Vendor CVEs

WordPress

All CVEs

39,914 total · sorted by risk

CVE	Vendor / Product	Sev	Risk	CVSS	Published	Description
CVE-2025-5932	WordPress Homerunner	Med	0.28	4.3	Jun 26, 2025	The Homerunner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.30. This is due to missing or incorrect nonce validation on the main_settings() function. This makes it possible for unauthenticated attackers to update…
CVE-2025-3863	WordPress Post Carousel Slider For Elementor	Med	0.28	4.3	Jun 26, 2025	The Post Carousel Slider for Elementor plugin for WordPress is vulnerable to improper authorization due to a missing capability check on the process_wbelps_promo_form() function in all versions up to, and including, 1.6.0. This makes it possible for authenticated attackers, with…
CVE-2025-52719	Metagauss Profilegrid	Med	0.28	4.3	Jun 20, 2025	Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Retrieve Embedded Sensitive Data.This issue affects ProfileGrid : from n/a through <= 5.9.5.2.
CVE-2025-52711	Boldgrid Post And Page Builder	Med	0.28	4.3	Jun 20, 2025	Cross-Site Request Forgery (CSRF) vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Cross Site Request Forgery.This issue affects Post and Page Builder by BoldGrid: from n/a through <= 1.27.8.
CVE-2025-49982	WordPress Wp Customer Area	Med	0.28	4.3	Jun 20, 2025	Missing Authorization vulnerability in aguilatechnologies WP Customer Area customer-area allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Customer Area: from n/a through <= 8.3.4.
CVE-2025-49981	Mahabub81 User Roles and Capabilities	Med	0.28	4.3	Jun 20, 2025	Missing Authorization vulnerability in mahabub81 User Roles and Capabilities user-roles-and-capabilities allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Roles and Capabilities: from n/a through <= 1.2.6.
CVE-2025-49980	WordPress Wp User Profile Avatar	Med	0.28	4.3	Jun 20, 2025	Missing Authorization vulnerability in WP Event Manager WP User Profile Avatar wp-user-profile-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Profile Avatar: from n/a through <= 1.0.6.
CVE-2025-49979	WordPress Media Hygiene	Med	0.28	4.3	Jun 20, 2025	Missing Authorization vulnerability in slui Media Hygiene media-hygiene allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Media Hygiene: from n/a through <= 4.0.1.
CVE-2025-49978	WordPress Wp Jobsearch	Med	0.28	4.3	Jun 20, 2025	Authorization Bypass Through User-Controlled Key vulnerability in eyecix JobSearch wp-jobsearch allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JobSearch: from n/a through < 3.0.6.
CVE-2025-49977	WordPress Wp Inventory Manager	Med	0.28	4.3	Jun 20, 2025	Cross-Site Request Forgery (CSRF) vulnerability in WP Inventory WP Inventory Manager wp-inventory-manager allows Cross Site Request Forgery.This issue affects WP Inventory Manager: from n/a through <= 2.3.4.
CVE-2025-49975	WordPress Jobwp	Med	0.28	4.3	Jun 20, 2025	Cross-Site Request Forgery (CSRF) vulnerability in Hossni Mubarak JobWP jobwp allows Cross Site Request Forgery.This issue affects JobWP: from n/a through <= 2.4.0.
CVE-2025-49974	WordPress UpStream	Med	0.28	4.3	Jun 20, 2025	Missing Authorization vulnerability in upstreamplugin UpStream: a Project Management Plugin for WordPress upstream allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UpStream: a Project Management Plugin for WordPress: from n/a through <=…
CVE-2025-49973	WordPress Image Sizes Controller	Med	0.28	4.3	Jun 20, 2025	Missing Authorization vulnerability in GrandPlugins Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes image-sizes-controller allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Sizes Controller, Create Custom…
CVE-2025-49972	WordPress Tm Replace Howdy	Med	0.28	4.3	Jun 20, 2025	Cross-Site Request Forgery (CSRF) vulnerability in David Wood TM Replace Howdy tm-replace-howdy allows Cross Site Request Forgery.This issue affects TM Replace Howdy: from n/a through <= 1.4.2.
