Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-10-06
CVE-2025-7721 - Joomsport Sports League Results Management Plugin
The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.7.3 via the task parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
PLUGIN
Joomsport Sports League Results Management
CVE-2025-7721
Risk Score
Threat Entry
Updated 2025-10-06
CVE-2025-10726 - Wprecovery Plugin
The WPRecovery plugin for WordPress is vulnerable to SQL Injection via the 'data[id]' parameter in all versions up to, and including, 2.0. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additionally, the result of this SQL injection is passed directly to PHP's unlink() function, allowing attackers to delete arbitrary files…
PLUGIN
Wprecovery
CVE-2025-10726
Risk Score
Threat Entry
Updated 2025-10-06
CVE-2025-6388 - Spirit Framework Plugin
The Spirit Framework plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.2.14. This is due to the custom_actions() function not properly validating a user's identity prior to authenticating them to the site. This makes it possible for unauthenticated attackers to log in as any user, including administrators, granted they have access to the administrator's username.
PLUGIN
Spirit Framework
CVE-2025-6388
Risk Score
Threat Entry
Updated 2025-10-02
CVE-2025-9697 - Ajax Woosearch Plugin
The Ajax WooSearch WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
PLUGIN
Ajax Woosearch
CVE-2025-9697
Risk Score
Threat Entry
Updated 2025-10-02
CVE-2025-9762 - Post By Email Plugin
The Post By Email plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the save_attachments function in all versions up to, and including, 1.0.4b. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
PLUGIN
Post By Email
CVE-2025-9762
Risk Score
Threat Entry
Updated 2025-10-02
CVE-2025-8625 - Copypress Rest Api Plugin
The Copypress Rest API plugin for WordPress is vulnerable to Remote Code Execution via copyreap_handle_image() Function in versions 1.1 to 1.2. The plugin falls back to a hard-coded JWT signing key when no secret is defined and does not restrict which file types can be fetched and saved as attachments. As a result, unauthenticated attackers can forge a valid token to gain elevated privileges and upload an arbitrary file (e.g. a PHP script) through the image handler, leading to remote code execution.
PLUGIN
Copypress Rest Api
CVE-2025-8625
Risk Score
Threat Entry
Updated 2025-09-26
CVE-2025-60156 - WordPress Core
Cross-Site Request Forgery (CSRF) vulnerability in webandprint AR For WordPress allows Upload a Web Shell to a Web Server. This issue affects AR For WordPress: from n/a through 7.98.
CORE
WordPress Core
CVE-2025-60156
Risk Score
Threat Entry
Updated 2025-09-24
CVE-2025-9054 - Multiloca Woocommerce Multi Locations Inventory Management Plugin
The MultiLoca - WooCommerce Multi Locations Inventory Management plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'wcmlim_settings_ajax_handler' function in all versions up to, and including, 4.2.8. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
PLUGIN
Multiloca Woocommerce Multi Locations Inventory Management
CVE-2025-9054
Risk Score
Threat Entry
Updated 2025-09-24
CVE-2025-10412 - WooCommerce Plugin
The Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) plugin for WordPress is vulnerable to arbitrary file uploads due to misconfigured file type validation in the 'uni_cpo_upload_file' function in all versions up to, and including, 4.9.54. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
PLUGIN
WooCommerce
CVE-2025-10412
Risk Score
Threat Entry
Updated 2025-09-24
CVE-2025-10147 - Podlove Podcasting Plugin For Wordpress
The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'move_as_original_file' function in all versions up to, and including, 4.2.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
PLUGIN
Podlove Podcasting Plugin For Wordpress
CVE-2025-10147
Risk Score
Threat Entry
Updated 2025-09-24
CVE-2025-9321 - Wpcasa Plugin
The WPCasa plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.4.1. This is due to insufficient input validation and restriction on the 'api_requests' function. This makes it possible for unauthenticated attackers to call arbitrary functions and execute code.
PLUGIN
Wpcasa
CVE-2025-9321
Risk Score
Threat Entry
Updated 2025-09-19
CVE-2025-5948 - Service Finder Bookings Plugin
The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0. This is due to the plugin not properly validating a user's identity prior to claiming a business when using the claim_business AJAX action. This makes it possible for unauthenticated attackers to login as any user including admins. Please note that subscriber privileges or brute-forcing are needed when completing the business takeover. The claim_id is needed to takeover the admin account, but brute-forcing is a practical approach to…
PLUGIN
Service Finder Bookings
CVE-2025-5948
Risk Score
Threat Entry
Updated 2025-09-19
CVE-2025-10690 - Goza Nonprofit Charity Wordpress Theme
The Goza - Nonprofit Charity WordPress Theme theme for WordPress is vulnerable to unauthorized arbitrary file uploads due to a missing capability check on the 'beplus_import_pack_install_plugin' function in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to upload zip files containing webshells disguised as plugins from remote locations to achieve remote code execution.
THEME
Goza Nonprofit Charity Wordpress Theme
CVE-2025-10690
Risk Score
Threat Entry
Updated 2025-12-23
CVE-2025-9083 - Ninja Forms Plugin
The Ninja Forms WordPress plugin before 3.11.1 unserializes user input via form field, which could allow Unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog.
PLUGIN
Ninja Forms
CVE-2025-9083
Risk Score
Threat Entry
Updated 2025-09-22
CVE-2025-8942 - Wp Hotel Booking Plugin
The WP Hotel Booking WordPress plugin before 2.2.3 lacks proper server-side validation for review ratings, allowing an attacker to manipulate the rating value (e.g., sending negative or out-of-range values) by intercepting and modifying requests.
PLUGIN
Wp Hotel Booking
CVE-2025-8942
Risk Score
Threat Entry
Updated 2025-09-22
CVE-2025-5305 - Password Reset With Code For Wordpress Rest Api Plugin
The Password Reset with Code for WordPress REST API WordPress plugin before 0.0.17 does not use cryptographically sound algorithms to generate OTP codes, potentially leading to account takeovers.
PLUGIN
Password Reset With Code For Wordpress Rest Api
CVE-2025-5305
Risk Score
Threat Entry
Updated 2025-09-11
CVE-2025-8570 - Beyondcart Plugin
The BeyondCart Connector plugin for WordPress is vulnerable to Privilege Escalation due to improper JWT secret management and authorization within the determine_current_user filter in versions 1.4.2 through 2.1.0. This makes it possible for unauthenticated attackers to craft valid tokens and assume any user’s identity.
PLUGIN
Beyondcart
CVE-2025-8570
Risk Score
Threat Entry
Updated 2025-09-09
CVE-2025-10134 - Goza Nonprofit Charity Wordpress Theme
The Goza - Nonprofit Charity WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the alone_import_pack_restore_data() function in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
THEME
Goza Nonprofit Charity Wordpress Theme
CVE-2025-10134
Risk Score
Threat Entry
Updated 2025-09-09
CVE-2025-9114 - Doccure Theme
The Doccure theme for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.4.8. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts.
THEME
Doccure
CVE-2025-9114
Risk Score
Threat Entry
Updated 2025-09-09
CVE-2025-9113 - Doccure Theme
The Doccure theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'doccure_temp_upload_to_media' function in all versions up to, and including, 1.4.8. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
THEME
Doccure
CVE-2025-9113
Risk Score