VYPR
← WordPress

Vendor CVEs

WordPress

All CVEs

40,119 total · sorted by risk
  • CVE-2025-60130MedSep 26, 2025
    WordPress
    WEDOS Global
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in wedos.com WEDOS Global wgpwpp allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WEDOS Global: from n/a through <= 1.2.2.

  • CVE-2025-60129MedSep 26, 2025
    Yext
    Yext
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in Yext Yext yext allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Yext: from n/a through <= 1.1.3.

  • CVE-2025-60125MedSep 26, 2025
    WordPress
    FoodBook
    risk 0.34cvss 5.3epss 0.00

    Insertion of Sensitive Information Into Sent Data vulnerability in themelooks FoodBook foodbook allows Retrieve Embedded Sensitive Data.This issue affects FoodBook: from n/a through <= 4.7.6.

  • CVE-2025-60121MedSep 26, 2025
    WordPress
    WooEvents
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in Ex-Themes WooEvents woo-events allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooEvents: from n/a through <= 4.1.7.

  • CVE-2025-60120MedSep 26, 2025
    WordPress
    Wp Directory Kit
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in WPDirectoryKit WP Directory Kit wpdirectorykit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Directory Kit: from n/a through <= 1.4.0.

  • CVE-2025-60119MedSep 26, 2025
    Coschedule
    coschedule-by-todaymade
    risk 0.34cvss 5.3epss 0.00

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in CoSchedule CoSchedule coschedule-by-todaymade allows Retrieve Embedded Sensitive Data.This issue affects CoSchedule: from n/a through <= 3.3.11.

  • CVE-2025-60100MedSep 26, 2025
    WordPress
    Xstore
    risk 0.34cvss 5.3epss 0.00

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in 8theme XStore xstore allows Code Injection.This issue affects XStore: from n/a through < 9.6.

  • CVE-2025-60092MedSep 26, 2025
    WordPress
    Download Manager
    risk 0.34cvss 5.3epss 0.00

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Shahjada Download Manager download-manager allows Retrieve Embedded Sensitive Data.This issue affects Download Manager: from n/a through <= 3.3.25.

  • CVE-2025-58919MedSep 26, 2025
    WordPress
    Wide Banner
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in guihom Wide Banner wide-banner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wide Banner: from n/a through <= 1.0.4.

  • CVE-2025-9984MedSep 26, 2025
    WordPress
    Featured Image From URL
    risk 0.34cvss 5.3epss 0.00

    The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the fifu_api_debug_posts() function in all versions up to, and including, 5.2.7. This makes it possible for unauthenticated attackers to read…

  • CVE-2025-10745MedSep 26, 2025
    WordPress
    The Banhammer
    risk 0.34cvss 5.3epss 0.00

    The Banhammer – Monitor Site Traffic, Block Bad Users and Bots plugin for WordPress is vulnerable to Blocking Bypass in all versions up to, and including, 3.4.8. This is due to a site-wide “secret key” being deterministically generated from a constant character set using…

  • CVE-2025-59573MedSep 22, 2025
    WordPress
    Cozy Blocks
    risk 0.34cvss 5.3epss 0.00

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in CozyThemes Cozy Blocks cozy-addons allows Code Injection.This issue affects Cozy Blocks: from n/a through <= 2.1.29.

  • CVE-2025-58969MedSep 22, 2025
    WordPress
    Custom Login URL
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in Greg Winiarski Custom Login URL custom-login-url allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Login URL: from n/a through <= 1.0.2.

  • CVE-2025-58685MedSep 22, 2025
    WordPress
    Cecabank Woocommerce
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in cecabank Cecabank WooCommerce Plugin cecabank-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cecabank WooCommerce Plugin: from n/a through <= 0.3.4.

  • CVE-2025-58681MedSep 22, 2025
    WordPress
    Easy Quotes
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in Jürgen Müller Easy Quotes easy-quotes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Quotes: from n/a through <= 1.2.4.

  • CVE-2025-58679MedSep 22, 2025
    WordPress
    Appmysite
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in AppMySite AppMySite appmysite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AppMySite: from n/a through <= 3.15.0.

  • CVE-2025-58659MedSep 22, 2025
    WordPress
    Helpie Faq
    risk 0.34cvss 5.3epss 0.00

    Use of Hard-coded Credentials vulnerability in Essekia Helpie FAQ helpie-faq allows Retrieve Embedded Sensitive Data.This issue affects Helpie FAQ: from n/a through <= 1.45.