CVE-2025-49971	WordPress Eds Responsive Menu	Med	0.28	4.3	Jun 20, 2025	Missing Authorization vulnerability in aThemeArt Translations eDS Responsive Menu eds-responsive-menu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eDS Responsive Menu: from n/a through <= 1.2.
CVE-2025-49970	WordPress Hello FSE Blog	Med	0.28	4.3	Jun 20, 2025	Missing Authorization vulnerability in sparklewpthemes Hello FSE Blog hello-fse-blog allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hello FSE Blog: from n/a through <= 1.0.6.
CVE-2025-49969	Zara 4 Zara 4 Image Compression	Med	0.28	4.3	Jun 20, 2025	Missing Authorization vulnerability in Zara 4 Zara 4 Image Compression zara-4 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zara 4 Image Compression: from n/a through <= 1.2.17.2.
CVE-2025-49968	WordPress XML Travel Portal Widget	Med	0.28	4.3	Jun 20, 2025	Cross-Site Request Forgery (CSRF) vulnerability in Oganro XML Travel Portal Widget oganro-reservation-widget allows Cross Site Request Forgery.This issue affects XML Travel Portal Widget: from n/a through <= 2.0.
CVE-2025-49967	WordPress Live Sports Streamthunder	Med	0.28	4.3	Jun 20, 2025	Cross-Site Request Forgery (CSRF) vulnerability in marcusjansen Live Sports Streamthunder live-sports-streamthunder allows Cross Site Request Forgery.This issue affects Live Sports Streamthunder: from n/a through <= 2.1.
CVE-2025-49966	WordPress Oganro Travel Portal Search Widget For Hotelbeds Apitude API	Med	0.28	4.3	Jun 20, 2025	Cross-Site Request Forgery (CSRF) vulnerability in Oganro Oganro Travel Portal Search Widget for HotelBeds APITUDE API oganro-travel-portal-search-widget-for-hotelbeds-apitude-api allows Cross Site Request Forgery.This issue affects Oganro Travel Portal Search Widget for…
CVE-2025-49965	WordPress Pixelbeds Channel Manager Booking Engine	Med	0.28	4.3	Jun 20, 2025	Cross-Site Request Forgery (CSRF) vulnerability in Oganro PixelBeds Channel Manager and Hotel Booking Engine pixelbeds-channel-manager-booking-engine allows Cross Site Request Forgery.This issue affects PixelBeds Channel Manager and Hotel Booking Engine: from n/a through <= 1.0.
CVE-2025-49964	WordPress Cliplink	Med	0.28	4.3	Jun 20, 2025	Cross-Site Request Forgery (CSRF) vulnerability in indgeek ClipLink cliplink allows Cross Site Request Forgery.This issue affects ClipLink: from n/a through <= 1.1.
CVE-2025-4571	Givewp Givewp	Med	0.28	5.4	Jun 19, 2025	The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized view and modification of data due to an insufficient capability check on the permissionsCheck functions in all versions up to, and including, 4.3.0. This makes it possible…
CVE-2025-23999	WordPress Breeze	Med	0.28	4.3	Jun 18, 2025	Missing Authorization vulnerability in Cloudways Breeze breeze allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breeze: from n/a through <= 2.2.13.
CVE-2025-49880	WordPress Cubewp Forms	Med	0.28	4.3	Jun 17, 2025	Missing Authorization vulnerability in Imran Tauqeer CubeWP Forms cubewp-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CubeWP Forms: from n/a through <= 1.1.5.
CVE-2025-49874	WordPress Arconix Faq	Med	0.28	4.3	Jun 17, 2025	Missing Authorization vulnerability in tychesoftwares Arconix FAQ arconix-faq allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Arconix FAQ: from n/a through <= 1.9.6.
CVE-2025-49865	Helmut Wandl Advanced Settings	Med	0.28	4.3	Jun 17, 2025	Cross-Site Request Forgery (CSRF) vulnerability in Helmut Wandl Advanced Settings advanced-settings allows Cross Site Request Forgery.This issue affects Advanced Settings: from n/a through <= 3.0.1.
CVE-2025-49857	WordPress Mycred	Med	0.28	4.3	Jun 17, 2025	Missing Authorization vulnerability in Saad Iqbal myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through <= 2.9.4.2.
