Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-11-21
CVE-2025-12964 - Magical Products Display Plugin
The Magical Products Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mpdpr_title_tag' and 'mpdpr_subtitle_tag' parameters in the MPD Pricing Table widget in all versions up to, and including, 1.1.29 due to insufficient input sanitization and output escaping on user-supplied HTML tag names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Magical Products Display
CVE-2025-12964
Risk Score
Threat Entry
Updated 2025-11-21
CVE-2025-12750 - And Marketing Automation Plugin
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to SQL Injection via the 'term' parameter in all versions up to, and including, 4.2.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
And Marketing Automation
CVE-2025-12750
Risk Score
Threat Entry
Updated 2025-11-21
CVE-2025-12066 - Wp Delete Post Copies Plugin
The WP Delete Post Copies plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 6.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
PLUGIN
Wp Delete Post Copies
CVE-2025-12066
Risk Score
Threat Entry
Updated 2025-11-21
CVE-2025-13141 - Absolute Addons For Elementor Plugin
The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Gutenberg blocks in all versions up to, and including, 3.0.0 due to insufficient input validation on user-supplied HTML tag names. This is due to the lack of a tag name whitelist allowing dangerous tags like 'script', 'iframe', and 'object' to be injected even though tag_escape() is used for sanitization. While some blocks use esc_html() for content, this can be bypassed using JavaScript encoding techniques (unquoted strings, backticks, String.fromCharCode()). This makes…
PLUGIN
Absolute Addons For Elementor
CVE-2025-13141
Risk Score
Threat Entry
Updated 2025-11-21
CVE-2025-11826 - Wp Company Info Plugin
The WP Company Info plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' attribute of the 'social-networks' shortcode in all versions up to, and including, 1.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Wp Company Info
CVE-2025-11826
Risk Score
Threat Entry
Updated 2025-11-21
CVE-2025-12039 - Bigbuy Wc Dropshipping Connector Plugin
The BigBuy Dropshipping Connector for WooCommerce plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 2.0.5 due to insufficient IP address validation and use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for unauthenticated attackers to retrieve the output of phpinfo().
PLUGIN
Bigbuy Wc Dropshipping Connector
CVE-2025-12039
Risk Score
Threat Entry
Updated 2025-11-21
CVE-2025-11973 - Keydatas Plugin
The 简数采集器 plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.6.3 via the __kds_flag functionality that imports featured images. This makes it possible for authenticated attackers, with Adminstrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
PLUGIN
Keydatas
CVE-2025-11973
Risk Score
Threat Entry
Updated 2025-11-21
CVE-2025-13149 - Change Categories Plugin
The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the "saveFutureActionData" function in all versions up to, and including, 4.9.1. This makes it possible for authenticated attackers, with author level access and above, to change the status of arbitrary posts and pages via the REST API endpoint.
PLUGIN
Change Categories
CVE-2025-13149
Risk Score
Threat Entry
Updated 2025-11-21
CVE-2025-11808 - Wp Google Street View Shortcode Plugin
The Shortcode for Google Street View plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'streetview' shortcode in all versions up to, and including, 0.5.7. This is due to insufficient input sanitization and output escaping on the 'id' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Wp Google Street View Shortcode
CVE-2025-11808
Risk Score
Threat Entry
Updated 2025-11-21
CVE-2025-11803 - Wpsite Shortcode Plugin
The WPSite Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'format' shortcode attribute in the wpsite_y shortcode and the 'before' attribute in the wpsite_postauthor shortcode in all versions up to, and including, 1.2. This is due to insufficient input sanitization and output escaping in error messages. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Wpsite Shortcode
CVE-2025-11803
Risk Score
Threat Entry
Updated 2025-11-21
CVE-2025-13142 - Custom Post Type Plugin
The Custom Post Type plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation on the custom post type deletion functionality. This makes it possible for unauthenticated attackers to delete custom post types via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Custom Post Type
CVE-2025-13142
Risk Score
Threat Entry
Updated 2025-11-21
CVE-2025-13135 - Hotelrunner Plugin
The HotelRunner Booking Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'hotelrunner' shortcode in all versions up to, and including, 5.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Hotelrunner
CVE-2025-13135
Risk Score
Threat Entry
Updated 2025-11-21
CVE-2025-13134 - Authorsure Plugin
The AuthorSure plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3. This is due to missing or incorrect nonce validation on the 'authorsure' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Authorsure
CVE-2025-13134
Risk Score
Threat Entry
Updated 2025-11-21
CVE-2025-12881 - Return Refund And Exchange For Woocommerce Plugin
The Return Refund and Exchange For WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.5 via the wps_rma_fetch_order_msgs() due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read other user's order messages.
PLUGIN
Return Refund And Exchange For Woocommerce
CVE-2025-12881
Risk Score
Threat Entry
Updated 2025-11-21
CVE-2025-12894 - Export And Import Csv And Xml Files To Wordpress Plugin
The Import WP – Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.14.17 via the import/export functionality and a lack of .htaccess protection. This makes it possible for unauthenticated attackers to extract sensitive data from exports stored in /exportwp and import data stored in /importwp.
PLUGIN
Export And Import Csv And Xml Files To Wordpress
CVE-2025-12894
Risk Score
Threat Entry
Updated 2025-11-21
CVE-2025-12661 - Pollcaster Shortcode Plugin
The Pollcaster Shortcode Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'height' parameter in the 'pollcaster' shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Pollcaster Shortcode
CVE-2025-12661
Risk Score
Threat Entry
Updated 2025-11-21
CVE-2025-12660 - Wallwisher Shortcode Plugin
The Padlet Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'key' parameter in the 'wallwisher' shortcode in all versions up to, and including, 1.3. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Wallwisher Shortcode
CVE-2025-12660
Risk Score
Threat Entry
Updated 2026-01-26
CVE-2025-12746 - Tainacan Plugin
The Tainacan plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Tainacan
CVE-2025-12746
Risk Score
Threat Entry
Updated 2025-11-21
CVE-2025-12170 - Checkbox Plugin
The Checkbox plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'wp_ajax_nopriv_checkbox_clean_log' AJAX endpoint in all versions up to, and including, 2.8.10. This makes it possible for unauthenticated attackers to clear log files.
PLUGIN
Checkbox
CVE-2025-12170
Risk Score
Threat Entry
Updated 2025-11-21
CVE-2025-12086 - Return Refund And Exchange For Woocommerce Plugin
The Return Refund and Exchange For WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.5 via the 'wps_rma_cancel_return_request' AJAX endpoint due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete other users refund requests.
PLUGIN
Return Refund And Exchange For Woocommerce
CVE-2025-12086
Risk Score