Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-12-08
CVE-2025-13137 - Woomotiv Plugin
The Live Sales Notification for Woocommerce – Woomotiv plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'woomotiv_limit' parameter in all versions up to, and including, 3.6.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Woomotiv
CVE-2025-13137
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-13308 - Application Passwords Plugin
The Application Passwords plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'reject_url' parameter in all versions up to, and including, 0.1.3. This is due to insufficient input sanitization and output escaping on user supplied URLs, which allows javascript: URI schemes to be embedded in the reject_url parameter. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when a user clicks the "No, I do not approve of this connection" button, granted they can successfully trick the victim into performing an action such…
PLUGIN
Application Passwords
CVE-2025-13308
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-13358 - Codeconfig Accessibility Plugin
The Accessiy By CodeConfig Accessibility plugin for WordPress is vulnerable to unauthorized page creation due to missing authorization checks in versions up to, and including, 1.0.0. This is due to the plugin not performing capability checks in the `Settings::createPage()` function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary published pages on the site via the `ccpcaCreatePage` AJAX action.
PLUGIN
Codeconfig Accessibility
CVE-2025-13358
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-13629 - Wp Landing Page Plugin
The WP Landing Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9.3. This is due to missing nonce validation on the 'wplp_api_update_text' function. This makes it possible for unauthenticated attackers to update arbitrary post meta via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Wp Landing Page
CVE-2025-13629
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-13309 - Codeconfig Accessibility Plugin
The Accessiy By CodeConfig Accessibility – Easy One-Click Accessibility Toolbar That Truly Matters plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers with subscriber-level access and above to modify the plugin’s global accessibility settings.
PLUGIN
Codeconfig Accessibility
CVE-2025-13309
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-12673 - Flex Qr Code Generator Plugin
The Flex QR Code Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_qr_code() function in all versions up to, and including, 1.2.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
PLUGIN
Flex Qr Code Generator
CVE-2025-12673
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-12717 - List Attachments Shortcode Plugin
The List Attachments Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before_list' parameter in the [list-attachments] shortcode in all versions up to, and including, 0.4.1a due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
List Attachments Shortcode
CVE-2025-12717
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-12715 - Canadian Nutrition Facts Label Plugin
The Canadian Nutrition Facts Label plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'percentage' field in the Nutrition Label custom post type in all versions up to, and including, 3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Canadian Nutrition Facts Label
CVE-2025-12715
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-12721 - G Ffl Cockpit Plugin
The g-FFL Cockpit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.1 via the /server_status REST API endpoint due to a lack of capability checks. This makes it possible for unauthenticated attackers to extract information about the server.
PLUGIN
G Ffl Cockpit
CVE-2025-12721
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-12720 - G Ffl Cockpit Plugin
The g-FFL Cockpit plugin for WordPress is vulnerable to unauthorized modification of data due to IP-based authorization that can be spoofed in the handle_enqueue_only() function in all versions up to, and including, 1.7.1. This makes it possible for unauthenticated attackers to delete arbitrary products.
PLUGIN
G Ffl Cockpit
CVE-2025-12720
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-12577 - Listar Directory Listing Plugin
The Listar – Directory Listing & Classifieds WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/listar/v1/place/save' REST API endpoint in all versions up to, and including, 3.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update listing details.
PLUGIN
Listar Directory Listing
CVE-2025-12577
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-12574 - Listar Directory Listing Plugin
The Listar – Directory Listing & Classifieds WordPress Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the '/wp-json/listar/v1/place/delete' REST API endpoint in all versions up to, and including, 3.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary posts.
PLUGIN
Listar Directory Listing
CVE-2025-12574
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-12091 - Instantsearch For Woocommerce Plugin
The Search, Filters & Merchandising for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wcis_save_email' endpoint in all versions up to, and including, 3.0.63. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivate the plugin.
PLUGIN
Instantsearch For Woocommerce
CVE-2025-12091
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-13922 - Simple Tags Plugin
The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'existing_terms_orderby' parameter in the AI preview AJAX endpoint in all versions up to, and including, 3.40.1. This is due to insufficient escaping on user-supplied parameters and lack of SQL query parameterization. This makes it possible for authenticated attackers, with Contributor-level access and above who have AI metabox permissions, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the…
PLUGIN
Simple Tags
CVE-2025-13922
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-12505 - Wedocs Plugin
The weDocs plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.1.14. This is due to the plugin not properly verifying that a user is authorized to perform an action in the create_item_permissions_check function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify global plugin settings.
PLUGIN
Wedocs
CVE-2025-12505
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-12510 - Widgets For Google Reviews Plugin
The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 13.2.4 due to insufficient input sanitization and output escaping on Google Reviews data imported by the plugin. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute in the admin panel (and potentially on the frontend) whenever a user accesses imported reviews, granted they can add a malicious review to a Google Place that is connected to the vulnerable site.
PLUGIN
Widgets For Google Reviews
CVE-2025-12510
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-11263 - Link Whisper Free Plugin
The Link Whisper Free plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the type parameter in all versions up to, and including, 0.8.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Link Whisper Free
CVE-2025-11263
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-13620 - Wp Social Login And Register Social Counter Plugin
The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to missing authorization in versions up to, and including, 3.1.3. This is due to the REST routes wslu/v1/check_cache/{type}, wslu/v1/save_cache/{type}, and wslu/v1/settings/clear_counter_cache being registered with permission_callback set to __return_true and lacking capability or nonce validation in their handlers. This makes it possible for unauthenticated attackers to clear or overwrite the social counter cache via crafted REST requests.
PLUGIN
Wp Social Login And Register Social Counter
CVE-2025-13620
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-13739 - Cryptx Plugin
The CryptX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `cryptx` shortcode in all versions up to, and including, 4.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Cryptx
CVE-2025-13739
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-13678 - Thai Lottery Widget Plugin
The Thai Lottery Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `thailottery` shortcode in all versions up to, and including, 2.5. This is due to insufficient input sanitization and output escaping on the user supplied `width` and `height` shortcode attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Thai Lottery Widget
CVE-2025-13678
Risk Score