  • CVE-2025-58656MedSep 22, 2025
    WordPress
    Estonian Shipping Methods For Woocommerce
    risk 0.34cvss 5.3epss 0.00

    Use of Hard-coded Credentials vulnerability in Risto Niinemets Estonian Shipping Methods for WooCommerce estonian-shipping-methods-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Estonian Shipping Methods for WooCommerce: from n/a through <= 1.7.2.

  • CVE-2025-58269MedSep 22, 2025
    WordPress
    Wp Project Manager
    risk 0.34cvss 5.3epss 0.00

    Use of Hard-coded Credentials vulnerability in weDevs WP Project Manager wedevs-project-manager allows Retrieve Embedded Sensitive Data.This issue affects WP Project Manager: from n/a through <= 2.6.25.

  • CVE-2025-58247MedSep 22, 2025
    WordPress
    Ti Woocommerce Wishlist
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TI WooCommerce Wishlist: from n/a through <= 2.10.0.

  • CVE-2025-58222MedSep 22, 2025
    WordPress
    Wp Team Manager
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in Dynamic Web Lab Team Manager wp-team-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team Manager: from n/a through 2.6.8.

  • CVE-2025-58029MedSep 22, 2025
    WordPress
    Classic Widgets With Block Based Widgets
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in Sumit Singh Classic Widgets with Block-based Widgets classic-widgets-with-block-based-widgets allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Classic Widgets with Block-based Widgets: from n/a through <=…

  • CVE-2025-58015MedSep 22, 2025
    Ays Pro
    Quiz Maker
    risk 0.34cvss 5.3epss 0.00

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Ays Pro Quiz Maker quiz-maker allows Retrieve Embedded Sensitive Data.This issue affects Quiz Maker: from n/a through <= 6.7.0.65.

  • CVE-2025-58004MedSep 22, 2025
    Smartdatasoft
    dricub-driving-school
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in SmartDataSoft DriCub dricub-driving-school allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DriCub: from n/a through <= 2.9.

  • CVE-2025-58003MedSep 22, 2025
    WordPress
    Javo Core
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in javothemes Javo Core javo-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Javo Core: from n/a through <= 3.0.0.266.

  • CVE-2025-58000MedSep 22, 2025
    WordPress
    Memberful - Membership Plugin
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in memberful Memberful - Membership Plugin memberful-wp allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Memberful - Membership Plugin: from n/a through <= 1.75.0.

  • CVE-2025-57987MedSep 22, 2025
    WordPress
    Wp Event Manager
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in ThimPress WP Events Manager wp-events-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Events Manager: from n/a through <= 2.2.1.

  • CVE-2025-57976MedSep 22, 2025
    WordPress
    CardCom Payment Gateway
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in CardCom CardCom Payment Gateway woo-cardcom-payment-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CardCom Payment Gateway: from n/a through <= 3.5.0.7.

  • CVE-2025-57971MedSep 22, 2025
    Salesmanago
    Salesmanago
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in SALESmanago SALESmanago & Leadoo salesmanago allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SALESmanago & Leadoo: from n/a through <= 3.8.1.

  • CVE-2025-57957MedSep 22, 2025
    WordPress
    Wooms
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in wpcraft WooMS wooms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooMS: from n/a through <= 9.12.

  • CVE-2025-57944MedSep 22, 2025
    WordPress
    Skimlinks Affiliate Marketing Tool
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in Skimlinks Skimlinks Affiliate Marketing Tool skimlinks allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Skimlinks Affiliate Marketing Tool: from n/a through <= 1.3.

  • CVE-2025-57939MedSep 22, 2025
    WordPress
    Image Hover Effects Elementor Addon
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in Blocksera Image Hover Effects – Elementor Addon image-hover-effects-addon-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Hover Effects – Elementor Addon: from n/a through…

  • CVE-2025-57928MedSep 22, 2025
    WordPress
    AWP Classifieds
    risk 0.34cvss 5.3epss 0.00

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Strategy11 Team AWP Classifieds another-wordpress-classifieds-plugin allows Code Injection.This issue affects AWP Classifieds: from n/a through <= 4.4.3.

  • CVE-2025-57923MedSep 22, 2025
    WordPress
    uk-address-postcode-validation
    risk 0.34cvss 5.3epss 0.00

    Insertion of Sensitive Information Into Sent Data vulnerability in Ideal Postcodes UK Address Postcode Validation uk-address-postcode-validation allows Retrieve Embedded Sensitive Data.This issue affects UK Address Postcode Validation: from n/a through <= 3.9.2.

