Wordpress Plugin

CVE-2025-52762 Jan 22, 17:15 HIGH This Week

flexostudio flexo-posts-manager flexo-posts-manager is affected by cross-site scripting (xss) (CVSS 6.1).

CVE-2025-50005 Jan 22, 17:15 MEDIUM This Month

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Composer td-composer allows DOM-Based XSS.This issue affects tagDiv Composer: from n/a through <= 5.4.2. [CVSS 6.1 MEDIUM]

CVE-2025-50004 Jan 22, 17:15 HIGH This Week

Deserialization of Untrusted Data vulnerability in artbees JupiterX Core jupiterx-core allows Object Injection.This issue affects JupiterX Core: from n/a through <= 4.10.1. [CVSS 8.5 HIGH]

CVE-2025-49336 Jan 22, 17:15 MEDIUM This Month

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pondol Pondol BBS pondol-bbs allows Stored XSS.This issue affects Pondol BBS: from n/a through <= 1.1.8.4. [CVSS 5.4 MEDIUM]

CVE-2025-49066 Jan 22, 17:15 HIGH This Week

LambertGroup Accordion Slider PRO accordion_slider_pro is affected by cross-site scripting (xss) (CVSS 6.1).

CVE-2025-49055 Jan 22, 17:15 CRITICAL Act Now

WP Learn SQL Injection allows unauthenticated attackers to execute arbitrary SQL queries against the WordPress database, exposing all stored data.

CVE-2025-49050 Jan 22, 17:15 HIGH This Week

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav WP Lead Capturing Pages wp-lead-capture allows Blind SQL Injection.This issue affects WP Lead Capturing Pages: from n/a through <= 2.5. [CVSS 8.8 HIGH]

CVE-2025-49049 Jan 22, 17:15 HIGH This Week

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ZoomIt DZS Video Gallery dzs-videogallery allows SQL Injection.This issue affects DZS Video Gallery: from n/a through <= 12.37. [CVSS 8.8 HIGH]

CVE-2025-49046 Jan 22, 17:15 HIGH This Week

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup xPromoter top_bar_promoter allows Reflected XSS.This issue affects xPromoter: from n/a through <= 1.3.4. [CVSS 6.1 MEDIUM]

CVE-2025-49045 Jan 22, 17:15 HIGH This Week

highwarden Super Interactive Maps super-interactive-maps is affected by cross-site scripting (xss) (CVSS 6.1).

CVE-2025-48094 Jan 22, 17:15 HIGH This Week

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Magic Slider magic_slider allows Reflected XSS.This issue affects Magic Slider: from n/a through <= 2.2. [CVSS 6.1 MEDIUM]

CVE-2025-47666 Jan 22, 17:15 HIGH This Week

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Image&Video FullScreen Background lbg_fullscreen_fullwidth_slider allows Reflected XSS.This issue affects Image&Video FullScreen Background: from n/a through <= 1.6.7. [CVSS 6.1 MEDIUM]

CVE-2025-47555 Jan 22, 17:15 LOW Monitor

Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through <= 3.9.4. [CVSS 8.1 HIGH]

CVE-2025-47500 Jan 22, 17:15 MEDIUM This Month

Benjamin Intal Stackable stackable-ultimate-gutenberg-blocks is affected by cross-site scripting (xss) (CVSS 5.4).

CVE-2025-32123 Jan 22, 17:15 HIGH This Week

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup HTML5 Video Player with Playlist & Multiple Skins lbg-vp2-html5-rightside allows Reflected XSS.This issue affects HTML5 Video Player with Playlist & Multiple Skins: from n/a through <= 5.3.5. [CVSS 6.1 MEDIUM]

CVE-2025-31413 Jan 22, 17:15 MEDIUM This Month

bdthemes Element Pack Elementor Addons bdthemes-element-pack-lite is affected by cross-site request forgery (csrf) (CVSS 8.8).

