Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-12-18
CVE-2025-14437 - Hummingbird Performance Plugin
The Hummingbird Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.18.0 via the 'request' function. This makes it possible for unauthenticated attackers to extract sensitive data including Cloudflare API credentials.
PLUGIN
Hummingbird Performance
CVE-2025-14437
Risk Score
Threat Entry
Updated 2025-12-18
CVE-2025-14364 - Demo Importer Plus Plugin
The Demo Importer Plus plugin for WordPress is vulnerable to unauthorized modification of data, loss of data, and privilege escalation due to a missing capability check on the Ajax::handle_request() function in all versions up to, and including, 2.0.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger a full site reset, dropping all database tables except users/usermeta and re-running wp_install(), which also assigns the Administrator role to the attacking subscriber account.
PLUGIN
Demo Importer Plus
CVE-2025-14364
Risk Score
Threat Entry
Updated 2025-12-18
CVE-2025-13641 - Nextgen Gallery Plugin
The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.59.12 via the 'template' shortcode parameter. This is due to insufficient path validation that allows absolute paths to be provided. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary PHP files on the server, bypassing web server restrictions like .htaccess. Successful exploitation could lead to information disclosure, code execution in the WordPress context, and potential remote…
PLUGIN
Nextgen Gallery
CVE-2025-13641
Risk Score
Threat Entry
Updated 2026-01-20
CVE-2025-64273 - WordPress Core
Missing Authorization vulnerability in GetResponse Email marketing for WordPress by GetResponse Official getresponse-official allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Email marketing for WordPress by GetResponse Official: from n/a through
CORE
WordPress Core
CVE-2025-64273
Risk Score
Threat Entry
Updated 2026-01-05
CVE-2025-11924 - Contact Form Builder That Grows With You Plugin
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.13.2. This is due to the plugin not properly verifying that a user is authorized before the `ninja-forms-views` REST endpoints return form metadata and submission content. This makes it possible for unauthenticated attackers to read arbitrary form definitions and submission records via a leaked bearer token granted they can load any page containing the Submissions Table block. NOTE: The developer released a…
PLUGIN
Contact Form Builder That Grows With You
CVE-2025-11924
Risk Score
Threat Entry
Updated 2025-12-16
CVE-2025-14002 - Wpcom Member Plugin
The WPCOM Member plugin for WordPress is vulnerable to authentication bypass via brute force in all versions up to, and including, 1.7.16. This is due to weak OTP (One-Time Password) generation using only 6 numeric digits combined with a 10-minute validity window and no rate limiting on verification attempts. This makes it possible for unauthenticated attackers to brute-force the verification code and authenticate as any user, including administrators, if they know the target's phone number, and the target does not notice or ignores the SMS notification with the OTP.
PLUGIN
Wpcom Member
CVE-2025-14002
Risk Score
Threat Entry
Updated 2025-12-15
CVE-2025-14383 - Booking Calendar Plugin
The Booking Calendar plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'dates_to_check' parameter in all versions up to, and including, 10.14.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Booking Calendar
CVE-2025-14383
Risk Score
Threat Entry
Updated 2025-12-15
CVE-2025-13355 - Url Shortify Plugin
The URL Shortify WordPress plugin before 1.11.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
PLUGIN
Url Shortify
CVE-2025-13355
Risk Score
Threat Entry
Updated 2025-12-15
CVE-2025-12684 - Url Shortify Plugin
The URL Shortify WordPress plugin before 1.11.3 does not sanitize and escape a parameter before outputting it back in the page, leading to a reflected cross site scripting, which could be used against high-privilege users such as admins.
