Filtered by vendor Wordpress Subscriptions
Filtered by product Wordpress Subscriptions
Total 11374 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-10137 1 Wordpress 1 Wordpress 2025-09-29 5.4 Medium
The Snow Monkey theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 29.1.5 via the request() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
CVE-2025-58914 1 Wordpress 1 Wordpress 2025-09-29 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Di Themes Di Themes Demo Site Importer allows Cross Site Request Forgery. This issue affects Di Themes Demo Site Importer: from n/a through 1.2.
CVE-2025-60111 2 Javothemes, Wordpress 2 Javo Core, Wordpress 2025-09-29 8.8 High
Cross-Site Request Forgery (CSRF) vulnerability in javothemes Javo Core allows Authentication Bypass. This issue affects Javo Core: from n/a through 3.0.0.266.
CVE-2025-60110 1 Wordpress 1 Wordpress 2025-09-29 8.5 High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup AllInOne - Banner Rotator allows SQL Injection. This issue affects AllInOne - Banner Rotator: from n/a through 3.8.
CVE-2025-48107 2 Undsgn, Wordpress 2 Uncode, Wordpress 2025-09-29 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in undsgn Uncode allows Reflected XSS. This issue affects Uncode: from n/a through n/a.
CVE-2025-60107 1 Wordpress 1 Wordpress 2025-09-29 8.5 High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup LambertGroup - AllInOne - Banner with Playlist allows Blind SQL Injection. This issue affects LambertGroup - AllInOne - Banner with Playlist: from n/a through 3.8.
CVE-2025-60108 1 Wordpress 1 Wordpress 2025-09-29 8.5 High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup LambertGroup - AllInOne - Banner with Thumbnails allows Blind SQL Injection. This issue affects LambertGroup - AllInOne - Banner with Thumbnails: from n/a through 3.8.
CVE-2025-60118 1 Wordpress 1 Wordpress 2025-09-29 8.5 High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Potenzaglobalsolutions PGS Core allows SQL Injection. This issue affects PGS Core: from n/a through 5.9.0.
CVE-2025-60150 1 Wordpress 1 Wordpress 2025-09-29 7.5 High
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpshuffle Subscribe to Download allows PHP Local File Inclusion. This issue affects Subscribe to Download: from n/a through 2.0.9.
CVE-2025-60115 1 Wordpress 1 Wordpress 2025-09-29 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in instapagedev Instapage Plugin allows Cross Site Request Forgery. This issue affects Instapage Plugin: from n/a through 3.5.12.
CVE-2025-60156 2 Webandprintdesign, Wordpress 2 Ar For Wordpress, Wordpress 2025-09-29 9.6 Critical
Cross-Site Request Forgery (CSRF) vulnerability in webandprint AR For WordPress allows Upload a Web Shell to a Web Server. This issue affects AR For WordPress: from n/a through 7.98.
CVE-2025-60138 1 Wordpress 1 Wordpress 2025-09-29 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Blocks allows Stored XSS. This issue affects SKT Blocks: from n/a through 2.5.
CVE-2025-60173 3 Ashwani Kumar, Woocommerce, Wordpress 3 Gst For Woocommerce, Woocommerce, Wordpress 2025-09-29 7.1 High
Cross-Site Request Forgery (CSRF) vulnerability in Ashwani kumar GST for WooCommerce allows Stored XSS. This issue affects GST for WooCommerce: from n/a through 2.0.
CVE-2025-60145 1 Wordpress 1 Wordpress 2025-09-29 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in yonifre Lenix scss compiler allows Cross Site Request Forgery. This issue affects Lenix scss compiler: from n/a through 1.2.
CVE-2025-60121 2 Exthemes, Wordpress 2 Wooevents, Wordpress 2025-09-29 5.3 Medium
Missing Authorization vulnerability in Ex-Themes WooEvents allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WooEvents: from n/a through 4.1.7.
CVE-2025-60152 1 Wordpress 1 Wordpress 2025-09-29 4.3 Medium
Missing Authorization vulnerability in wpshuffle Subscribe To Unlock allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Subscribe To Unlock: from n/a through 1.1.5.
CVE-2025-60184 1 Wordpress 1 Wordpress 2025-09-29 5.9 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Terry L. SEO Search Permalink allows Stored XSS. This issue affects SEO Search Permalink: from n/a through 1.0.3.
CVE-2025-60166 1 Wordpress 1 Wordpress 2025-09-29 4.3 Medium
Missing Authorization vulnerability in wpshuffle WP Subscription Forms PRO allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Subscription Forms PRO: from n/a through 2.0.5.
CVE-2025-60181 1 Wordpress 1 Wordpress 2025-09-29 5.4 Medium
Server-Side Request Forgery (SSRF) vulnerability in silence Silencesoft RSS Reader allows Server Side Request Forgery. This issue affects Silencesoft RSS Reader: from n/a through 0.6.
CVE-2025-60122 1 Wordpress 1 Wordpress 2025-09-29 4.3 Medium
Missing Authorization vulnerability in HivePress HivePress Claim Listings allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects HivePress Claim Listings: from n/a through 1.1.3.