CVE-2025-27005 Jan 22, 17:15 HIGH This Week

LambertGroup HTML5 Video Player lbg-vp2-html5-bottom is affected by cross-site scripting (xss) (CVSS 6.1).

CVE-2025-14844 Jan 16, 10:16 HIGH PATCH This Week

Restrict Content versions up to 3.2.16 is affected by authorization bypass through user-controlled key (CVSS 8.2).

CVE-2025-14757 Jan 16, 09:15 MEDIUM PATCH This Month

The Cost Calculator Builder plugin for WordPress is vulnerable to Unauthenticated Payment Status Bypass in all versions up to, and including, 3.6.9 only when used in combination with Cost Calculator Builder PRO. This is due to the complete_payment AJAX action being registered via wp_ajax_nopriv, making it accessible to unauthenticated users, and the complete() function only verifying a nonce without checking user capabilities or order ownership. Since nonces are exposed to all visitors via wi...

CVE-2025-14457 Jan 15, 07:16 LOW PATCH Monitor

Drag and Drop Multiple File Upload for Contact Form 7 (WordPress plugin) is affected by missing authorization (CVSS 3.7).

CVE-2025-14448 Jan 15, 06:16 MEDIUM PATCH This Month

WP-Members Membership Plugin (WordPress plugin) is affected by cross-site scripting (xss) (CVSS 5.4).

CVE-2023-54332 Jan 13, 23:16 MEDIUM POC This Month

Jetpack 11.4 contains a cross-site scripting vulnerability in the contact form module that allows attackers to inject malicious scripts through the post_id parameter. [CVSS 6.1 MEDIUM]

CVE-2026-22522 Jan 08, 17:15 MEDIUM This Month

Munir Kamal Block Slider through version 2.2.3 fails to properly enforce access control, allowing authenticated users to access sensitive information they should not have permission to view. An attacker with valid credentials could exploit this missing authorization check to read confidential data. No patch is currently available for this vulnerability.

CVE-2026-22519 Jan 08, 17:15 MEDIUM This Month

Stored cross-site scripting in BuddyDev MediaPress through version 1.6.2 enables authenticated attackers to inject malicious scripts that execute in other users' browsers, potentially compromising session data or performing unauthorized actions. The vulnerability requires user interaction and affects the confidentiality, integrity, and availability of affected installations. No patch is currently available.

CVE-2026-22518 Jan 08, 17:15 MEDIUM This Month

DOM-based cross-site scripting in pencilwp X Addons for Elementor through version 1.0.23 allows authenticated attackers to inject malicious scripts that execute in users' browsers with user interaction. An attacker with login credentials can exploit this vulnerability to steal session tokens, deface content, or perform actions on behalf of affected users. No patch is currently available for this vulnerability.

CVE-2026-22492 Jan 08, 17:15 MEDIUM This Month

Docket Cache versions through 24.07.04 contain an access control bypass that allows authenticated users to perform unauthorized actions due to improper permission validation. An attacker with valid credentials can exploit this vulnerability to cause denial of service or access restricted functionality. No patch is currently available.

CVE-2026-22489 Jan 08, 17:15 MEDIUM This Month

Wptexture Image Slider Slideshow versions through 1.8 contain an authorization bypass flaw that allows authenticated users to modify content by manipulating access control parameters. An attacker with user-level access could exploit incorrectly configured security controls to perform unauthorized actions beyond their assigned privileges. No patch is currently available for this vulnerability.

CVE-2026-22488 Jan 08, 17:15 MEDIUM This Month

Inadequate access control in IdeaBox Creations Dashboard Welcome for Beaver Builder (versions through 1.0.8) permits unauthorized users to modify data without proper authentication. An unauthenticated attacker can exploit misconfigured security levels to perform unauthorized actions over the network with no user interaction required. No patch is currently available to address this vulnerability.

