High

CVE-2025-13035

Code Snippets [code-snippets] < 3.9.2

The Code Snippets plugin for WordPress is vulnerable to a PHP code injection attack, affecting all versions up to and including 3.9.1. An a…

Medium

CVE-2025-12814

SiteSEO – SEO Simplified [siteseo] < 1.3.3

A security flaw exists in WordPress plugins of version 1.3.2 and earlier due to a faulty permission check within the siteseo_reset_settings…

Medium

CVE-2025-13085

SiteSEO – SEO Simplified [siteseo] < 1.3.3

The SiteSEO plugin for WordPress contains a flaw in its authorization checks that allows certain users with administrative privileges to ac…

Medium

CVE-2025-13031

WPeMatico RSS Feed Fetcher [wpematico] < 2.8.13

The WPeMatico RSS Feed Fetcher plugin for WordPress contains a security flaw affecting versions up to 2.8.12, which allows attackers with e…

Medium

CVE-2025-12777

YITH WooCommerce Wishlist [yith-woocommerce-wishlist] < 4.10.1

The YITH WooCommerce Wishlist plugin for WordPress contains a security flaw in versions prior to 4.10.1, which allows unauthorized users to…

Medium

CVE-2025-12427

YITH WooCommerce Wishlist [yith-woocommerce-wishlist] <= 4.10.0 (unfixed)

A vulnerability in YITH WooCommerce Wishlist plugin affects all versions up to 4.10.0, allowing unauthorized access to user-controlled keys…

Medium

CVE-2025-13054

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 3.14.9

The User Profile Builder plugin for WordPress contains a security flaw in its wppb-embed shortcode, allowing malicious users with contribut…

Medium

CVE-2025-11427

WP Migrate Lite – Migration Made Easy [wp-migrate-db] < 2.7.7

The WP Migrate Lite plugin for WordPress has a security flaw in versions 2.7.6 and earlier, allowing unauthorized users to secretly trigger…

Medium

CVE-2025-11734

Broken Link Checker by AIOSEO – Find & Fix Broken Internal, External & Video Links [broken-link-checker-seo] < 1.2.6

The Broken Link Checker plugin for WordPress, developed by AIOSEO, contains a flaw in its REST API functionality that permits unauthorized …

Medium

CVE-2025-11267

VK All in One Expansion Unit [vk-all-in-one-expansion-unit] < 9.112.2

A WordPress plugin, VK All in One Expansion Unit, has a security flaw allowing malicious scripts to be embedded into webpage content when c…

Medium

CVE-2025-11265

VK All in One Expansion Unit [vk-all-in-one-expansion-unit] < 9.112.2

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

High

CVE-2025-12974

Gravity Forms [gravityforms] < 2.9.22

The Gravity Forms plugin for WordPress has a security flaw in its legacy chunked upload mechanism that allows unauthenticated attackers to …

High

CVE-2025-12482

Booking for Appointments and Events Calendar – Amelia [ameliabooking] < 1.2.36

The Amelia plugin for WordPress, which manages appointments and events, has a security flaw in its search function. In versions up to 1.2.3…

Medium

CVE-2025-12847

All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) [all-in-one-seo-pack] < 4.9.0

A vulnerability exists in the All in One SEO plugin for WordPress, affecting versions up to 4.8.9. The issue lies in the plugin's REST API …

Medium

CVE-2025-64381

Booking Calendar [booking] < 10.14.8

The Booking Calendar plugin for WordPress contains a security flaw that enables malicious users with contributor-level permissions or highe…

Medium

CVE-2025-64384

JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder] < 3.5.4

A security flaw exists within the JetFormBuilder Dynamic Blocks Form Builder plugin for WordPress, affecting all versions prior to 3.5.4. T…

High

CVE-2025-12844

AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini [ai-engine] < 3.1.9

The AI Engine WordPress plugin has a security flaw in its handling of untrusted input in certain functions. Specifically, versions up to 3.…

High

CVE-2025-12733

WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets [wp-all-import] < 4.0.0

The WP All Import plugin for WordPress contains a security flaw in versions up to 3.9.6 that allows malicious users with administrative pri…

Low

CVE-2025-12954

Timetable and Event Schedule by MotoPress [mp-timetable] < 2.4.16

A vulnerability exists in Timetable and Event Schedule plugin versions prior to 2.4.15 that allows authorized users with contributor privil…

Medium

CVE-2025-12366

Page Builder: Pagelayer – Drag and Drop website builder [pagelayer] < 2.0.6

The Pagelayer plugin for WordPress contains an authentication bypass vulnerability in versions up to 2.0.5, which allows authorized users w…