CVE-2025-49856	WordPress Responsive Plus	Med	0.28	4.3	Jun 17, 2025	Cross-Site Request Forgery (CSRF) vulnerability in CyberChimps Responsive Plus responsive-add-ons allows Cross Site Request Forgery.This issue affects Responsive Plus: from n/a through <= 3.2.2.
CVE-2025-48111	Yithemes YITH PayPal Express Checkout for WooCommerce	Med	0.28	4.3	Jun 17, 2025	Cross-Site Request Forgery (CSRF) vulnerability in YITHEMES YITH PayPal Express Checkout for WooCommerce allows Cross Site Request Forgery. This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.49.0.
CVE-2025-6062	WordPress Yougler Blogger Profile Page	Med	0.28	4.3	Jun 14, 2025	The Yougler Blogger Profile Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, v1.01. This is due to missing or incorrect nonce validation on the 'yougler-plugin.php' page. This makes it possible for unauthenticated…
CVE-2025-4592	WordPress AI Image Lab	Med	0.28	4.3	Jun 14, 2025	The AI Image Lab – Free AI Image Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is due to missing or incorrect nonce validation on the 'wpz-ai-images' page. This makes it possible for unauthenticated…
CVE-2025-5928	WordPress Wp Sliding Logindashboard Panel	Med	0.28	4.3	Jun 13, 2025	The WP Sliding Login/Dashboard Panel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing or incorrect nonce validation on the wp_sliding_panel_user_options() function. This makes it possible for…
CVE-2025-49510	WordPress Min Max Step Quantity Limits Manager for WooCommerce	Med	0.28	4.3	Jun 10, 2025	Cross-Site Request Forgery (CSRF) vulnerability in WPFactory Min Max Step Quantity Limits Manager for WooCommerce product-quantity-for-woocommerce allows Cross Site Request Forgery.This issue affects Min Max Step Quantity Limits Manager for WooCommerce: from n/a through <= 5.1.0.
CVE-2025-5925	WordPress Bunnys Print CSS	Med	0.28	4.3	Jun 10, 2025	The Bunny’s Print CSS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.95. This is due to missing or incorrect nonce validation on the pcss_options_subpanel() function. This makes it possible for unauthenticated attackers…
CVE-2025-49449	WordPress Interactive Regional Map of Africa	Med	0.28	4.3	Jun 6, 2025	Cross-Site Request Forgery (CSRF) vulnerability in WP Map Plugins Interactive Regional Map of Africa interactive-map-of-africa allows Cross Site Request Forgery.This issue affects Interactive Regional Map of Africa: from n/a through <= 1.0.
CVE-2025-49446	WordPress Admin Notes	Med	0.28	4.3	Jun 6, 2025	Cross-Site Request Forgery (CSRF) vulnerability in minhlaobao Admin Notes admin-note allows Cross Site Request Forgery.This issue affects Admin Notes: from n/a through <= 1.1.
CVE-2025-49445	WordPress Interactive Uk Regional Map	Med	0.28	4.3	Jun 6, 2025	Cross-Site Request Forgery (CSRF) vulnerability in WP Map Plugins Interactive UK Regional Map interactive-uk-regional-map allows Cross Site Request Forgery.This issue affects Interactive UK Regional Map: from n/a through <= 2.0.
CVE-2025-49440	WordPress WP Security Master	Med	0.28	4.3	Jun 6, 2025	Cross-Site Request Forgery (CSRF) vulnerability in Vuong Nguyen WP Security Master wp-security-master allows Cross Site Request Forgery.This issue affects WP Security Master: from n/a through <= 1.0.2.
CVE-2025-49439	mariusz88atelierweb Atelier Create CV	Med	0.28	4.3	Jun 6, 2025	Cross-Site Request Forgery (CSRF) vulnerability in mariusz88atelierweb Atelier Create CV atelier-create-cv allows Cross Site Request Forgery.This issue affects Atelier Create CV: from n/a through <= 1.1.5.
