Filtered by vendor Wordpress Subscriptions
Total 5367 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-48343 1 Wordpress 1 Wordpress 2025-08-29 7.1 High
Cross-Site Request Forgery (CSRF) vulnerability in Aaron Axelsen WPMU Ldap Authentication allows Stored XSS. This issue affects WPMU Ldap Authentication: from n/a through 5.0.1.
CVE-2025-48318 1 Wordpress 1 Wordpress 2025-08-29 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in shen2 多说社会化评论框 allows Cross Site Request Forgery. This issue affects 多说社会化评论框: from n/a through 1.2.
CVE-2025-48311 1 Wordpress 1 Wordpress 2025-08-29 7.1 High
Cross-Site Request Forgery (CSRF) vulnerability in OffClicks Invisible Optin allows Stored XSS. This issue affects Invisible Optin: from n/a through 1.0.
CVE-2025-48350 1 Wordpress 1 Wordpress 2025-08-29 4.3 Medium
Missing Authorization vulnerability in Neuralabz LTD AutoWP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AutoWP: from n/a through 2.2.2.
CVE-2025-48327 1 Wordpress 1 Wordpress 2025-08-29 5.3 Medium
Missing Authorization vulnerability in inkthemes WP Mailgun SMTP allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects WP Mailgun SMTP: from n/a through 1.0.7.
CVE-2025-48319 1 Wordpress 1 Wordpress 2025-08-29 5.9 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gslauraspeck Mesa Mesa Reservation Widget allows Stored XSS. This issue affects Mesa Mesa Reservation Widget: from n/a through 1.0.0.
CVE-2025-48305 1 Wordpress 1 Wordpress 2025-08-29 5.9 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vikingjs Goal Tracker for Patreon allows Stored XSS. This issue affects Goal Tracker for Patreon: from n/a through 0.4.6.
CVE-2025-0951 2 Liquidthemes, Wordpress 4 Ai Hub, Archub, Hub and 1 more 2025-08-29 4.3 Medium
Multiple plugins and/or themes for WordPress by LiquidThemes are vulnerable to unauthorized access due to a missing capability check on the liquid_reset_wordpress_before AJAX in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivate all of a site's plugins. While we escalated this to Envato after not being able to establish contact, it appears the developer added a nonce check, however that is not sufficient protection as the nonce is exposed to all users with access to the dashboard.
CVE-2025-58194 2 Bold-themes, Wordpress 2 Bold Page Builder, Wordpress 2025-08-29 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Page Builder allows Stored XSS. This issue affects Bold Page Builder: from n/a through 5.4.3.
CVE-2025-58203 2 Solacewp, Wordpress 2 Solace Extra, Wordpress 2025-08-29 4.4 Medium
Server-Side Request Forgery (SSRF) vulnerability in solacewp Solace Extra allows Server Side Request Forgery. This issue affects Solace Extra: from n/a through 1.3.2.
CVE-2025-48306 1 Wordpress 1 Wordpress 2025-08-29 7.1 High
Cross-Site Request Forgery (CSRF) vulnerability in developers savyour Savyour Affiliate Partner allows Stored XSS. This issue affects Savyour Affiliate Partner: from n/a through 2.1.4.
CVE-2025-48309 1 Wordpress 1 Wordpress 2025-08-29 7.1 High
Cross-Site Request Forgery (CSRF) vulnerability in web-able BetPress allows Stored XSS. This issue affects BetPress: from n/a through 1.0.1 Lite.
CVE-2025-48310 2 Wordpress, Wptableeditor 2 Wordpress, Table Editor 2025-08-29 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in wptableeditor Table Editor allows Cross Site Request Forgery. This issue affects Table Editor: from n/a through 1.6.4.
CVE-2025-48320 1 Wordpress 1 Wordpress 2025-08-29 7.1 High
Cross-Site Request Forgery (CSRF) vulnerability in cuckoohello 百度分享按钮 allows Stored XSS. This issue affects 百度分享按钮: from n/a through 1.0.6.
CVE-2025-48352 1 Wordpress 1 Wordpress 2025-08-29 5.9 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sitesearch-yandex Yandex Site search pinger allows Stored XSS. This issue affects Yandex Site search pinger: from n/a through 1.5.
CVE-2025-48360 2 Razvan Stanga, Wordpress 2 Varnish Nginx Proxy Caching Plugin, Wordpress 2025-08-29 5.9 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Razvan Stanga Varnish/Nginx Proxy Caching allows Stored XSS. This issue affects Varnish/Nginx Proxy Caching: from n/a through 1.8.3.
CVE-2025-48361 1 Wordpress 1 Wordpress 2025-08-29 5.3 Medium
Insertion of Sensitive Information Into Sent Data vulnerability in Saeed Sattar Beglou Hesabfa Accounting allows Retrieve Embedded Sensitive Data. This issue affects Hesabfa Accounting: from n/a through 2.2.4.
CVE-2025-58196 2 Uicore, Wordpress 2 Elements, Wordpress 2025-08-29 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uicore UiCore Elements allows Stored XSS. This issue affects UiCore Elements: from n/a through 1.3.4.
CVE-2025-58205 2 Elementinvader, Wordpress 2 Elementinvader Addons For Elementor, Wordpress 2025-08-29 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Element Invader ElementInvader Addons for Elementor allows DOM-Based XSS. This issue affects ElementInvader Addons for Elementor: from n/a through 1.3.6.
CVE-2025-48312 1 Wordpress 1 Wordpress 2025-08-29 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 文派翻译（WP Chinese Translation） WPAvatar allows Stored XSS. This issue affects WPAvatar: from n/a through 1.9.3.