Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-10-16
CVE-2025-10660 - Wp Dashboard Chat Plugin
The WP Dashboard Chat plugin for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Wp Dashboard Chat
CVE-2025-10660
Risk Score
Threat Entry
Updated 2025-10-16
CVE-2025-10313 - Find And Replace Content Plugin
The Find And Replace content for WordPress plugin for WordPress is vulnerable to unauthorized Stored Cross-Site Scripting and Arbitrary Content Replacement due to a missing capability check on the far_admin_ajax_fun() function in all versions up to, and including, 1.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into pages that can make privilege escalation and malicious redirects possible.
PLUGIN
Find And Replace Content
CVE-2025-10313
Risk Score
Threat Entry
Updated 2025-10-16
CVE-2025-10575 - Wp Jquery Pdf Paged Plugin
The WP jQuery Pager plugin for WordPress is vulnerable to SQL Injection via the 'ids' shortcode attribute parameter handled by the WPJqueryPaged::get_gallery_page_imgs() function in all versions up to, and including, 1.4.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Wp Jquery Pdf Paged
CVE-2025-10575
Risk Score
Threat Entry
Updated 2025-10-16
CVE-2025-10648 - Login With Yourmembership Plugin
The YourMembership Single Sign On – YM SSO Login plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'moym_display_test_attributes' function in all versions up to, and including, 1.1.7. This makes it possible for unauthenticated attackers to read the profile data of the latest SSO login.
PLUGIN
Login With Yourmembership
CVE-2025-10648
Risk Score
Threat Entry
Updated 2025-10-16
CVE-2025-10486 - Content Writer Plugin
The Content Writer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.8 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files.
PLUGIN
Content Writer
CVE-2025-10486
Risk Score
Threat Entry
Updated 2025-10-16
CVE-2025-10312 - Theme Importer Plugin
The Theme Importer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation when processing form submissions in the theme-importer.php file. This makes it possible for unauthenticated attackers to trigger arbitrary file downloads and potentially execute malicious operations via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Theme Importer
CVE-2025-10312
Risk Score
Threat Entry
Updated 2025-10-16
CVE-2025-10294 - Ownid Passwordless Login Plugin
The OwnID Passwordless Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.3.4. This is due to the plugin not properly checking if the ownid_shared_secret value is empty prior to authenticating a user via JWT. This makes it possible for unauthenticated attackers to log in as other users, including administrators, on instances where the plugin has not been fully configured yet.
PLUGIN
Ownid Passwordless Login
CVE-2025-10294
Risk Score
Threat Entry
Updated 2025-10-16
CVE-2025-10299 - Create Temporary Login Plugin
The WPBifröst – Instant Passwordless Temporary Login Links plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the ctl_create_link AJAX action in all versions up to, and including, 1.0.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create new administrative user accounts and subsequently log in as those.
PLUGIN
Create Temporary Login
CVE-2025-10299
Risk Score
Threat Entry
Updated 2025-10-16
CVE-2025-10310 - Rich Snippet Site Report Plugin
The Rich Snippet Site Report plugin for WordPress is vulnerable to SQL Injection via the 'last' parameter in all versions up to, and including, 2.0.0105 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This can also be exploited via CSRF.
PLUGIN
Rich Snippet Site Report
CVE-2025-10310
Risk Score
Threat Entry
Updated 2025-10-16
CVE-2025-10303 - Library Management System Plugin
The Library Management System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the owt7_library_management_ajax_handler() function in all versions up to, and including, 3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update and manipulate several of the plugin's settings and features.
PLUGIN
Library Management System
CVE-2025-10303
Risk Score
Threat Entry
Updated 2025-10-16
CVE-2025-10301 - Funkitools Plugin
The FunKItools plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to missing or incorrect nonce validation on the saveFields() function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Funkitools
CVE-2025-10301
Risk Score
Threat Entry
Updated 2025-10-16
CVE-2025-10300 - Topbar Plugin
The TopBar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the fme_nb_topbar_save_settings() function. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Topbar
CVE-2025-10300
Risk Score
Threat Entry
Updated 2025-10-16
CVE-2025-10293 - Keyy Plugin
The Keyy Two Factor Authentication (like Clef) plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.2.3. This is due to the plugin not properly validating a user's identity associated with a token generated. This makes it possible for authenticated attackers, with subscriber-level access and above, to generate valid auth tokens and leverage that to auto-login as other accounts, including administrators, as long as the administrator has the 2FA set up.
PLUGIN
Keyy
CVE-2025-10293
Risk Score
Threat Entry
Updated 2025-10-16
CVE-2025-10194 - Shortcode Button Plugin
The Shortcode Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button' shortcode in all versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Shortcode Button
CVE-2025-10194
Risk Score
Threat Entry
Updated 2025-10-16
CVE-2025-10141 - Digiseller Plugin
The Digiseller plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ds' shortcode in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Digiseller
CVE-2025-10141
Risk Score
Threat Entry
Updated 2025-10-16
CVE-2025-10140 - Quick Login Plugin
The Quick Social Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'quick-login' shortcode in all versions up to, and including, 1.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Quick Login
CVE-2025-10140
Risk Score
Threat Entry
Updated 2025-10-16
CVE-2025-10186 - Wp Whydonate Plugin
The WhyDonate – FREE Donate button – Crowdfunding – Fundraising plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the remove_row function in all versions up to, and including, 4.0.14. This makes it possible for unauthenticated attackers to delete rows from the wp_wdplugin_style table.
PLUGIN
Wp Whydonate
CVE-2025-10186
Risk Score
Threat Entry
Updated 2025-10-16
CVE-2025-10139 - Wp Bookwidgets Plugin
The WP BookWidgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bw_link' shortcode in all versions up to, and including, 0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Wp Bookwidgets
CVE-2025-10139
Risk Score
Threat Entry
Updated 2025-10-16
CVE-2025-10135 - Wp Viewstl Plugin
The WP ViewSTL plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'viewstl' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Wp Viewstl
CVE-2025-10135
Risk Score
Threat Entry
Updated 2025-10-16
CVE-2025-10133 - Urlyar Url Shortner Plugin
The URLYar URL Shortner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'urlyar_shortlink' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Urlyar Url Shortner
CVE-2025-10133
Risk Score