CVE-2026-22487 Jan 08, 17:15 MEDIUM This Month

Baqend Speed Kit versions through 2.0.2 contain an authorization bypass that allows authenticated users to modify data by exploiting misconfigured access control levels. An attacker with valid credentials could escalate privileges to alter information they should not have permission to change. No patch is currently available.

CVE-2026-22486 Jan 08, 17:15 MEDIUM This Month

The Hakob Re Gallery & Responsive Photo Gallery Plugin through version 1.17.18 contains an authorization bypass that permits unauthenticated attackers to modify gallery content due to improperly enforced access controls. This vulnerability affects all installations of the plugin and could allow attackers to alter or deface photo galleries without authentication. No patch is currently available.

CVE-2025-69169 Jan 08, 10:15 MEDIUM This Month

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Noor Alam Easy Media Download easy-media-download allows Reflection Injection.This issue affects Easy Media Download: from n/a through <= 1.1.11. [CVSS 5.4 MEDIUM]

CVE-2025-68892 Jan 08, 10:15 HIGH This Week

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gopiplus@hotmail.com Scroll rss excerpt scroll-rss-excerpt allows Reflected XSS.This issue affects Scroll rss excerpt: from n/a through <= 5.0. [CVSS 6.1 MEDIUM]

CVE-2025-68890 Jan 08, 10:15 HIGH This Week

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hands01 e-shops e-shops-cart2 allows DOM-Based XSS.This issue affects e-shops: from n/a through <= 1.0.4. [CVSS 6.1 MEDIUM]

CVE-2025-68889 Jan 08, 10:15 HIGH This Week

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pinpoll Pinpoll pinpoll allows Reflected XSS.This issue affects Pinpoll: from n/a through <= 4.0.0. [CVSS 7.1 HIGH]

CVE-2025-68875 Jan 08, 10:15 MEDIUM This Month

jcaruso001 Flaming Password Reset flaming-password-reset is affected by cross-site scripting (xss) (CVSS 5.4).

CVE-2025-68874 Jan 08, 10:15 HIGH This Week

Shahjada Visitor Stats Widget visitor-stats-widget is affected by cross-site scripting (xss) (CVSS 7.1).

CVE-2025-68873 Jan 08, 10:15 HIGH This Week

chloédigital PRIMER by chloédigital primer-by-chloedigital is affected by cross-site scripting (xss) (CVSS 7.1).

CVE-2025-68867 Jan 08, 10:15 MEDIUM This Month

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in anibalwainstein Effect Maker effect-maker allows DOM-Based XSS.This issue affects Effect Maker: from n/a through <= 1.2.1. [CVSS 6.5 MEDIUM]

CVE-2025-67933 Jan 08, 10:15 HIGH This Week

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in taskbuilder Taskbuilder taskbuilder allows Reflected XSS.This issue affects Taskbuilder: from n/a through <= 4.0.9. [CVSS 6.1 MEDIUM]

CVE-2025-67932 Jan 08, 10:15 HIGH This Week

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in purethemes Listeo Core listeo-core allows Reflected XSS.This issue affects Listeo Core: from n/a through < 2.0.19. [CVSS 6.1 MEDIUM]

CVE-2025-67931 Jan 08, 10:15 HIGH This Week

Insertion of Sensitive Information Into Sent Data vulnerability in AITpro BulletProof Security bulletproof-security allows Retrieve Embedded Sensitive Data.This issue affects BulletProof Security: from n/a through <= 6.9. [CVSS 7.5 HIGH]

CVE-2025-67930 Jan 08, 10:15 HIGH This Week

Vernon Systems Limited eHive Search ehive-search is affected by cross-site scripting (xss) (CVSS 6.1).

CVE-2025-67928 Jan 08, 10:15 CRITICAL Act Now

Automotive Listings WordPress theme (through 18.6) has blind SQL injection enabling unauthenticated database extraction.