CVE-2025-49435	WordPress Wp Easy Allopass	Med	0.28	4.3	Jun 6, 2025	Cross-Site Request Forgery (CSRF) vulnerability in Hasina77 Wp Easy Allopass wordpress-easy-allopass allows Cross Site Request Forgery.This issue affects Wp Easy Allopass: from n/a through <= 4.1.1.
CVE-2025-49332	WordPress Wp Time Slots Booking Form	Med	0.28	4.3	Jun 6, 2025	Cross-Site Request Forgery (CSRF) vulnerability in codepeople WP Time Slots Booking Form wp-time-slots-booking-form allows Cross Site Request Forgery.This issue affects WP Time Slots Booking Form: from n/a through <= 1.2.30.
CVE-2025-49317	WordPress WP Page Loading	Med	0.28	4.3	Jun 6, 2025	Cross-Site Request Forgery (CSRF) vulnerability in NTC WP Page Loading wp-page-loading allows Cross Site Request Forgery.This issue affects WP Page Loading: from n/a through <= 1.0.6.
CVE-2025-49293	WordPress Crawlomatic Multipage Scraper Post Generator	Med	0.28	4.3	Jun 6, 2025	Missing Authorization vulnerability in CodeRevolution Crawlomatic Multisite Scraper Post Generator crawlomatic-multipage-scraper-post-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Crawlomatic Multisite Scraper Post…
CVE-2025-49292	WordPress Profile Builder	Med	0.28	4.3	Jun 6, 2025	Improper Validation of Specified Quantity in Input vulnerability in Cozmoslabs Profile Builder profile-builder allows Phishing.This issue affects Profile Builder: from n/a through <= 3.13.8.
CVE-2025-49291	Codepeople Calculated Fields Form	Med	0.28	4.3	Jun 6, 2025	Cross-Site Request Forgery (CSRF) vulnerability in codepeople Calculated Fields Form calculated-fields-form allows Cross Site Request Forgery.This issue affects Calculated Fields Form: from n/a through <= 5.3.58.
CVE-2025-49287	WordPress Webtoffee Product Feed	Med	0.28	4.3	Jun 6, 2025	Missing Authorization vulnerability in WebToffee Product Feed for WooCommerce webtoffee-product-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Feed for WooCommerce: from n/a through <= 2.2.8.
CVE-2025-49286	WordPress Wp Table Builder	Med	0.28	4.3	Jun 6, 2025	Cross-Site Request Forgery (CSRF) vulnerability in WP Table Builder WP Table Builder wp-table-builder allows Cross Site Request Forgery.This issue affects WP Table Builder: from n/a through <= 2.0.6.
CVE-2025-49285	WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent	Med	0.28	4.3	Jun 6, 2025	Cross-Site Request Forgery (CSRF) vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent gdpr-cookie-consent allows Cross Site Request Forgery.This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through <= 3.8.0.
CVE-2025-49284	WordPress WP Maintenance Mode & Site Under Construction	Med	0.28	4.3	Jun 6, 2025	Cross-Site Request Forgery (CSRF) vulnerability in wp-buy WP Maintenance Mode & Site Under Construction wp-maintenance-mode-site-under-construction allows Cross Site Request Forgery.This issue affects WP Maintenance Mode & Site Under Construction: from n/a through <= 4.3.

CVE-2025-5932MedJun 26, 2025
WordPress
Homerunner
risk 0.28cvss 4.3epss 0.00
The Homerunner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.30. This is due to missing or incorrect nonce validation on the main_settings() function. This makes it possible for unauthenticated attackers to update…
CVE-2025-3863MedJun 26, 2025
WordPress
Post Carousel Slider For Elementor
risk 0.28cvss 4.3epss 0.00
The Post Carousel Slider for Elementor plugin for WordPress is vulnerable to improper authorization due to a missing capability check on the process_wbelps_promo_form() function in all versions up to, and including, 1.6.0. This makes it possible for authenticated attackers, with…
CVE-2025-52719MedJun 20, 2025
Metagauss
Profilegrid
risk 0.28cvss 4.3epss 0.00
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Retrieve Embedded Sensitive Data.This issue affects ProfileGrid : from n/a through <= 5.9.5.2.
