Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-08-15
CVE-2025-7641 - Assistant For Nextgen Gallery Plugin
The Assistant for NextGEN Gallery plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation in the /wp-json/nextgenassistant/v1.0.0/control REST endpoint in all versions up to, and including, 1.0.9. This makes it possible for unauthenticated attackers to delete arbitrary directories on the server, which can cause a complete loss of availability.
PLUGIN
Assistant For Nextgen Gallery
CVE-2025-7641
Risk Score
Threat Entry
Updated 2025-08-15
CVE-2025-7507 - Elink Embed Content Plugin
The elink – Embed Content plugin for WordPress is vulnerable to Malicious Redirect in all versions up to, and including, 1.1.0. This is due to the plugin not restricting URLS that can be supplied through the elink shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to supply an HTML file that can be leverged to redirect users to a malicious domain.
PLUGIN
Elink Embed Content
CVE-2025-7507
Risk Score
Threat Entry
Updated 2025-08-15
CVE-2025-5844 - Radius Blocks Plugin
The Radius Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘subHeadingTagName’ parameter in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Radius Blocks
CVE-2025-5844
Risk Score
Threat Entry
Updated 2025-08-15
CVE-2025-8604 - Wp Table Builder Plugin
The WP Table Builder – WordPress Table Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wptb shortcode in all versions up to, and including, 2.0.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Wp Table Builder
CVE-2025-8604
Risk Score
Threat Entry
Updated 2025-08-15
CVE-2025-8451 - Essential Addons For Elementor Lite Plugin
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘data-gallery-items’ parameter in all versions up to, and including, 6.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Essential Addons For Elementor Lite
CVE-2025-8451
Risk Score
Threat Entry
Updated 2025-08-15
CVE-2025-6679 - Bit Form Plugin
The Bit Form builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 2.20.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. For this to be exploitable, the PRO version needs to be installed and activated as well. Additionally a form with an advanced file upload element needs to be published.
PLUGIN
Bit Form
CVE-2025-6679
Risk Score
Threat Entry
Updated 2025-08-15
CVE-2025-8013 - Quttera Web Malware Scanner Plugin
The Quttera Web Malware Scanner plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.5.1.41 via the 'RunExternalScan' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
PLUGIN
Quttera Web Malware Scanner
CVE-2025-8013
Risk Score
Threat Entry
Updated 2025-08-15
CVE-2025-8867 - Graphina Elementor Charts And Graphs Plugin
The Graphina - Elementor Charts and Graphs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple chart widget parameters in version 3.1.3 and below. This is due to insufficient input sanitization and output escaping on user supplied attributes such as chart categories, titles, and tooltip settings. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Graphina Elementor Charts And Graphs
CVE-2025-8867
Risk Score
Threat Entry
Updated 2025-08-15
CVE-2025-8680 - B Slider Plugin
The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Server-Side Request Forgery in version less than, or equal to, 2.0.0 via the fs_api_request function. This makes it possible for authenticated attackers, with subscriber-level access and above to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.
PLUGIN
B Slider
CVE-2025-8680
Risk Score
Threat Entry
Updated 2025-08-15
CVE-2025-8676 - B Slider Plugin
The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Sensitive Information Exposure in versions less than, or equal to, 2.0.0 via the get_active_plugins function. This makes it possible for authenticated attackers, with subscriber-level access and above to extract sensitive data including installed plugin information.
PLUGIN
B Slider
CVE-2025-8676
Risk Score
Threat Entry
Updated 2025-08-15
CVE-2025-8342 - Login With Phone Number Plugin
The WooCommerce OTP Login With Phone Number, OTP Verification plugin for WordPress is vulnerable to authentication bypass due to insufficient empty value checking in the lwp_ajax_register function in all versions up to, and including, 1.8.47. This makes it possible for unauthenticated attackers to bypass OTP verification and gain administrative access to any user account with a configured phone number by exploiting improper Firebase API error handling when the Firebase API key is not configured.
PLUGIN
Login With Phone Number
CVE-2025-8342
Risk Score
Threat Entry
Updated 2025-08-15
CVE-2025-6025 - Order Tip Woo Plugin
The Order Tip for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Improper Input Validation in all versions up to, and including, 1.5.4. This is due to lack of server-side validation on the `data-tip` attribute, which makes it possible for unauthenticated attackers to apply an excessive or even negative tip amount, resulting in unauthorized discount up to free orders depending on the value submitted.
PLUGIN
Order Tip Woo
CVE-2025-6025
Risk Score
Threat Entry
Updated 2025-12-12
CVE-2025-54676 - Online Booking Scheduling Calendar Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita allows Stored XSS. This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through 4.5.3.
PLUGIN
Online Booking Scheduling Calendar
CVE-2025-54676
Risk Score
Threat Entry
Updated 2025-08-14
CVE-2025-52728 - Allows Php Local File Inclusion Plugin
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WebCodingPlace Responsive Posts Carousel WordPress Plugin allows PHP Local File Inclusion. This issue affects Responsive Posts Carousel WordPress Plugin: from n/a through 15.0.
PLUGIN
Allows Php Local File Inclusion
CVE-2025-52728
Risk Score
Threat Entry
Updated 2025-08-18
CVE-2025-5998 - Password Protect Wordpress Plugin
The PPWP – Password Protect Pages WordPress plugin before version 1.9.11 allows to put the site content behind a password authorization, however users with subscriber or greater roles can view content via the REST API.
PLUGIN
Password Protect Wordpress
CVE-2025-5998
Risk Score
Threat Entry
Updated 2026-01-16
CVE-2025-8046 - Injection Guard Plugin
The Injection Guard WordPress plugin before 1.2.8 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
PLUGIN
Injection Guard
CVE-2025-8046
Risk Score
Threat Entry
Updated 2026-02-20
CVE-2025-7808 - Before 1 Plugin
The WP Shopify WordPress plugin before 1.5.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Before 1
CVE-2025-7808
Risk Score
Threat Entry
Updated 2025-08-14
CVE-2025-6790 - Before 10 Plugin
The Quiz and Survey Master (QSM) WordPress plugin before 10.2.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
PLUGIN
Before 10
CVE-2025-6790
Risk Score
Threat Entry
Updated 2025-08-14
CVE-2025-3414 - Before 1 Plugin
The Structured Content (JSON-LD) #wpsc WordPress plugin before 1.7.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
PLUGIN
Before 1
CVE-2025-3414
Risk Score
Threat Entry
Updated 2025-08-13
CVE-2025-6184 - Tutor Plugin
The Tutor LMS Pro – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter used in the get_submitted_assignments() function in all versions up to, and including, 3.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Tutor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Only the Pro…
PLUGIN
Tutor
CVE-2025-6184
Risk Score