  • CVE-2025-57922MedSep 22, 2025
    WordPress
    Envíos Coordinadora Woocommerce
    risk 0.34cvss 5.3epss 0.00

    Insertion of Sensitive Information Into Sent Data vulnerability in Coordinadora Mercantil S.A. Envíos Coordinadora Woocommerce coordinadora allows Retrieve Embedded Sensitive Data.This issue affects Envíos Coordinadora Woocommerce: from n/a through <= 1.1.32.

  • CVE-2025-57921MedSep 22, 2025
    N-Media
    Frontend File Manager
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in N-Media Frontend File Manager nmedia-user-file-uploader allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Frontend File Manager: from n/a through <= 23.3.

  • CVE-2025-57907MedSep 22, 2025
    Heureka
    Heureka
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in Heureka Group Heureka heureka allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Heureka: from n/a through <= 1.1.0.

  • CVE-2025-57899MedSep 22, 2025
    WordPress
    Wp Compress
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Compress: from n/a through <= 6.50.54.

  • CVE-2025-10305MedSep 20, 2025
    WordPress
    Secure Passkeys
    risk 0.34cvss 5.3epss 0.00

    The Secure Passkeys plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the delete_passkey() and passkeys_list() function in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with…

  • CVE-2025-8999MedSep 17, 2025
    WordPress
    Sydney
    risk 0.34cvss 5.3epss 0.00

    The Sydney theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'activate_modules' function in all versions up to, and including, 2.56. This makes it possible for authenticated attackers, with Subscriber-level access and…

  • CVE-2025-9617MedSep 11, 2025
    WordPress
    Publish approval
    risk 0.34cvss 5.3epss 0.00

    The Publish approval plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the publish_save_option function. This makes it possible for unauthenticated attackers to…

  • CVE-2025-58980MedSep 9, 2025
    WordPress
    Export Wp Page To Static HTML
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in recorp Export WP Page to Static HTML/CSS export-wp-page-to-static-html allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Export WP Page to Static HTML/CSS: from n/a through <= 4.1.0.

  • CVE-2025-58979MedSep 9, 2025
    WordPress
    BerqWP searchpro
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in BerqWP BerqWP searchpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BerqWP: from n/a through <= 2.2.53.

  • CVE-2025-58978MedSep 9, 2025
    WordPress
    PDF Generator For Wordpress
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in WP Swings PDF Generator for WordPress pdf-generator-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF Generator for WordPress: from n/a through <= 1.5.4.

  • CVE-2025-53348MedSep 9, 2025
    WordPress
    Kalium
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in Laborator Kalium kalium allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kalium: from n/a through <= 3.18.3.

  • CVE-2025-53340MedSep 9, 2025
    WordPress
    Awesome Support
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in awesomesupport Awesome Support awesome-support allows Retrieve Embedded Sensitive Data.This issue affects Awesome Support: from n/a through <= 6.3.6.

  • CVE-2025-49860MedSep 9, 2025
    WordPress
    Majestic Support
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in Majestic Support Majestic Support majestic-support.This issue affects Majestic Support: from n/a through <= 1.1.0.

  • CVE-2025-7368MedSep 6, 2025
    WordPress
    REHub - Price Comparison, Multi Vendor Marketplace Wordpress Theme
    risk 0.34cvss 5.3epss 0.00

    The REHub - Price Comparison, Multi Vendor Marketplace Wordpress Theme theme for WordPress is vulnerable to Information Exposure in all versions up to, and including, 19.9.7 via the 'ajax_action_re_getfullcontent' function due to insufficient restrictions on which posts can be…

  • CVE-2025-58797MedSep 5, 2025
    WordPress
    Ninja Charts
    risk 0.34cvss 5.3epss 0.00

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Mahmudul Hasan Arif Ninja Charts ninja-charts allows Retrieve Embedded Sensitive Data.This issue affects Ninja Charts: from n/a through <= 3.3.5.

  • CVE-2025-9616MedSep 4, 2025
    WordPress
    Popad
    risk 0.34cvss 5.3epss 0.00

    The PopAd plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is due to missing or incorrect nonce validation on the PopAd_reset_cookie_time function. This makes it possible for unauthenticated attackers to reset…

Page 586 of 803