CVE-2025-52711MedJun 20, 2025
Boldgrid
Post And Page Builder
risk 0.28cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Cross Site Request Forgery.This issue affects Post and Page Builder by BoldGrid: from n/a through <= 1.27.8.
CVE-2025-49982MedJun 20, 2025
WordPress
Wp Customer Area
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in aguilatechnologies WP Customer Area customer-area allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Customer Area: from n/a through <= 8.3.4.
CVE-2025-49981MedJun 20, 2025
Mahabub81
User Roles and Capabilities
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in mahabub81 User Roles and Capabilities user-roles-and-capabilities allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Roles and Capabilities: from n/a through <= 1.2.6.
CVE-2025-49980MedJun 20, 2025
WordPress
Wp User Profile Avatar
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in WP Event Manager WP User Profile Avatar wp-user-profile-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Profile Avatar: from n/a through <= 1.0.6.
CVE-2025-49979MedJun 20, 2025
WordPress
Media Hygiene
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in slui Media Hygiene media-hygiene allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Media Hygiene: from n/a through <= 4.0.1.
CVE-2025-49978MedJun 20, 2025
WordPress
Wp Jobsearch
risk 0.28cvss 4.3epss 0.00
Authorization Bypass Through User-Controlled Key vulnerability in eyecix JobSearch wp-jobsearch allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JobSearch: from n/a through < 3.0.6.
CVE-2025-49977MedJun 20, 2025
WordPress
Wp Inventory Manager
risk 0.28cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in WP Inventory WP Inventory Manager wp-inventory-manager allows Cross Site Request Forgery.This issue affects WP Inventory Manager: from n/a through <= 2.3.4.
CVE-2025-49975MedJun 20, 2025
WordPress
Jobwp
risk 0.28cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Hossni Mubarak JobWP jobwp allows Cross Site Request Forgery.This issue affects JobWP: from n/a through <= 2.4.0.
CVE-2025-49974MedJun 20, 2025
WordPress
UpStream
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in upstreamplugin UpStream: a Project Management Plugin for WordPress upstream allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UpStream: a Project Management Plugin for WordPress: from n/a through <=…
CVE-2025-49973MedJun 20, 2025
WordPress
Image Sizes Controller
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in GrandPlugins Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes image-sizes-controller allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Sizes Controller, Create Custom…
CVE-2025-49972MedJun 20, 2025
WordPress
Tm Replace Howdy
risk 0.28cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in David Wood TM Replace Howdy tm-replace-howdy allows Cross Site Request Forgery.This issue affects TM Replace Howdy: from n/a through <= 1.4.2.
CVE-2025-49971MedJun 20, 2025
WordPress
Eds Responsive Menu
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in aThemeArt Translations eDS Responsive Menu eds-responsive-menu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eDS Responsive Menu: from n/a through <= 1.2.
CVE-2025-49970MedJun 20, 2025
WordPress
Hello FSE Blog
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in sparklewpthemes Hello FSE Blog hello-fse-blog allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hello FSE Blog: from n/a through <= 1.0.6.
CVE-2025-49969MedJun 20, 2025
Zara 4
Zara 4 Image Compression
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in Zara 4 Zara 4 Image Compression zara-4 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zara 4 Image Compression: from n/a through <= 1.2.17.2.
CVE-2025-49968MedJun 20, 2025
WordPress
XML Travel Portal Widget
risk 0.28cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Oganro XML Travel Portal Widget oganro-reservation-widget allows Cross Site Request Forgery.This issue affects XML Travel Portal Widget: from n/a through <= 2.0.
CVE-2025-49967MedJun 20, 2025
WordPress
Live Sports Streamthunder
risk 0.28cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in marcusjansen Live Sports Streamthunder live-sports-streamthunder allows Cross Site Request Forgery.This issue affects Live Sports Streamthunder: from n/a through <= 2.1.
