Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-12-12
CVE-2025-12650 - Simple Post Listing Plugin
The Simple post listing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class_name' parameter in the postlist shortcode in all versions up to, and including, 0.2. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page via mouse interaction.
PLUGIN
Simple Post Listing
CVE-2025-12650
Risk Score
Threat Entry
Updated 2025-12-12
CVE-2025-13886 - Lt Unleashed Plugin
The LT Unleashed plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.1 via the 'template' parameter in the `book` shortcode due to insufficient path sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where files such as wp-config.php can be included.
PLUGIN
Lt Unleashed
CVE-2025-13886
Risk Score
Threat Entry
Updated 2025-12-12
CVE-2025-13839 - Ljusers Plugin
The LJUsers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter of the 'ljuser' shortcode in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Ljusers
CVE-2025-13839
Risk Score
Threat Entry
Updated 2025-12-12
CVE-2025-14293 - Wp Job Portal Plugin
The WP Job Portal plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.4.0 via the 'downloadCustomUploadedFile' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
PLUGIN
Wp Job Portal
CVE-2025-14293
Risk Score
Threat Entry
Updated 2025-12-12
CVE-2025-9436 - Wp Reviews Plugin For Google
The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `trustindex` shortcode in all versions up to, and including, 13.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Wp Reviews Plugin For Google
CVE-2025-9436
Risk Score
Threat Entry
Updated 2025-12-12
CVE-2025-10163 - List Category Posts Plugin
The List category posts plugin for WordPress is vulnerable to time-based SQL Injection via the ‘starting_with’ parameter of the catlist shortcode in all versions up to, and including, 0.91.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
List Category Posts
CVE-2025-10163
Risk Score
Threat Entry
Updated 2025-12-12
CVE-2025-13764 - Wp Cardealer Plugin
The WP CarDealer plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.16. This is due to the 'WP_CarDealer_User::process_register' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.
PLUGIN
Wp Cardealer
CVE-2025-13764
Risk Score
Threat Entry
Updated 2025-12-12
CVE-2025-11467 - Feedzy Rss Feeds Plugin
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 5.1.1 via the feedzy_lazy_load function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
PLUGIN
Feedzy Rss Feeds
CVE-2025-11467
Risk Score
Threat Entry
Updated 2025-12-12
CVE-2025-14390 - Video Merchant Plugin
The Video Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in version
PLUGIN
Video Merchant
CVE-2025-14390
Risk Score
Threat Entry
Updated 2025-12-12
CVE-2025-13073 - Before 2 Plugin
The HandL UTM Grabber / Tracker WordPress plugin before 2.8.1 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Before 2
CVE-2025-13073
Risk Score
Threat Entry
Updated 2025-12-12
CVE-2025-13072 - Before 2 Plugin
The HandL UTM Grabber / Tracker WordPress plugin before 2.8.1 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
PLUGIN
Before 2
CVE-2025-13072
Risk Score
Threat Entry
Updated 2025-12-12
CVE-2025-13339 - Hippoo Mobile App For Woocommerce Plugin
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.7.1 via the template_redirect() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
PLUGIN
Hippoo Mobile App For Woocommerce
CVE-2025-13339
Risk Score
Threat Entry
Updated 2025-12-12
CVE-2025-13677 - Simple Download Counter Plugin
The Simple Download Counter plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.2.2. This is due to insufficient path validation in the `simple_download_counter_parse_path()` function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which may contain sensitive information such as database credentials (wp-config.php) or system files. Please note that the vendor opted to continue to allow remote file downloads from arbitrary locations on the server, however, has disabled this functionality…
PLUGIN
Simple Download Counter
CVE-2025-13677
Risk Score
Threat Entry
Updated 2025-12-12
CVE-2025-13613 - Elated Membership Plugin
The Elated Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.2. This is due to the plugin not properly logging in a user with the data that was previously verified through the 'eltdf_membership_check_facebook_user' and the 'eltdf_membership_login_user_from_social_network' function. This makes it possible for unauthenticated attackers to log in as administrative users, as long as they have an existing account on the site which can easily be created by default through the temp user functionality, and access to the administrative user's email.
PLUGIN
Elated Membership
CVE-2025-13613
Risk Score
Threat Entry
Updated 2025-12-09
CVE-2025-13924 - For Woocommerce Plugin
The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.17. This is due to missing or incorrect nonce validation on the 'maybe_duplicate' function. This makes it possible for unauthenticated attackers to duplicate and publish product field groups, including draft and pending field groups, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
For Woocommerce
CVE-2025-13924
Risk Score
Threat Entry
Updated 2026-01-20
CVE-2025-67559 - Online Booking Scheduling Calendar Plugin
Missing Authorization vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through
PLUGIN
Online Booking Scheduling Calendar
CVE-2025-67559
Risk Score
Threat Entry
Updated 2026-01-20
CVE-2025-67472 - Online Booking Scheduling Calendar Plugin
Cross-Site Request Forgery (CSRF) vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Cross Site Request Forgery.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through
PLUGIN
Online Booking Scheduling Calendar
CVE-2025-67472
Risk Score
Threat Entry
Updated 2025-12-09
CVE-2025-13604 - Security Malware Firewall Plugin
The Login Security, FireWall, Malware removal by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the page URL in all versions up to, and including, 2.168 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Security Malware Firewall
CVE-2025-13604
Risk Score
Threat Entry
Updated 2026-01-09
CVE-2025-13071 - Custom Admin Menu Plugin
The Custom Admin Menu WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
PLUGIN
Custom Admin Menu
CVE-2025-13071
Risk Score
Threat Entry
Updated 2026-01-09
CVE-2025-13070 - Csv To Sorttable Plugin
The CSV to SortTable WordPress plugin through 4.2 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as contributor to perform LFI attacks.
PLUGIN
Csv To Sorttable
CVE-2025-13070
Risk Score