CVE-2025-67927 Jan 08, 10:15 HIGH This Week

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spencer Haws Link Whisper Free link-whisper allows Reflected XSS.This issue affects Link Whisper Free: from n/a through <= 0.8.8. [CVSS 6.1 MEDIUM]

CVE-2025-67926 Jan 08, 10:15 MEDIUM This Month

Missing Authorization vulnerability in Shahjahan Jewel Fluent Support fluent-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Support: from n/a through <= 1.10.4. [CVSS 8.8 HIGH]

CVE-2025-67919 Jan 08, 10:15 MEDIUM This Month

WofficeIO Woffice Core woffice-core is affected by authorization bypass through user-controlled key (CVSS 8.1).

CVE-2025-67915 Jan 08, 10:15 HIGH This Week

Timetics WordPress plugin (through 1.0.46) allows authentication bypass via alternate path, enabling unauthenticated admin access to the booking system.

CVE-2025-67913 Jan 08, 10:15 MEDIUM This Month

Aruba HiSpeed Cache WordPress plugin (before 3.0.3) has missing authorization allowing unauthenticated access to cache management functions with full CIA impact.

CVE-2025-67911 Jan 08, 10:15 CRITICAL Act Now

Newsletters WordPress plugin by Tribulant (through 4.11) is vulnerable to PHP object injection through deserialization of untrusted data, potentially leading to RCE via POP chains.

CVE-2025-67910 Jan 08, 10:15 CRITICAL Act Now

Contentstudio WordPress plugin (through 1.3.7) allows unauthenticated web shell upload, enabling immediate server compromise.

CVE-2025-27002 Jan 08, 10:15 HIGH This Week

LambertGroup CountDown With Image or Video Background countdown-with-background is affected by cross-site scripting (xss) (CVSS 6.1).

CVE-2025-23993 Jan 08, 10:15 CRITICAL Act Now

Felan Framework (through 1.1.3) also has SQL injection in addition to the auth bypass (CVE-2025-23504). Two critical vulnerabilities in the same plugin create a devastating attack chain.

CVE-2025-23504 Jan 08, 10:15 CRITICAL Act Now

Felan Framework for WordPress (through 1.1.3) allows authentication bypass through an alternate path, enabling unauthenticated admin access.

CVE-2025-22728 Jan 08, 10:15 HIGH This Week

Workreap WordPress plugin (through 3.3.6) has SQL injection enabling unauthenticated database extraction. A freelance marketplace plugin likely containing user PII and financial data.

CVE-2025-22726 Jan 08, 10:15 MEDIUM This Month

nK Themes Helper WordPress plugin (through 1.7.9) has SSRF enabling unauthenticated server-side requests to internal services and cloud metadata endpoints.

CVE-2025-22725 Jan 08, 10:15 HIGH This Week

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in loopus WP Virtual Assistant VirtualAssistant allows Stored XSS.This issue affects WP Virtual Assistant: from n/a through <= 3.0. [CVSS 5.4 MEDIUM]

CVE-2025-22715 Jan 08, 10:15 HIGH This Week

Missing Authorization vulnerability in loopus WP Attractive Donations System - Easy Stripe & Paypal donations WP_AttractiveDonationsSystem allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Attractive Donations System - Easy Stripe & Paypal donations: from n/a through <= 1.25. [CVSS 8.1 HIGH]

CVE-2025-14360 Jan 08, 10:15 HIGH This Week

Blockons WordPress plugin (through 1.2.15) has missing authorization allowing unauthenticated access to restricted functionality with full CIA impact.

CVE-2025-14358 Jan 08, 10:15 HIGH This Week

REHub Framework for WordPress (through 19.9.5) has missing authorization allowing unauthenticated access to restricted functionality with full CIA impact.