CVE-2025-49966MedJun 20, 2025
WordPress
Oganro Travel Portal Search Widget For Hotelbeds Apitude API
risk 0.28cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Oganro Oganro Travel Portal Search Widget for HotelBeds APITUDE API oganro-travel-portal-search-widget-for-hotelbeds-apitude-api allows Cross Site Request Forgery.This issue affects Oganro Travel Portal Search Widget for…
CVE-2025-49965MedJun 20, 2025
WordPress
Pixelbeds Channel Manager Booking Engine
risk 0.28cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Oganro PixelBeds Channel Manager and Hotel Booking Engine pixelbeds-channel-manager-booking-engine allows Cross Site Request Forgery.This issue affects PixelBeds Channel Manager and Hotel Booking Engine: from n/a through <= 1.0.
CVE-2025-49964MedJun 20, 2025
WordPress
Cliplink
risk 0.28cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in indgeek ClipLink cliplink allows Cross Site Request Forgery.This issue affects ClipLink: from n/a through <= 1.1.
CVE-2025-4571MedJun 19, 2025
Givewp
Givewp
risk 0.28cvss 5.4epss 0.00
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized view and modification of data due to an insufficient capability check on the permissionsCheck functions in all versions up to, and including, 4.3.0. This makes it possible…
CVE-2025-23999MedJun 18, 2025
WordPress
Breeze
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in Cloudways Breeze breeze allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breeze: from n/a through <= 2.2.13.
CVE-2025-49880MedJun 17, 2025
WordPress
Cubewp Forms
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in Imran Tauqeer CubeWP Forms cubewp-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CubeWP Forms: from n/a through <= 1.1.5.
CVE-2025-49874MedJun 17, 2025
WordPress
Arconix Faq
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in tychesoftwares Arconix FAQ arconix-faq allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Arconix FAQ: from n/a through <= 1.9.6.
CVE-2025-49865MedJun 17, 2025
Helmut Wandl
Advanced Settings
risk 0.28cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Helmut Wandl Advanced Settings advanced-settings allows Cross Site Request Forgery.This issue affects Advanced Settings: from n/a through <= 3.0.1.
CVE-2025-49857MedJun 17, 2025
WordPress
Mycred
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in Saad Iqbal myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through <= 2.9.4.2.
CVE-2025-49856MedJun 17, 2025
WordPress
Responsive Plus
risk 0.28cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in CyberChimps Responsive Plus responsive-add-ons allows Cross Site Request Forgery.This issue affects Responsive Plus: from n/a through <= 3.2.2.
CVE-2025-48111MedJun 17, 2025
Yithemes
YITH PayPal Express Checkout for WooCommerce
risk 0.28cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in YITHEMES YITH PayPal Express Checkout for WooCommerce allows Cross Site Request Forgery. This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.49.0.
CVE-2025-6062MedJun 14, 2025
WordPress
Yougler Blogger Profile Page
risk 0.28cvss 4.3epss 0.00
The Yougler Blogger Profile Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, v1.01. This is due to missing or incorrect nonce validation on the 'yougler-plugin.php' page. This makes it possible for unauthenticated…
CVE-2025-4592MedJun 14, 2025
WordPress
AI Image Lab
risk 0.28cvss 4.3epss 0.00
The AI Image Lab – Free AI Image Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is due to missing or incorrect nonce validation on the 'wpz-ai-images' page. This makes it possible for unauthenticated…
CVE-2025-5928MedJun 13, 2025
WordPress
Wp Sliding Logindashboard Panel
risk 0.28cvss 4.3epss 0.00
The WP Sliding Login/Dashboard Panel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing or incorrect nonce validation on the wp_sliding_panel_user_options() function. This makes it possible for…
CVE-2025-49510MedJun 10, 2025
WordPress
Min Max Step Quantity Limits Manager for WooCommerce
risk 0.28cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in WPFactory Min Max Step Quantity Limits Manager for WooCommerce product-quantity-for-woocommerce allows Cross Site Request Forgery.This issue affects Min Max Step Quantity Limits Manager for WooCommerce: from n/a through <= 5.1.0.
CVE-2025-5925MedJun 10, 2025
WordPress
Bunnys Print CSS
risk 0.28cvss 4.3epss 0.00
The Bunny’s Print CSS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.95. This is due to missing or incorrect nonce validation on the pcss_options_subpanel() function. This makes it possible for unauthenticated attackers…
CVE-2025-49449MedJun 6, 2025
WordPress
Interactive Regional Map of Africa
risk 0.28cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in WP Map Plugins Interactive Regional Map of Africa interactive-map-of-africa allows Cross Site Request Forgery.This issue affects Interactive Regional Map of Africa: from n/a through <= 1.0.
