Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,307

CVE-2024-10869

GuardGiant Brute Force Protection <= 2.2.6 - Reflected Cross-Site Scripting

The WordPress Brute Force Protection – Stop Brute Force Attacks plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.2.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Guardgiant Wordpress
Products
Wordpress Brute Force Protection - Stop Brute Force Attacks Wordpress
CVE-2025-68838

WordPress MemberPress Discord Addon plugin <= 1.1.4 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in expresstechsoftware MemberPress Discord Addon expresstechsoftwares-memberpress-discord-add-on allows Reflected XSS.This issue affects MemberPress Discord Addon: from n/a through <= 1.1.4.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Expresstechsoftware Wordpress
Products
Memberpress Discord Addon Wordpress
CVE-2025-68839

WordPress Easy Theme Options plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Remi Corson Easy Theme Options easy-theme-options allows Reflected XSS.This issue affects Easy Theme Options: from n/a through <= 1.0.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-68854

WordPress ID Arrays plugin <= 2.1.2 - POST-Based Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in harman79 ID Arrays id-arrays allows DOM-Based XSS.This issue affects ID Arrays: from n/a through <= 2.1.2.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Harman79 Wordpress
Products
Id Arrays Wordpress
CVE-2025-68855

WordPress JobBoard Job listing plugin <= 1.2.8 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in themeglow JobBoard Job listing job-board-light allows Retrieve Embedded Sensitive Data.This issue affects JobBoard Job listing: from n/a through <= 1.2.8.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Themeglow Wordpress
Products
Jobboard Job Listing Wordpress
CVE-2025-68857

WordPress Paid Downloads plugin <= 3.15 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ichurakov Paid Downloads paid-downloads allows Blind SQL Injection.This issue affects Paid Downloads: from n/a through <= 3.15.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-68863

WordPress iContact for Gravity Forms plugin <= 1.3.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zack Katz iContact for Gravity Forms gravity-forms-icontact allows Reflected XSS.This issue affects iContact for Gravity Forms: from n/a through <= 1.3.2.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Wordpress Zack Katz
Products
Wordpress Icontact For Gravity Forms
CVE-2025-68866

WordPress Dinatur plugin <= 1.18 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in woofer696 Dinatur dinatur allows Stored XSS.This issue affects Dinatur: from n/a through <= 1.18.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-67963

WordPress Movie Booking plugin <= 1.1.5 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ovatheme Movie Booking movie-booking allows Path Traversal.This issue affects Movie Booking: from n/a through <= 1.1.5.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-67960

WordPress WorkScout-Core plugin <= 1.7.06 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in purethemes WorkScout-Core workscout-core allows Reflected XSS.This issue affects WorkScout-Core: from n/a through <= 1.7.06.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Purethemes Wordpress
Products
Workscout Core Wordpress
CVE-2025-68869

WordPress LazyTasks plugin <= 1.2.37 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in LazyCoders LLC LazyTasks lazytasks-project-task-management allows Privilege Escalation.This issue affects LazyTasks: from n/a through <= 1.2.37.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Lazycoders Wordpress
Products
Lazytasks Wordpress
CVE-2025-67959

WordPress WorkScout theme <= 4.1.07 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in purethemes WorkScout workscout allows Reflected XSS.This issue affects WorkScout: from n/a through <= 4.1.07.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Purethemes Wordpress
Products
Workscout Wordpress
CVE-2025-68880

WordPress Simple Archive Generator plugin <= 5.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in peterwsterling Simple Archive Generator simple-archive-generator allows Reflected XSS.This issue affects Simple Archive Generator: from n/a through <= 5.2.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Peter Sterling Wordpress
Products
Simple Archive Generator Wordpress
CVE-2024-10552

Flexmls® IDX Plugin <= 3.14.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via API parameters

The Flexmls® IDX Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘api_key’ and 'api_secret' parameters in all versions up to, and including, 3.14.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 3.14.25.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2024-43233

WordPress BSK Forms Blacklist plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in BannerSky BSK Forms Blacklist allows Reflected XSS.This issue affects BSK Forms Blacklist: from n/a through 3.8.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Bannersky Wordpress
Products
Bsk Forms Blacklist Wordpress
CVE-2025-67954

WordPress Salon booking system plugin <= 10.30.3 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Retrieve Embedded Sensitive Data.This issue affects Salon booking system: from n/a through <= 10.30.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-67952

WordPress Grand Tour theme < 5.6.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Tour grandtour allows Reflected XSS.This issue affects Grand Tour: from n/a through < 5.6.2.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Themegoods Wordpress
Products
Grand Tour Wordpress
CVE-2025-68881

WordPress AppExperts plugin <= 1.4.5 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal AppExperts appexperts allows SQL Injection.This issue affects AppExperts: from n/a through <= 1.4.5.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-60209

WordPress Connector for Gravity Forms and Google Sheets plugin <= 1.2.6 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in CRM Perks Connector for Gravity Forms and Google Sheets wp-gravity-forms-spreadsheets allows Object Injection.This issue affects Connector for Gravity Forms and Google Sheets: from n/a through <= 1.2.6.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2024-12516

Coupon Plugin <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Coupon Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Coupon Code' parameter in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress