Filtered by vendor Wordpress Subscriptions
Filtered by product Wordpress Subscriptions
Total 11394 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-9427 2 Lemonsoft, Wordpress 2 Wordpress Add-on, Wordpress 2026-01-14 N/A
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Lemonsoft WordPress add on allows Cross-Site Scripting (XSS).This issue affects WordPress add on: 2025.7.1.
CVE-2025-14507 2 Metagauss, Wordpress 2 Eventprime, Wordpress 2026-01-14 5.3 Medium
The EventPrime - Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.7.0 via the REST API. This makes it possible for unauthenticated attackers to extract sensitive booking data including user names, email addresses, ticket details, payment information, and order keys when the API is enabled by an administrator. The vulnerability was partially patched in version 4.2.7.0.
CVE-2026-0684 2 Codepeople, Wordpress 2 Cp Image Store With Slideshow, Wordpress 2026-01-14 4.3 Medium
The CP Image Store with Slideshow plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.9 due to a logic error in the 'cpis_admin_init' function's permission check. This makes it possible for authenticated attackers, with Contributor-level access and above, to import arbitrary products via XML, if the XML file has already been uploaded to the server.
CVE-2025-10915 1 Wordpress 1 Wordpress 2026-01-14 9.8 Critical
The Dreamer Blog WordPress theme through 1.2 is vulnerable to arbitrary installations due to a missing capability check.
CVE-2025-14001 2 Ninjateam, Wordpress 2 Wp Duplicate Page, Wordpress 2026-01-14 5.4 Medium
The WP Duplicate Page plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the 'duplicateBulkHandle' and 'duplicateBulkHandleHPOS' functions in all versions up to, and including, 1.8. This makes it possible for authenticated attackers, with Contributor-level access and above, to duplicate arbitrary posts, pages, and WooCommerce HPOS orders even when their role is explicitly excluded from the plugin's "Allowed User Roles" setting, potentially exposing sensitive information and allowing duplicate fulfillment of WooCommerce orders.
CVE-2025-14829 1 Wordpress 1 Wordpress 2026-01-14 9.1 Critical
The E-xact | Hosted Payment | WordPress plugin through 2.0 is vulnerable to arbitrary file deletion due to insufficient file path validation. This makes it possible for unauthenticated attackers to delete arbitrary files on the server.
CVE-2024-27189 2 Catchsquare, Wordpress 2 Wp Social Widget, Wordpress 2026-01-13 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchsquare WP Social Widget allows Stored XSS.This issue affects WP Social Widget: from n/a through 2.2.5.
CVE-2023-37885 2 Inspirythemes, Wordpress 2 Realhomes, Wordpress 2026-01-13 4.3 Medium
Missing Authorization vulnerability in InspiryThemes RealHomes.This issue affects RealHomes: from n/a through 4.0.2.
CVE-2023-37886 2 Inspirythemes, Wordpress 2 Realhomes, Wordpress 2026-01-13 5.4 Medium
Missing Authorization vulnerability in InspiryThemes RealHomes.This issue affects RealHomes: from n/a through 4.0.2.
CVE-2025-14803 2 Nex-forms, Wordpress 2 Express Wp Form Builder, Wordpress 2026-01-13 6.8 Medium
The NEX-Forms WordPress plugin before 9.1.8 does not sanitise and escape some of its settings. The NEX-Forms WordPress plugin before 9.1.8 can be configured in such a way that could allow subscribers to perform Stored Cross-Site Scripting.
CVE-2025-14574 2 Wedevs, Wordpress 2 Wedocs, Wordpress 2026-01-13 5.3 Medium
The weDocs plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.15 via the `/wp-json/wp/v2/docs/settings` REST API endpoint. This makes it possible for unauthenticated attackers to extract sensitive data including third party services API keys.
CVE-2025-14736 2 Shabti, Wordpress 2 Frontend Admin By Dynamapps, Wordpress 2026-01-13 9.8 Critical
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.28.25. This is due to insufficient validation of user-supplied role values in the 'validate_value', 'pre_update_value', and 'get_fields_display' functions. This makes it possible for unauthenticated attackers to register as administrators and gain complete control of the site, granted they can access a user registration form containing a Role field.
CVE-2025-14893 2 Indieweb, Wordpress 2 Indieweb, Wordpress 2026-01-13 6.4 Medium
The IndieWeb plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Telephone' parameter in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2025-13753 2 Wordpress, Wptb 2 Wordpress, Wp Table Builder 2026-01-13 4.3 Medium
The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to unauthorized modification of data due to an incorrect authorization check on the save_table() function in all versions up to, and including, 2.0.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create new wptb-table posts.
CVE-2025-14937 2 Dynamiapps, Wordpress 2 Frontend Admin, Wordpress 2026-01-13 7.2 High
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'acff' parameter in the 'frontend_admin/forms/update_field' AJAX action in all versions up to, and including, 3.28.23 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2025-13729 2 Greenshady, Wordpress 2 Entry Views, Wordpress 2026-01-13 6.4 Medium
The Entry Views plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'entry-views' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2025-14436 3 Neeraj Slit, Woocommerce, Wordpress 3 Brevo For Woocommerce, Woocommerce, Wordpress 2026-01-13 7.2 High
The Brevo for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘user_connection_id’ parameter in all versions up to, and including, 4.0.49 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2025-13935 2 Themeum, Wordpress 2 Tutor Lms, Wordpress 2026-01-13 4.3 Medium
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course completion in all versions up to, and including, 3.9.2. This is due to missing enrollment verification in the 'mark_course_complete' function. This makes it possible for authenticated attackers, with subscriber level access and above, to mark any course as completed.
CVE-2025-14720 2 Ameliabooking, Wordpress 2 Booking For Appointments And Events Calendar, Wordpress 2026-01-13 5.3 Medium
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on multiple AJAX actions in all versions up to, and including, 1.2.38. This makes it possible for unauthenticated attackers to mark payments as refunded, trigger sending of queued notifications (emails/SMS/WhatsApp), and access debug information among other things.
CVE-2025-14172 2 Infosatech, Wordpress 2 Wp Page Permalink Extension, Wordpress 2026-01-13 6.5 Medium
The WP Page Permalink Extension plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.5.4. This is due to missing authorization checks on the `cwpp_trigger_flush_rewrite_rules` function hooked to `wp_ajax_cwpp_trigger_flush_rewrite_rules`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to flush the site's rewrite rules via the `action` parameter.