CVE-2025-49446MedJun 6, 2025
WordPress
Admin Notes
risk 0.28cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in minhlaobao Admin Notes admin-note allows Cross Site Request Forgery.This issue affects Admin Notes: from n/a through <= 1.1.
CVE-2025-49445MedJun 6, 2025
WordPress
Interactive Uk Regional Map
risk 0.28cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in WP Map Plugins Interactive UK Regional Map interactive-uk-regional-map allows Cross Site Request Forgery.This issue affects Interactive UK Regional Map: from n/a through <= 2.0.
CVE-2025-49440MedJun 6, 2025
WordPress
WP Security Master
risk 0.28cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Vuong Nguyen WP Security Master wp-security-master allows Cross Site Request Forgery.This issue affects WP Security Master: from n/a through <= 1.0.2.
CVE-2025-49439MedJun 6, 2025
mariusz88atelierweb
Atelier Create CV
risk 0.28cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in mariusz88atelierweb Atelier Create CV atelier-create-cv allows Cross Site Request Forgery.This issue affects Atelier Create CV: from n/a through <= 1.1.5.
CVE-2025-49435MedJun 6, 2025
WordPress
Wp Easy Allopass
risk 0.28cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Hasina77 Wp Easy Allopass wordpress-easy-allopass allows Cross Site Request Forgery.This issue affects Wp Easy Allopass: from n/a through <= 4.1.1.
CVE-2025-49332MedJun 6, 2025
WordPress
Wp Time Slots Booking Form
risk 0.28cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in codepeople WP Time Slots Booking Form wp-time-slots-booking-form allows Cross Site Request Forgery.This issue affects WP Time Slots Booking Form: from n/a through <= 1.2.30.
CVE-2025-49317MedJun 6, 2025
WordPress
WP Page Loading
risk 0.28cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in NTC WP Page Loading wp-page-loading allows Cross Site Request Forgery.This issue affects WP Page Loading: from n/a through <= 1.0.6.
CVE-2025-49293MedJun 6, 2025
WordPress
Crawlomatic Multipage Scraper Post Generator
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in CodeRevolution Crawlomatic Multisite Scraper Post Generator crawlomatic-multipage-scraper-post-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Crawlomatic Multisite Scraper Post…
CVE-2025-49292MedJun 6, 2025
WordPress
Profile Builder
risk 0.28cvss 4.3epss 0.00
Improper Validation of Specified Quantity in Input vulnerability in Cozmoslabs Profile Builder profile-builder allows Phishing.This issue affects Profile Builder: from n/a through <= 3.13.8.
CVE-2025-49291MedJun 6, 2025
Codepeople
Calculated Fields Form
risk 0.28cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in codepeople Calculated Fields Form calculated-fields-form allows Cross Site Request Forgery.This issue affects Calculated Fields Form: from n/a through <= 5.3.58.
CVE-2025-49287MedJun 6, 2025
WordPress
Webtoffee Product Feed
risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in WebToffee Product Feed for WooCommerce webtoffee-product-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Feed for WooCommerce: from n/a through <= 2.2.8.
CVE-2025-49286MedJun 6, 2025
WordPress
Wp Table Builder
risk 0.28cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in WP Table Builder WP Table Builder wp-table-builder allows Cross Site Request Forgery.This issue affects WP Table Builder: from n/a through <= 2.0.6.
CVE-2025-49285MedJun 6, 2025
WordPress
WP Cookie Notice for GDPR, CCPA & ePrivacy Consent
risk 0.28cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent gdpr-cookie-consent allows Cross Site Request Forgery.This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through <= 3.8.0.
CVE-2025-49284MedJun 6, 2025
WordPress
WP Maintenance Mode & Site Under Construction
risk 0.28cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in wp-buy WP Maintenance Mode & Site Under Construction wp-maintenance-mode-site-under-construction allows Cross Site Request Forgery.This issue affects WP Maintenance Mode & Site Under Construction: from n/a through <= 4.3.

Page 671 of 799