Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-12-08
CVE-2025-13682 - Trail Manager Plugin
The Trail Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
PLUGIN
Trail Manager
CVE-2025-13682
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-12879 - User Importer And Generator Plugin
The User Generator and Importer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.2.2. This is due to missing nonce validation in the "Import Using CSV File" function. This makes it possible for unauthenticated attackers to elevate user privileges by creating arbitrary accounts with administrator privileges via a forged request, provided they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
User Importer And Generator
CVE-2025-12879
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-13614 - Cool Tag Cloud Plugin
The Cool Tag Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cool_tag_cloud' shortcode in all versions up to, and including, 2.29 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Cool Tag Cloud
CVE-2025-13614
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-12876 - Projectopia Core Plugin
The Projectopia – WordPress Project Management plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pto_delete_file AJAX action in all versions up to, and including, 5.1.19. This makes it possible for unauthenticated attackers to delete arbitrary attachments.
PLUGIN
Projectopia Core
CVE-2025-12876
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-12851 - My Auctions Allegro Plugin
The My auctions allegro plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.6.32 via the 'controller' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
PLUGIN
My Auctions Allegro
CVE-2025-12851
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-13684 - Ark Relatedpost Plugin
The ARK Related Posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 2.19. This is due to missing or incorrect nonce validation on the ark_rp_options_page function. This makes it possible for unauthenticated attackers to modify the plugin's configuration settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Ark Relatedpost
CVE-2025-13684
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-12130 - Product Vendors Plugin
The WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.4. This is due to missing or incorrect nonce validation on the /vendor_dashboard/product/delete/ endpoint. This makes it possible for unauthenticated attackers to delete vendor products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Product Vendors
CVE-2025-12130
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-12374 - User Verification Plugin
The Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.39. This is due to the plugin not properly validating that an OTP was generated before comparing it to user input in the "user_verification_form_wrap_process_otpLogin" function. This makes it possible for unauthenticated attackers to log in as any user with a verified email address, such as an administrator, by submitting an empty OTP value.
PLUGIN
User Verification
CVE-2025-12374
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-12850 - My Auctions Allegro Plugin
The My auctions allegro plugin for WordPress is vulnerable to SQL Injection via the ‘auction_id’ parameter in all versions up to, and including, 3.6.32 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
My Auctions Allegro
CVE-2025-12850
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-13515 - Newsletters From Rss To Email Newsletters Using Nourish Plugin
The Nouri.sh Newsletter plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` parameter in all versions up to, and including, 1.0.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Newsletters From Rss To Email Newsletters Using Nourish
CVE-2025-13515
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-12355 - Payaza Plugin
The Payaza plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_nopriv_update_order_status' AJAX endpoint in all versions up to, and including, 0.3.8. This makes it possible for unauthenticated attackers to update order statuses.
PLUGIN
Payaza
CVE-2025-12355
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-12186 - Weekly Planner Plugin
The Weekly Planner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
PLUGIN
Weekly Planner
CVE-2025-12186
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-12373 - Smart Shipping And Delivery Portal For E Shops And Retailers Plugin
The Torod – The smart shipping and delivery portal for e-shops and retailers plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9. This is due to missing or incorrect nonce validation on the save_settings function. This makes it possible for unauthenticated attackers to modify plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Smart Shipping And Delivery Portal For E Shops And Retailers
CVE-2025-12373
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-12354 - Live Css Preview Plugin
The Live CSS Preview plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_frontend_save' AJAX endpoint in all versions up to, and including, 2.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's css setting.
PLUGIN
Live Css Preview
CVE-2025-12354
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-12093 - Voidek Employee Portal Plugin
The Voidek Employee Portal plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX actions in all versions up to, and including, 1.0.6. This makes it possible for unauthenticated attackers to perform several actions like registering an account, deleting users, and modifying details within the employee portal.
PLUGIN
Voidek Employee Portal
CVE-2025-12093
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-13860 - Easy Jump Links Menus Plugin
The Easy Jump Links Menus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `h_tags` parameter in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Easy Jump Links Menus
CVE-2025-13860
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-13625 - Wp Sos Donate Plugin
The WP-SOS-Donate Donation Sidebar Plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` parameter in all versions up to, and including, 0.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Wp Sos Donate
CVE-2025-13625
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-13623 - Twitscription Plugin
The Twitscription plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the admin.php PATH_INFO in all versions up to, and including, 0.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Twitscription
CVE-2025-13623
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-13622 - Jabberbenachrichtigung Plugin
The Jabbernotification plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the admin.php PATH_INFO in all versions up to, and including, 0.99-RC2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Jabberbenachrichtigung
CVE-2025-13622
Risk Score
Threat Entry
Updated 2025-12-08
CVE-2025-13621 - Dream Gallery Plugin
The dream gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the 'dreampluginsmain' AJAX action. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Dream Gallery
CVE-2025-13621
Risk Score