Vulnerabilità WordPress (qui elenco plugin) fonte: NIST CVES


  1. CVE-2025-11895 -- 2025-10-17T10:15:33.907
    Received
      The Binary MLM Plan Plugin for WordPress is vulnerable to insecure direct object reference in versions up to, and including, 3.0.
      - This is due to the bmp_user_payout_detail_of_current_user() function selecting payout records solely by id without verifying ownership.
      - This makes it possible for authenticated attackers with the bmp_user role (often subscribers) to view other members' payout summaries via direct requests to the /bmp-account-detail/ endpoint with a crafted payout-id parameter granted they can access the shortcode output.


  2. CVE-2025-10850 -- 2025-10-16T07:15:32.897
    Awaiting Analysis
      The Felan Framework Plugin for WordPress is vulnerable to improper authentication in versions up to, and including, 1.1.4.
      - This is due to the hardcoded password in the 'fb_ajax_login_or_register' function and in the 'google_ajax_login_or_register' function.
      - This makes it possible for unauthenticated attackers to log in as any existing user on the site, if they registered with facebook or google social login and did not change their password.


  3. CVE-2025-10849 -- 2025-10-16T07:15:32.710
    Awaiting Analysis
      The Felan Framework Plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'process_Plugin_actions' function called via an AJAX action in versions up to, and including, 1.1.4.
      - This makes it possible for unauthenticated attackers to activate or deactivate arbitrary Plugins.


  4. CVE-2025-10742 -- 2025-10-16T07:15:32.517
    Awaiting Analysis
      The Truelysell Core Plugin for WordPress is vulnerable to Arbitrary User password Change in versions up to, and including, 1.8.6.
      - This is due to the Plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources.
      - This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts.
      - Note: This can only be exploited unauthenticated if the attacker knows which page contains the 'truelysell_edit_staff' shortcode.


  5. CVE-2025-10706 -- 2025-10-16T07:15:32.270
    Awaiting Analysis
      The Classified Pro theme for WordPress is vulnerable to unauthorized Plugin installation due to a missing capability check in the 'cwp_addons_update_Plugin_cb' function in all versions up to, and including, 1.0.14.
      - This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary Plugins on the affected site's server which may make remote code execution possible.
      - Note: The required nonce for the vulnerability is in the CubeWP Framework Plugin.


  6. CVE-2025-11814 -- 2025-10-16T05:15:36.880
    Awaiting Analysis
      The Ultimate Addons for WPBakery Plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to 3.21.1 (exclusive) due to insufficient input sanitization and output escaping.
      - This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.


  7. CVE-2025-10700 -- 2025-10-16T03:15:35.420
    Awaiting Analysis
      The Ally – Web Accessibility & Usability Plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.0.
      - This is due to missing or incorrect nonce validation on the enable_unfiltered_files_upload function.
      - This makes it possible for unauthenticated attackers to enable unfiltered file upload and add svg files to the upload list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.


  8. CVE-2025-9967 -- 2025-10-15T09:15:43.500
    Awaiting Analysis
      The Orion SMS OTP Verification Plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.7.
      - This is due to the Plugin not properly validating a user's identity prior to updating their password.
      - This makes it possible for unauthenticated attackers to change arbitrary user's password to a one-time password if the attacker knows the user's phone number


  9. CVE-2025-11728 -- 2025-10-15T09:15:43.307
    Awaiting Analysis
      The Oceanpayment CreditCard Gateway Plugin for WordPress is vulnerable to unauthenticated and unauthorized modification of data due to missing authentication and capability checks on the 'return_payment' and 'notice_payment' functions in all versions up to, and including, 6.0.
      - This makes it possible for unauthenticated attackers to update WooCommerce orders to 'failed' status, and update transaction IDs.


  10. CVE-2025-11722 -- 2025-10-15T09:15:43.110
    Awaiting Analysis
      The Woocommerce Category and Products Accordion Panel Plugin for WordPress is vulnerable to Local file Inclusion in all versions up to, and including, 1.0 via the 'categoryaccordionpanel' shortcode.
      - This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files.
      - This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.