Medium

CVE-2025-66061

Seriously Simple Podcasting [seriously-simple-podcasting] < 3.14.0

The Seriously Simple Podcasting plugin for WordPress contains a security flaw in versions 3.13.0 and earlier, allowing malicious actors to …

Medium

CVE-2025-66059

Seriously Simple Podcasting [seriously-simple-podcasting] < 3.14.0

A WordPress plugin called Seriously Simple Podcasting has a security flaw that lets unauthorized users access sensitive data embedded withi…

Medium

CVE-2025-66060

Seriously Simple Podcasting [seriously-simple-podcasting] < 3.14.0

A security flaw exists within the Seriously Simple Podcasting plugin for WordPress, affecting all versions prior to 3.14.0, where an essent…

Medium

CVE-2025-12177

Download Manager [download-manager] < 3.3.31

A security flaw exists in WordPress plugins due to a hardcoded Cron key embedded within the deleteExpired and clearTempDataCPCron functions…

Medium

CVE-2025-11972

PublishPress Taxonomies – Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms [simple-tags] < 3.40.1

A WordPress plugin called Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI has a critical security flaw in versions up to 3.…

Medium

CVE-2025-66056

Uncanny Automator – MCP Server + Automation MCP for Claude & ChatGPT [uncanny-automator] < 6.10.0

A security flaw exists within the Uncanny Automator plugin for WordPress, affecting all iterations prior to version 6.10.1. Specifically, t…

Critical

CVE-2025-12352

Gravity Forms [gravityforms] < 2.9.21

A critical security flaw exists in Gravity Forms plugin versions up to 2.9.20, allowing unauthorized access to upload any type of file via …

Medium

CVE-2025-11271

Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads] < 3.5.3

A security flaw exists in Easy Digital Downloads plugin for WordPress, affecting versions up to 3.5.2. The issue arises from an oversight i…

Medium

CVE-2025-11745

Ad Inserter – Ad Manager & AdSense Ads [ad-inserter] < 2.8.8

The Ad Inserter plugin for WordPress contains a security flaw that allows malicious code injection via custom fields within the 'adinserter…

Critical

CVE-2025-11749

AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini [ai-engine] < 3.1.4

The AI Engine plugin for WordPress has a security flaw that allows unauthorized users to obtain sensitive information through its REST API …

High

CVE-2025-12384

Document Embedder – let visitors read files without downloading [document-emberdder] < 2.0.1

The Document Embedder plugin for WordPress has a security flaw affecting all versions up to 2.0.0. The issue arises from the plugin's failu…

Medium

CVE-2025-12192

The Events Calendar [the-events-calendar] < 6.15.10

The Events Calendar plugin for WordPress has an issue in versions 6.15.9 and earlier where the sysinfo REST endpoint does not properly vali…

High

CVE-2025-12197

The Events Calendar [the-events-calendar] < 6.15.10

The Events Calendar plugin for WordPress contains a security flaw in versions 6.15.1.1 through 6.15.9, allowing malicious input to bypass n…

Medium

CVE-2025-11162

Spectra Legacy – Gutenberg Blocks [ultimate-addons-for-gutenberg] < 2.19.15

The Spectra Gutenberg Blocks plugin for WordPress contains a security flaw that allows malicious code injection through Custom CSS input fi…

Medium

CVE-2025-11917

WPeMatico RSS Feed Fetcher [wpematico] < 2.8.12

The WPeMatico RSS Feed Fetcher plugin for WordPress contains a flaw in its wpematico_test_feed() function that allows authenticated users w…

Medium

CVE-2025-12045

Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More [themeisle-companion] < 3.0.3

The Orbit Fox plugin, which includes features like duplicate page creation and custom fonts, is susceptible to stored cross-site scripting …

Medium

CVE-2025-12324

TablePress – Tables in WordPress made easy [tablepress] < 3.2.5

The TablePress plugin for WordPress contains a security flaw that allows malicious users with contributor privileges or higher to insert un…

Medium

CVE-2025-67535

WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings [wp-google-map-plugin] < 4.8.7

The Maps WordPress plugin contains a vulnerability that allows attackers with administrator-level access and above to inject malicious PHP …

Critical

CVE-2025-11833

Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App [post-smtp] < 3.6.1

The Post SMTP plugin, version 3.6.0 and earlier, is susceptible to unauthorized data access because it lacks proper capability checks in it…

Medium

CVE-2025-11377

List category posts [list-category-posts] < 0.93.0

A WordPress plugin called List category posts is flawed in its handling of the 'catlist' shortcode, allowing unauthorized users with contri…

Medium

CVE-2025-11502

Schema & Structured Data for WP & AMP [schema-and-structured-data-for-wp] < 1.52

The Schema & Structured Data for WP & AMP plugin contains a security flaw in its handling of user-submitted data within the 'saswp_tiny_mul…