PLUGIN
Url Shortify
CVE-2025-12684
Risk Score
Threat Entry
Updated 2025-12-15
CVE-2025-13126 - Wpforo Forum Plugin
The wpForo Forum plugin for WordPress is vulnerable to generic SQL Injection via the `post_args` and `topic_args` parameters in all versions up to, and including, 2.4.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Wpforo Forum
CVE-2025-13126
Risk Score
Threat Entry
Updated 2025-12-15
CVE-2025-14476 - Cross Domain Copy Paste For Wordpress Plugin
The Doubly – Cross Domain Copy Paste for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.46 via deserialization of untrusted input from the content.txt file within uploaded ZIP archives. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute arbitrary code, delete files, retrieve sensitive data, or perform other actions depending on the available gadgets. This is only exploitable by subscribers, when…
PLUGIN
Cross Domain Copy Paste For Wordpress
CVE-2025-14476
Risk Score
Threat Entry
Updated 2025-12-15
CVE-2025-14475 - Extensive Vc Addon Plugin
The Extensive VC Addons for WPBakery page builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9.1 via the `extensive_vc_get_module_template_part` function. This is due to insufficient path normalization and validation of the user-supplied `shortcode_name` parameter in the `extensive_vc_init_shortcode_pagination` AJAX action. This makes it possible for unauthenticated attackers to include and execute arbitrary PHP files on the server, allowing the execution of any PHP code in those files via the `shortcode_name` parameter.
PLUGIN
Extensive Vc Addon
CVE-2025-14475
Risk Score
Threat Entry
Updated 2025-12-15
CVE-2025-14397 - Postem Ipsum Plugin
The Postem Ipsum plugin for WordPress is vulnerable to unauthorized modification of data to Privilege Escalation due to a missing capability check on the postem_ipsum_generate_users() function in all versions up to, and including, 3.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary user accounts with the administrator role.
PLUGIN
Postem Ipsum
CVE-2025-14397
Risk Score
Threat Entry
Updated 2025-12-15
CVE-2025-13094 - Wp3d Model Import Block Plugin
The WP3D Model Import Viewer plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handle_import_file() function in all versions up to, and including, 1.0.7. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
PLUGIN
Wp3d Model Import Block
CVE-2025-13094
Risk Score
Threat Entry
Updated 2025-12-15
CVE-2025-13089 - Wp Directory Kit Plugin
The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'hide_fields' and the 'attr_search' parameter in all versions up to, and including, 1.4.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Wp Directory Kit
CVE-2025-13089
Risk Score
Threat Entry
Updated 2025-12-15
CVE-2025-13077 - Payamito Sms Woocommerce Plugin
The افزونه پیامک ووکامرس فوق حرفه ای (جدید) payamito sms woocommerce plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'columns' parameter in all versions up to, and including, 1.3.5. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Payamito Sms Woocommerce
CVE-2025-13077
Risk Score
Threat Entry
Updated 2025-12-12
CVE-2025-12835 - Through 17 Does Not Validate A File Parameter When Deleting Files Plugin
The WooMulti WordPress plugin through 17 does not validate a file parameter when deleting files, which could allow any authenticated users, such as subscriber to delete arbitrary files on the server.
PLUGIN
Through 17 Does Not Validate A File Parameter When Deleting Files
CVE-2025-12835
Risk Score
Threat Entry
Updated 2025-12-12
CVE-2025-14169 - Funnel Builder Plugin
The FunnelKit - Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'opid' parameter in all versions up to, and including, 3.13.1.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Funnel Builder
CVE-2025-14169
Risk Score
Threat Entry
Updated 2025-12-12
CVE-2025-14068 - Wpnakama Plugin
The WPNakama plugin for WordPress is vulnerable to time-based SQL Injection via the 'order_by' parameter in all versions up to, and including, 0.6.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Wpnakama
CVE-2025-14068
Risk Score
Threat Entry
Updated 2025-12-12
CVE-2025-12570 - Fancy Product Designer Plugin
The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 6.4.8 due to insufficient input sanitization and output escaping in the data-to-image.php and pdf-to-image.php files. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
PLUGIN
Fancy Product Designer
CVE-2025-12570
Risk Score