  11. CVE-2025-11701 -- 2025-10-15T09:15:42.910
    Awaiting Analysis
      The Zip Attachments Plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check as well as missing post status validation in the za_create_zip_callback function in all versions up to, and including, 1.6.
      - This makes it possible for unauthenticated attackers to download attachments from private and password-protected posts.


  12. CVE-2025-11692 -- 2025-10-15T09:15:42.720
    Awaiting Analysis
      The Zip Attachments Plugin for WordPress is vulnerable to unauthorized loss of data due to a missing authorization and capability checks on the download.php file in all versions up to, and including, 1.6.
      - This makes it possible for unauthenticated attackers to delete arbitrary files from the current wp_upload_dir directory.


  13. CVE-2025-11365 -- 2025-10-15T09:15:42.520
    Awaiting Analysis
      The WP Google Map Plugin Plugin for WordPress is vulnerable to blind SQL Injection via the 'id' parameter of the 'google_map' shortcode in all versions up to, and including, 1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.
      - This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.


  14. CVE-2025-11196 -- 2025-10-15T09:15:42.320
    Awaiting Analysis
      The External Login Plugin for WordPress is vulnerable to sensitive information exposure in all versions up to, and including, 1.11.2 due to the 'exlog_test_connection' AJAX action lacking capability checks or nonce validation.
      - This makes it possible for authenticated attackers, with subscriber-level access and above, to query the configured external database and retrieve truncated usernames, email addresses, and password hashes via the diagnostic test results view.


  15. CVE-2025-11177 -- 2025-10-15T09:15:42.093
    Awaiting Analysis
      The External Login Plugin for WordPress is vulnerable to SQL Injection via the 'log' parameter in all versions up to, and including, 1.11.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.
      - This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database when a PostgreSQL or MSSQL database is configured as the external authentication database.


  16. CVE-2025-10754 -- 2025-10-15T09:15:41.900
    Awaiting Analysis
      The DocoDoco Store Locator Plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the zip upload functionality in all versions up to, and including, 1.0.1.
      - This makes it possible for authenticated attackers, with Editor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.


  17. CVE-2025-10743 -- 2025-10-15T09:15:41.717
    Awaiting Analysis
      The Outdoor Plugin for WordPress is vulnerable to SQL Injection via the 'edit' action in all versions up to, and including, 1.3.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.
      - This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.


  18. CVE-2025-10730 -- 2025-10-15T09:15:41.540
    Awaiting Analysis
      The Wp tabber widget Plugin for WordPress is vulnerable to SQL Injection via the 'wp-tabber-widget' shortcode in all versions up to, and including, 4.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.
      - This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.


  19. CVE-2025-10682 -- 2025-10-15T09:15:41.327
    Awaiting Analysis
      The TARIFFUXX Plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.4.
      - This is due to insufficient neutralization of user-supplied input used directly in SQL queries.
      - This makes it possible for authenticated attackers, with Contributor-level access and above, to inject additional SQL into queries and extract sensitive information from the database via a crafted id attribute in the 'tariffuxx_configurator' shortcode.


  20. CVE-2025-10660 -- 2025-10-15T09:15:41.137
    Awaiting Analysis
      The WP Dashboard Chat Plugin for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.
      - This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.


  21. CVE-2025-10648 -- 2025-10-15T09:15:40.953
    Awaiting Analysis
      The YourMembership Single Sign On – YM SSO Login Plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'moym_display_test_attributes' function in all versions up to, and including, 1.1.7.
      - This makes it possible for unauthenticated attackers to read the profile data of the latest SSO login.


  22. CVE-2025-10575 -- 2025-10-15T09:15:40.740
    Awaiting Analysis
      The WP jQuery Pager Plugin for WordPress is vulnerable to SQL Injection via the 'ids' shortcode attribute parameter handled by the WPJqueryPaged::get_gallery_page_imgs() function in all versions up to, and including, 1.4.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.
      - This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.


  23. CVE-2025-10486 -- 2025-10-15T09:15:40.547
    Awaiting Analysis
      The Content Writer Plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.8 through publicly exposed log files.
      - This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files.