High

CVE-2025-10487

Advanced Ads – Ad Manager & AdSense [advanced-ads] < 2.0.13

The Advanced Ads – Ad Manager & AdSense plugin for WordPress contains a security flaw in versions up to 2.0.12, allowing unauthorized acces…

Medium

CVE-2025-12367

SiteSEO – SEO Simplified [siteseo] < 1.3.2

The SiteSEO – SEO Simplified WordPress plugin has a security flaw in versions 1.3.1 and earlier, which allows unauthorized users with at le…

Medium

CVE-2025-11174

Document Library Lite [document-library-lite] < 1.1.7

The Document Library Lite plugin for WordPress contains a flaw in its authorization mechanism that affects all versions up to 1.1.6. Specif…

Medium

CVE-2025-11816

Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates – WPLP Legal Pages [wplegalpages] < 3.5.2

A flaw exists in WP Legal Pages plugin for WordPress, affecting all versions up to 3.5.1, where an essential security check is absent from …

Medium

CVE-2025-64357

Advanced Database Cleaner – Optimize & Clean Database to Speed Up Site Performance [advanced-database-cleaner] < 3.1.7

The Advanced Database Cleaner plugin for WordPress contains a security flaw in versions 3.1.6 and earlier, allowing malicious individuals t…

Medium

CVE-2025-12175

The Events Calendar [the-events-calendar] < 6.15.10

The Events Calendar plugin for WordPress contains a security flaw that allows authorized users with at least Subscriber privileges to bypas…

Medium

CVE-2025-64358

Smart Coupons For WooCommerce Coupons [wt-smart-coupons-for-woocommerce] < 2.2.4

The Smart Coupons For WooCommerce Coupons plugin has a security flaw that allows authorized users with a level of access as low as Subscrib…

CVE

CVE-2025-49042

WooCommerce [woocommerce] < 10.0.3

The WooCommerce plugin for WordPress is susceptible to stored cross-site scripting (XSS) attacks in versions from the earliest up to 10.0.2…

CVE

CVE-2025-64296

Meta for WooCommerce [facebook-for-woocommerce] < 3.5.8

The Facebook for WooCommerce plugin, versions 3.5.7 and earlier, lacks proper capability checks in certain functions, allowing unauthentica…

Medium

CVE-2025-11632

Call Now Button – The Free Click to Call Button for WordPress [call-now-button] < 1.5.5

A security flaw exists within the Call Now Button plugin for WordPress, allowing authenticated users with a Subscriber-level access or high…

Medium

CVE-2025-10008

Translate WordPress with Weglot 2.0 – Multilingual AI Translation [weglot] < 5.2

A security flaw exists in Weglot's WordPress translation plugin, where an essential permission check is absent from its "clean_options" fun…

Medium

CVE-2025-12450

LiteSpeed Cache [litespeed-cache] < 7.6

The LiteSpeed Cache plugin for WordPress, up to version 7.5.0.1, is susceptible to Reflected Cross-Site Scripting through URLs due to inade…

Medium

CVE-2025-11587

Call Now Button – The Free Click to Call Button for WordPress [call-now-button] < 1.5.4

The Call Now Button plugin for WordPress, up to version 1.5.3, is susceptible to unauthorized data modification because it lacks proper cap…

High

CVE-2025-64353

Polylang [polylang] < 3.7.4

Authenticated users with Contributor-level access and above can inject malicious PHP objects into Polylang versions up to 3.7.3 by exploiti…

High

CVE-2025-11735

HUSKY – Products Filter for WooCommerce Professional. MCP is onboard [woocommerce-products-filter] < 1.3.7.2

The HUSKY – Products Filter Professional plugin for WooCommerce has a security flaw in its handling of user input, specifically the `phrase…

High

CVE-2025-64198

Easy Social Share Buttons [easy-social-share-buttons3] < 10.7.1

The Easy Social Share Buttons plugin for WordPress contains a security flaw in versions prior to 10.7.2, allowing malicious code to be embe…

Medium

CVE-2025-64354

Gutenberg [gutenberg] < 21.9.0

The Gutenberg plugin for WordPress contains a security flaw in versions 21.8.2 and earlier, allowing malicious users with at least contribu…

Medium

CVE-2025-10580

Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets [widget-options] < 4.1.3

The Widget Options plugin, a popular choice for managing widgets and blocks on WordPress sites up to version 4.1.2, is susceptible to store…

Medium

CVE-2025-11497

Advanced Database Cleaner – Optimize & Clean Database to Speed Up Site Performance [advanced-database-cleaner] < 3.1.7

The Advanced Database Cleaner plugin for WordPress contains a security weakness in all versions prior to 3.1.6, specifically within the aDB…