Filtered by vendor Wordpress Subscriptions

Search

Switch to Advanced Search (Beta)
Total 9895 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-14984 2 Jegstudio, Wordpress 2 Gutenverse, Wordpress 2026-01-12 6.4 Medium
The Gutenverse Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file upload in all versions up to, and including, 2.3.2. This is due to the plugin's framework component adding SVG to the allowed MIME types via the upload_mimes filter without implementing any sanitization of SVG file contents. This makes it possible for authenticated attackers, with Author-level access and above, to upload SVG files containing malicious JavaScript that executes when the file is viewed, leading to arbitrary JavaScript execution in victims' browsers.
CVE-2024-37102 2 Blossomthemes, Wordpress 2 Vilva, Wordpress 2026-01-12 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Blossom Themes Vilva allows Cross Site Request Forgery.This issue affects Vilva: from n/a through 1.2.2.
CVE-2024-38703 2 Wordpress, Xylusthemes 2 Wordpress, Wp Event Aggregator 2026-01-12 6.5 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Xylus Themes WP Event Aggregator allows Stored XSS.This issue affects WP Event Aggregator: from n/a through 1.7.9.
CVE-2024-32531 2 Everestthemes, Wordpress 2 Gucherry Blog, Wordpress 2026-01-12 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest themes GuCherry Blog allows Reflected XSS.This issue affects GuCherry Blog: from n/a through 1.1.8.
CVE-2024-44010 2 Catchthemes, Wordpress 2 Full Frame, Wordpress 2026-01-12 5.1 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Catch Themes Full frame allows Stored XSS.This issue affects Full frame: from n/a through 2.7.2.
CVE-2025-13070 1 Wordpress 1 Wordpress 2026-01-09 6.6 Medium
The CSV to SortTable WordPress plugin through 4.2 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as contributor to perform LFI attacks.
CVE-2025-12954 2 Motopress, Wordpress 2 Timetable And Event Schedule, Wordpress 2026-01-09 2.7 Low
The Timetable and Event Schedule by MotoPress WordPress plugin before 2.4.16 does not verify a user has access to a specific event when duplicating, leading to arbitrary event disclosure when to users with a role as low as Contributor.
CVE-2025-12061 1 Wordpress 1 Wordpress 2026-01-09 8.6 High
The TAX SERVICE Electronic HDM WordPress plugin before 1.2.1 does not authorization and CSRF checks in an AJAX action, allowing unauthenticated users to import and execute arbitrary SQL statements
CVE-2025-12057 1 Wordpress 1 Wordpress 2026-01-09 9.8 Critical
The WavePlayer WordPress plugin before 3.8.0 does not have authorization in an AJAX action as well as does not validate the file to be copied locally, allowing unauthenticated users to upload arbitrary file on the server and lead to RCE
CVE-2025-11191 1 Wordpress 1 Wordpress 2026-01-09 5.3 Medium
The RealPress WordPress plugin before 1.1.0 registers the REST routes without proper permission checks, allowing the creation of pages and sending of emails from the site.
CVE-2025-10406 1 Wordpress 1 Wordpress 2026-01-09 5.5 Medium
The BlindMatrix e-Commerce WordPress plugin before 3.1 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users, such as contributors, to perform LFI attacks.
CVE-2025-13071 1 Wordpress 1 Wordpress 2026-01-09 7.1 High
The Custom Admin Menu WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVE-2025-10684 1 Wordpress 1 Wordpress 2026-01-09 4.3 Medium
The Construction Light WordPress theme before 1.6.8 does not have authorisation and CSRF when activating via an AJAX action, allowing any authenticated users, such as subscriber to activate arbitrary .
CVE-2024-47356 2 Catchthemes, Wordpress 2 Create, Wordpress 2026-01-09 5.1 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Catch Themes Create allows Stored XSS.This issue affects Create: from n/a through 2.9.1.
CVE-2025-30881 2 Themehunk, Wordpress 2 Big Store, Wordpress 2026-01-09 4.3 Medium
Missing Authorization vulnerability in ThemeHunk Big Store allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Big Store: from n/a through 2.0.8.
CVE-2024-37421 2 Rarathemes, Wordpress 2 Jobscout, Wordpress 2026-01-09 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Rara Theme JobScout allows Cross Site Request Forgery.This issue affects JobScout: from n/a through 1.1.4.
CVE-2023-28688 2 Themehunk, Wordpress 2 Variation Swatches, Wordpress 2026-01-09 5.4 Medium
Cross-Site Request Forgery (CSRF) vulnerability in ThemeHunk TH Variation Swatches allows Cross Site Request Forgery.This issue affects TH Variation Swatches: from n/a through 1.2.7.
CVE-2024-31428 2 Rarathemes, Wordpress 2 The Conference, Wordpress 2026-01-09 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Rara Theme The Conference.This issue affects The Conference: from n/a through 1.2.0.
CVE-2024-31384 2 Rarathemes, Wordpress 2 Spa And Salon, Wordpress 2026-01-09 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Rara Theme Spa and Salon.This issue affects Spa and Salon: from n/a through 1.2.7.
CVE-2025-52816 2 Themehunk, Wordpress 2 Zita, Wordpress 2026-01-09 8.1 High
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themehunk Zita allows PHP Local File Inclusion. This issue affects Zita: from n/a through 1.6.5.