  24. CVE-2025-10313 -- 2025-10-15T09:15:40.373
    Awaiting Analysis
      The Find And Replace content for WordPress Plugin for WordPress is vulnerable to unauthorized Stored Cross-Site Scripting and Arbitrary Content Replacement due to a missing capability check on the far_admin_ajax_fun() function in all versions up to, and including, 1.1.
      - This makes it possible for unauthenticated attackers to inject arbitrary web scripts into pages that can make privilege escalation and malicious redirects possible.


  25. CVE-2025-10312 -- 2025-10-15T09:15:40.183
    Awaiting Analysis
      The Theme Importer Plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.
      - This is due to missing nonce validation when processing form submissions in the theme-importer.php file.
      - This makes it possible for unauthenticated attackers to trigger arbitrary file downloads and potentially execute malicious operations via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.


  26. CVE-2025-10310 -- 2025-10-15T09:15:39.967
    Awaiting Analysis
      The Rich Snippet Site Report Plugin for WordPress is vulnerable to SQL Injection via the 'last' parameter in all versions up to, and including, 2.0.0105 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.
      - This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
      - This can also be exploited via CSRF.


  27. CVE-2025-10303 -- 2025-10-15T09:15:39.780
    Awaiting Analysis
      The Library Management System Plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the owt7_library_management_ajax_handler() function in all versions up to, and including, 3.1.
      - This makes it possible for authenticated attackers, with Subscriber-level access and above, to update and manipulate several of the Plugin's settings and features.


  28. CVE-2025-10301 -- 2025-10-15T09:15:39.610
    Awaiting Analysis
      The FunKItools Plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2.
      - This is due to missing or incorrect nonce validation on the saveFields() function.
      - This makes it possible for unauthenticated attackers to update Plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.


  29. CVE-2025-10300 -- 2025-10-15T09:15:39.400
    Awaiting Analysis
      The TopBar Plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0.
      - This is due to missing or incorrect nonce validation on the fme_nb_topbar_save_settings() function.
      - This makes it possible for unauthenticated attackers to update the Plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.


  30. CVE-2025-10299 -- 2025-10-15T09:15:39.217
    Awaiting Analysis
      The WPBifröst – Instant passwordless Temporary Login Links Plugin for WordPress is vulnerable to privilege Escalation due to a missing capability check on the ctl_create_link AJAX action in all versions up to, and including, 1.0.7.
      - This makes it possible for authenticated attackers, with Subscriber-level access and above, to create new administrative user accounts and subsequently log in as those.


  31. CVE-2025-10294 -- 2025-10-15T09:15:39.043
    Awaiting Analysis
      The OwnID passwordless Login Plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.3.4.
      - This is due to the Plugin not properly checking if the ownid_shared_secret value is empty prior to authenticating a user via JWT.
      - This makes it possible for unauthenticated attackers to log in as other users, including administrators, on instances where the Plugin has not been fully configured yet.


  32. CVE-2025-10293 -- 2025-10-15T09:15:38.850
    Awaiting Analysis
      The Keyy Two Factor Authentication (like Clef) Plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.2.3.
      - This is due to the Plugin not properly validating a user's identity associated with a token generated.
      - This makes it possible for authenticated attackers, with subscriber-level access and above, to generate valid auth tokens and leverage that to auto-login as other accounts, including administrators, as long as the administrator has the 2FA set up.


  33. CVE-2025-10194 -- 2025-10-15T09:15:38.650
    Awaiting Analysis
      The shortcode Button Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Plugin's 'button' shortcode in all versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping on user supplied attributes.
      - This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.


  34. CVE-2025-10186 -- 2025-10-15T09:15:38.467
    Awaiting Analysis
      The WhyDonate – FREE Donate button – Crowdfunding – Fundraising Plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the remove_row function in all versions up to, and including, 4.0.14.
      - This makes it possible for unauthenticated attackers to delete rows from the wp_wdPlugin_style table.


  35. CVE-2025-10141 -- 2025-10-15T09:15:38.280
    Awaiting Analysis
      The Digiseller Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Plugin's 'ds' shortcode in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes.
      - This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.


  36. CVE-2025-10140 -- 2025-10-15T09:15:38.077
    Awaiting Analysis
      The Quick Social Login Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Plugin's 'quick-login' shortcode in all versions up to, and including, 1.4.6 due to insufficient input sanitization and output escaping on user supplied attributes.
      - This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.