CVE-2025-13504 Jan 08, 10:15 HIGH This Week

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins Real Estate Pro real-estate-pro allows Reflected XSS.This issue affects Real Estate Pro: from n/a through <= 2.1.4. [CVSS 6.1 MEDIUM]

CVE-2025-12551 Jan 08, 10:15 HIGH This Week

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins ListingHub listinghub allows Reflected XSS.This issue affects ListingHub: from n/a through 1.2.6. [CVSS 6.1 MEDIUM]

CVE-2025-49335 Jan 07, 15:15 MEDIUM This Month

Server-Side Request Forgery (SSRF) vulnerability in minnur External Media allows Server Side Request Forgery.This issue affects External Media: from n/a through 1.0.36. [CVSS 4.9 MEDIUM]

CVE-2025-47552 Jan 07, 13:15 CRITICAL Act Now

DZS Video Gallery WordPress plugin (through 12.37) is vulnerable to PHP object injection through insecure deserialization. An unauthenticated attacker can inject arbitrary PHP objects, potentially achieving code execution through POP chains.

CVE-2025-46494 Jan 07, 13:15 HIGH This Week

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesgrove WidgetKit Pro allows Reflected XSS.This issue affects WidgetKit Pro: from n/a through 1.13.1. [CVSS 7.1 HIGH]

CVE-2025-46434 Jan 07, 13:15 MEDIUM This Month

Missing Authorization vulnerability in POSIMYTH Innovation The Plus Addons for Elementor Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Plus Addons for Elementor Pro: from n/a before 6.3.7. [CVSS 6.5 MEDIUM]

CVE-2025-46256 Jan 07, 13:15 MEDIUM This Month

Path Traversal: '.../...//' vulnerability in SigmaPlugin Advanced Database Cleaner PRO allows Path Traversal.This issue affects Advanced Database Cleaner PRO: from n/a through 3.2.10. [CVSS 6.4 MEDIUM]

CVE-2025-32303 Jan 07, 13:15 CRITICAL Act Now

WPCHURCH WordPress plugin (through 2.7.0) has blind SQL injection with scope change, enabling unauthenticated extraction of the full WordPress database.

CVE-2025-69333 Jan 07, 12:17 MEDIUM This Month

Missing Authorization vulnerability in Crocoblock JetEngine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetEngine: from n/a through 3.8.1.1. [CVSS 4.3 MEDIUM]

CVE-2025-32300 Jan 07, 12:17 HIGH This Week

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Digital zoom studio DZS Video Gallery allows Reflected XSS.This issue affects DZS Video Gallery: from n/a through 12.25. [CVSS 7.1 HIGH]

CVE-2025-31643 Jan 07, 12:17 HIGH This Week

Incorrect Privilege Assignment vulnerability in Dasinfomedia WPCHURCH allows Privilege Escalation.This issue affects WPCHURCH: from n/a through 2.7.0. [CVSS 8.8 HIGH]

CVE-2025-12449 Jan 07, 12:16 MEDIUM This Month

The aBlocks - WordPress Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data and disclosure of sensitive information due to missing capability checks on multiple AJAX actions in all versions up to, and including, 2.4.0. [CVSS 5.4 MEDIUM]

CVE-2025-11877 Jan 07, 12:16 HIGH This Week

The User Activity Log plugin is vulnerable to a limited options update in versions up to, and including, 2.2. The failed-login handler 'ual_shook_wp_login_failed' lacks a capability check and writes failed usernames directly into update_option() calls. [CVSS 7.5 HIGH]

CVE-2025-31642 Jan 07, 02:14 HIGH This Week

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dasinfomedia WPCHURCH allows Reflected XSS.This issue affects WPCHURCH: from n/a through 2.7.0. [CVSS 7.1 HIGH]

CVE-2025-32304 Jan 06, 18:15 HIGH This Week

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mojoomla WPCHURCH allows PHP Local File Inclusion.This issue affects WPCHURCH: from n/a through 2.7.0. [CVSS 8.1 HIGH]

CVE-2025-69364 Jan 06, 17:15 MEDIUM This Month

Missing Authorization vulnerability in Cloudways Breeze breeze allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breeze: from n/a through <= 2.2.21. [CVSS 5.3 MEDIUM]

CVE-2025-69363 Jan 06, 17:15 MEDIUM This Month

CyberChimps Responsive Addons for Elementor responsive-addons-for-elementor is affected by missing authorization (CVSS 6.5).

