Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-12-08
CVE-2025-13629 - Wp Landing Page Plugin
The WP Landing Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9.3. This is due to missing nonce validation on the 'wplp_api_update_text' function. This makes it possible for unauthenticated attackers to update arbitrary post meta via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Wp Landing Page
CVE-2025-13629
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-13309 - Codeconfig Accessibility Plugin
The Accessiy By CodeConfig Accessibility – Easy One-Click Accessibility Toolbar That Truly Matters plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers with subscriber-level access and above to modify the plugin’s global accessibility settings.
PLUGIN
Codeconfig Accessibility
CVE-2025-13309
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-12717 - List Attachments Shortcode Plugin
The List Attachments Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before_list' parameter in the [list-attachments] shortcode in all versions up to, and including, 0.4.1a due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
List Attachments Shortcode
CVE-2025-12717
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-12715 - Canadian Nutrition Facts Label Plugin
The Canadian Nutrition Facts Label plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'percentage' field in the Nutrition Label custom post type in all versions up to, and including, 3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Canadian Nutrition Facts Label
CVE-2025-12715
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-12721 - G Ffl Cockpit Plugin
The g-FFL Cockpit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.1 via the /server_status REST API endpoint due to a lack of capability checks. This makes it possible for unauthenticated attackers to extract information about the server.
PLUGIN
G Ffl Cockpit
CVE-2025-12721
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-12720 - G Ffl Cockpit Plugin
The g-FFL Cockpit plugin for WordPress is vulnerable to unauthorized modification of data due to IP-based authorization that can be spoofed in the handle_enqueue_only() function in all versions up to, and including, 1.7.1. This makes it possible for unauthenticated attackers to delete arbitrary products.
PLUGIN
G Ffl Cockpit
CVE-2025-12720
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-12577 - Listar Directory Listing Plugin
The Listar – Directory Listing & Classifieds WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/listar/v1/place/save' REST API endpoint in all versions up to, and including, 3.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update listing details.
PLUGIN
Listar Directory Listing
CVE-2025-12577
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-12574 - Listar Directory Listing Plugin
The Listar – Directory Listing & Classifieds WordPress Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the '/wp-json/listar/v1/place/delete' REST API endpoint in all versions up to, and including, 3.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary posts.
PLUGIN
Listar Directory Listing
CVE-2025-12574
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-12091 - Instantsearch For Woocommerce Plugin
The Search, Filters & Merchandising for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wcis_save_email' endpoint in all versions up to, and including, 3.0.63. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivate the plugin.
PLUGIN
Instantsearch For Woocommerce
CVE-2025-12091
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-13922 - Simple Tags Plugin
The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'existing_terms_orderby' parameter in the AI preview AJAX endpoint in all versions up to, and including, 3.40.1. This is due to insufficient escaping on user-supplied parameters and lack of SQL query parameterization. This makes it possible for authenticated attackers, with Contributor-level access and above who have AI metabox permissions, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the…
PLUGIN
Simple Tags
CVE-2025-13922
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-12505 - Wedocs Plugin
The weDocs plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.1.14. This is due to the plugin not properly verifying that a user is authorized to perform an action in the create_item_permissions_check function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify global plugin settings.
PLUGIN
Wedocs
CVE-2025-12505
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-11263 - Link Whisper Free Plugin
The Link Whisper Free plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the type parameter in all versions up to, and including, 0.8.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Link Whisper Free
CVE-2025-11263
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-13620 - Wp Social Login And Register Social Counter Plugin
The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to missing authorization in versions up to, and including, 3.1.3. This is due to the REST routes wslu/v1/check_cache/{type}, wslu/v1/save_cache/{type}, and wslu/v1/settings/clear_counter_cache being registered with permission_callback set to __return_true and lacking capability or nonce validation in their handlers. This makes it possible for unauthenticated attackers to clear or overwrite the social counter cache via crafted REST requests.
PLUGIN
Wp Social Login And Register Social Counter
CVE-2025-13620
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-13739 - Cryptx Plugin
The CryptX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `cryptx` shortcode in all versions up to, and including, 4.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Cryptx
CVE-2025-13739
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-13678 - Thai Lottery Widget Plugin
The Thai Lottery Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `thailottery` shortcode in all versions up to, and including, 2.5. This is due to insufficient input sanitization and output escaping on the user supplied `width` and `height` shortcode attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Thai Lottery Widget
CVE-2025-13678
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-13682 - Trail Manager Plugin
The Trail Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
PLUGIN
Trail Manager
CVE-2025-13682
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-12876 - Projectopia Core Plugin
The Projectopia – WordPress Project Management plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pto_delete_file AJAX action in all versions up to, and including, 5.1.19. This makes it possible for unauthenticated attackers to delete arbitrary attachments.
PLUGIN
Projectopia Core
CVE-2025-12876
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-13684 - Ark Relatedpost Plugin
The ARK Related Posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 2.19. This is due to missing or incorrect nonce validation on the ark_rp_options_page function. This makes it possible for unauthenticated attackers to modify the plugin's configuration settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Ark Relatedpost
CVE-2025-13684
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-12130 - Product Vendors Plugin
The WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.4. This is due to missing or incorrect nonce validation on the /vendor_dashboard/product/delete/ endpoint. This makes it possible for unauthenticated attackers to delete vendor products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Product Vendors
CVE-2025-12130
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-13515 - Newsletters From Rss To Email Newsletters Using Nourish Plugin
The Nouri.sh Newsletter plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` parameter in all versions up to, and including, 1.0.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Newsletters From Rss To Email Newsletters Using Nourish
CVE-2025-13515
Risk Score