Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-07-08
CVE-2025-6462 - Ez Sql Reports Shortcode Widget And Db Backup Plugin
The EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's SQLREPORT shortcode in all versions up to, and including, 5.25.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Ez Sql Reports Shortcode Widget And Db Backup
CVE-2025-6462
Risk Score
Threat Entry
Updated 2025-07-08
CVE-2025-5937 - Micropayments Plugin
The MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.0. This is due to missing or incorrect nonce validation on the adminOptions() function. This makes it possible for unauthenticated attackers to reset the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Micropayments
CVE-2025-5937
Risk Score
Threat Entry
Updated 2025-07-07
CVE-2025-6755 - Game Users Share Button Plugin
The Game Users Share Buttons plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ajaxDeleteTheme() function in all versions up to, and including, 1.3.0. This makes it possible for Subscriber-level attackers to add arbitrary file paths (such as ../../../../wp-config.php) to the themeNameId parameter of the AJAX request, which can lead to remote code execution.
PLUGIN
Game Users Share Button
CVE-2025-6755
Risk Score
Threat Entry
Updated 2025-07-07
CVE-2025-5304 - Pt Project Notebooks Plugin
The PT Project Notebooks plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization in the wpnb_pto_new_users_add() function in versions 1.0.0 through 1.1.3. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator.
PLUGIN
Pt Project Notebooks
CVE-2025-5304
Risk Score
Threat Entry
Updated 2025-07-07
CVE-2025-6252 - Qi Addons For Elementor Plugin
The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 1.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Qi Addons For Elementor
CVE-2025-6252
Risk Score
Threat Entry
Updated 2025-07-07
CVE-2025-6381 - Vidmov Plugin
The BeeTeam368 Extensions plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.4 via the handle_remove_temp_file() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform actions on files outside of the originally intended directory. This vulnerability can be used to delete the wp-config.php file, which can be leveraged into a site takeover.
PLUGIN
Vidmov
CVE-2025-6381
Risk Score
Threat Entry
Updated 2025-07-07
CVE-2025-6379 - Vidmov Plugin
The BeeTeam368 Extensions Pro plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.4 via the handle_live_fn() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform actions on files outside of the originally intended directory. This vulnerability can be used to delete the wp-config.php file, which can be leveraged into a site takeover.
PLUGIN
Vidmov
CVE-2025-6379
Risk Score
Threat Entry
Updated 2025-07-07
CVE-2025-6350 - Wp Vr Plugin
The WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘hotspot-hover’ parameter in all versions up to, and including, 8.5.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Wp Vr
CVE-2025-6350
Risk Score
Threat Entry
Updated 2025-06-30
CVE-2025-53260 - Upload Of File With Dangerous Type Vulnerability In Getredhawkstudio File Manager Plugin
Unrestricted Upload of File with Dangerous Type vulnerability in getredhawkstudio File Manager Plugin For Wordpress allows Upload a Web Shell to a Web Server. This issue affects File Manager Plugin For Wordpress: from n/a through 7.5.
PLUGIN
Upload Of File With Dangerous Type Vulnerability In Getredhawkstudio File Manager
CVE-2025-53260
Risk Score
Threat Entry
Updated 2025-07-07
CVE-2025-5398 - Ninja Forms Plugin
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the use of a templating engine in all versions up to, and including, 3.10.2.1 due to insufficient output escaping on user data passed through the template. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Ninja Forms
CVE-2025-5398
Risk Score
Threat Entry
Updated 2025-07-07
CVE-2025-2940 - Ninja Tables Plugin
The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.18 via the args[url] parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
PLUGIN
Ninja Tables
CVE-2025-2940
Risk Score
Threat Entry
Updated 2025-07-02
CVE-2025-6688 - Simple Payment Plugin
The Simple Payment plugin for WordPress is vulnerable to Authentication Bypass in versions 1.3.6 to 2.3.8. This is due to the plugin not properly verifying a user's identity prior to logging them in through the create_user() function. This makes it possible for unauthenticated attackers to log in as administrative users.
PLUGIN
Simple Payment
CVE-2025-6688
Risk Score
Threat Entry
Updated 2025-07-08
CVE-2025-6689 - Fl3r Accessibility Suite Plugin
The FL3R Accessibility Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's fl3raccessibilitysuite shortcode in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Fl3r Accessibility Suite
CVE-2025-6689
Risk Score
Threat Entry
Updated 2025-07-08
CVE-2025-6550 - Pack Elementor Addons Plugin
The The Pack Elementor addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slider_options’ parameter in all versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Pack Elementor Addons
CVE-2025-6550
Risk Score
Threat Entry
Updated 2025-07-07
CVE-2025-5940 - Osom Blocks Plugin
The Osom Blocks – Custom Post Type listing block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class_name’ parameter in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Osom Blocks
CVE-2025-5940
Risk Score
Threat Entry
Updated 2025-06-30
CVE-2025-4587 - Ab Testing For Wp Plugin
The A/B Testing for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ab-testing-for-wp/ab-test-block' block in all versions up to, and including, 1.18.2 due to insufficient input sanitization and output escaping on the 'id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Ab Testing For Wp
CVE-2025-4587
Risk Score
Threat Entry
Updated 2025-07-07
CVE-2025-5936 - Vr Calendar Plugin
The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.7. This is due to missing or incorrect nonce validation on the syncCalendar() function. This makes it possible for unauthenticated attackers to trigger a calendar sync via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Vr Calendar
CVE-2025-5936
Risk Score
Threat Entry
Updated 2025-07-01
CVE-2025-5093 - Before 2 Plugin
The Responsive Lightbox & Gallery WordPress plugin before 2.5.2 use the Swipebox library which does not validate and escape title attributes before outputting them back in a page/post where used, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
PLUGIN
Before 2
CVE-2025-5093
Risk Score
Threat Entry
Updated 2025-07-01
CVE-2025-5035 - Firelight Lightbox Plugin
The Firelight Lightbox WordPress plugin before 2.3.16 does not sanitise and escape title attributes before outputting them in the page, which could allow users with a role as low as contributors to perform stored Cross-Site Scripting attacks.
PLUGIN
Firelight Lightbox
CVE-2025-5035
Risk Score
Threat Entry
Updated 2025-07-07
CVE-2025-5194 - Wp Map Block Plugin
The WP Map Block WordPress plugin before 2.0.3 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
PLUGIN
Wp Map Block
CVE-2025-5194
Risk Score