVSS 5.4).

CVE-2025-63019 Jan 22, 17:15 MEDIUM This Month

Johan Jonk Stenström Cookies and Content Security Policy cookies-and-content-security-policy contains a security vulnerability (CVSS 7.5).

CVE-2025-63017 Jan 22, 17:15 HIGH This Week

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in fuelthemes WerkStatt Plugin werkstatt-plugin allows PHP Local File Inclusion.This issue affects WerkStatt Plugin: from n/a through <= 1.6.6. [CVSS 7.5 HIGH]

CVE-2025-62754 Jan 22, 17:15 MEDIUM This Month

Payment Gateway bKash for WooCommerce has a missing authorization vulnerability allowing attackers to exploit incorrect access controls for privilege escalation.

CVE-2025-62106 Jan 22, 17:15 MEDIUM This Month

Missing Authorization vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-CRM System: from n/a through <= 3.4.5. [CVSS 8.8 HIGH]

CVE-2025-62077 Jan 22, 17:15 MEDIUM This Month

SEOSEON EUROPE S.L Affiliate Link Tracker affiliate-link-tracker is affected by cross-site scripting (xss) (CVSS 5.9).