CVE-2025-69362 Jan 06, 17:15 MEDIUM This Month

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH UiChemy uichemy allows Stored XSS.This issue affects UiChemy: from n/a through <= 4.4.2. [CVSS 6.5 MEDIUM]

CVE-2025-69361 Jan 06, 17:15 MEDIUM This Month

Missing Authorization vulnerability in PublishPress Post Expirator post-expirator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Expirator: from n/a through <= 4.9.3. [CVSS 4.3 MEDIUM]

CVE-2025-69360 Jan 06, 17:15 MEDIUM This Month

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for WPBakery) thegem-elements allows DOM-Based XSS.This issue affects TheGem Theme Elements (for WPBakery): from n/a through <= 5.11.0. [CVSS 6.5 MEDIUM]

CVE-2025-69359 Jan 06, 17:15 MEDIUM This Month

Missing Authorization vulnerability in WPFunnels Creator LMS creatorlms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Creator LMS: from n/a through <= 1.1.12. [CVSS 5.3 MEDIUM]

CVE-2025-69357 Jan 06, 17:15 MEDIUM This Month

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) thegem-elements-elementor allows Stored XSS.This issue affects TheGem Theme Elements (for Elementor): from n/a through <= 5.11.0. [CVSS 6.5 MEDIUM]

CVE-2025-69356 Jan 06, 17:15 HIGH This Week

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) thegem-elements-elementor allows PHP Local File Inclusion.This issue affects TheGem Theme Elements (for Elementor): from n/a through <= 5.11.0. [CVSS 7.5 HIGH]

CVE-2025-69355 Jan 06, 17:15 MEDIUM This Month

Missing Authorization vulnerability in Tickera Tickera tickera-event-ticketing-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tickera: from n/a through <= 3.5.6.4. [CVSS 4.3 MEDIUM]

CVE-2025-69354 Jan 06, 17:15 MEDIUM This Month

BBR Plugins Better Business Reviews better-business-reviews is affected by missing authorization (CVSS 5.4).

CVE-2025-69353 Jan 06, 17:15 MEDIUM This Month

Missing Authorization vulnerability in Proxy &amp; VPN Blocker Proxy &amp; VPN Blocker proxy-vpn-blocker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Proxy &amp; VPN Blocker: from n/a through <= 3.5.3. [CVSS 5.4 MEDIUM]

CVE-2025-69352 Jan 06, 17:15 MEDIUM This Month

Missing Authorization vulnerability in StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar: from n/a through <= 6.15.12.2. [CVSS 5.4 MEDIUM]

CVE-2025-69351 Jan 06, 17:15 HIGH This Week

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjahan Jewel Ninja Tables ninja-tables allows Blind SQL Injection.This issue affects Ninja Tables: from n/a through <= 5.2.4. [CVSS 6.5 MEDIUM]

CVE-2025-69350 Jan 06, 17:15 MEDIUM This Month

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Accordion accordions-wp allows Stored XSS.This issue affects Accordion: from n/a through <= 3.0.3. [CVSS 6.5 MEDIUM]

CVE-2025-69349 Jan 06, 17:15 MEDIUM This Month

Missing Authorization vulnerability in Fahad Mahmood RSS Feed Widget rss-feed-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RSS Feed Widget: from n/a through <= 3.0.2. [CVSS 5.4 MEDIUM]

CVE-2025-69348 Jan 06, 17:15 MEDIUM This Month

CoolHappy The Events Calendar Countdown Addon countdown-for-the-events-calendar is affected by missing authorization (CVSS 5.4).