  37. CVE-2025-10139 -- 2025-10-15T09:15:37.890
    Awaiting Analysis
      The WP BookWidgets Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Plugin's 'bw_link' shortcode in all versions up to, and including, 0.9 due to insufficient input sanitization and output escaping on user supplied attributes.
      - This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.


  38. CVE-2025-10135 -- 2025-10-15T09:15:37.700
    Awaiting Analysis
      The WP ViewSTL Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Plugin's 'viewstl' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes.
      - This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.


  39. CVE-2025-10133 -- 2025-10-15T09:15:37.500
    Awaiting Analysis
      The URLYar URL Shortner Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Plugin's 'urlyar_shortlink' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes.
      - This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.


  40. CVE-2025-10132 -- 2025-10-15T09:15:37.277
    Awaiting Analysis
      The Dhivehi Text Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Plugin's 'dhivehi' shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping on user supplied attributes.
      - This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.


  41. CVE-2025-10056 -- 2025-10-15T09:15:37.057
    Awaiting Analysis
      The Task Scheduler Plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.3 via the “Check Website” task.
      - This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.


  42. CVE-2025-10051 -- 2025-10-15T09:15:36.850
    Awaiting Analysis
      The Demo Import Kit Plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.1.0 via the import functionality.
      - This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.


  43. CVE-2025-10045 -- 2025-10-15T09:15:36.600
    Awaiting Analysis
      The onOffice for WP-Websites Plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in all versions up to, and including, 5.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.
      - This makes it possible for authenticated attackers, with Editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.


  44. CVE-2025-10041 -- 2025-10-15T09:15:36.380
    Awaiting Analysis
      The Flex QR Code Generator Plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in thesave_qr_code_to_db() function in all versions up to, and including, 1.2.5.
      - This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.


  45. CVE-2025-10038 -- 2025-10-15T09:15:36.167
    Awaiting Analysis
      The Binary MLM Plan Plugin for WordPress is vulnerable to limited privilege Escalation in all versions up to, and including, 3.0.
      - This is due to bmp_user role granting all users with the manage_bmp capability by default upon registration through the Plugin's form.
      - This makes it possible for unauthenticated attackers to register and manage the Plugin's settings.


  46. CVE-2025-11501 -- 2025-10-15T08:15:33.847
    Awaiting Analysis
      The Dynamically Display Posts Plugin for WordPress is vulnerable to SQL Injection via the 'tax_query' parameter in all versions up to, and including, 1.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.
      - This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.


  47. CVE-2025-11161 -- 2025-10-15T07:15:32.023
    Awaiting Analysis
      The WPBakery Page Builder Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the vc_custom_heading shortcode in all versions up to, and including, 8.6.1.
      - This is due to insufficient restriction of allowed HTML tags and improper sanitization of user-supplied attributes in the font_container parameter.
      - This makes it possible for authenticated attackers with contributor-level access or higher to inject arbitrary web scripts in posts that will execute whenever a user accesses an injected page via the vc_custom_heading shortcode with malicious tag and text attributes granted they have access to use WPBakery shortcodes.


  48. CVE-2025-11160 -- 2025-10-15T07:15:30.680
    Awaiting Analysis
      The WPBakery Page Builder Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS module in all versions up to, and including, 8.6.1.
      - This is due to insufficient input sanitization and output escaping of user-supplied JavaScript code in the Custom JS module.
      - This makes it possible for authenticated attackers with contributor-level access or higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page via the WPBakery Page Builder Custom JS module granted they have access to the WPBakery editor for post types.


  49. CVE-2025-8561 -- 2025-10-15T06:15:46.203
    Awaiting Analysis
      The Ova Advent Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Plugin's shortcodes in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping on user supplied attributes.
      - This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.


  50. CVE-2025-6042 -- 2025-10-15T06:15:44.887
    Awaiting Analysis
      The Lisfinity Core - Lisfinity Core Plugin used for pebas® Lisfinity WordPress theme Plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.4.0.
      - This is due to the Plugin assigning the editor role by default.
      - While limitations with respect to capabilities are put in place, use of the API is not restricted.
      - This vulnerability can be leveraged together with CVE-2025-6038 to obtain admin privileges.






Newsletter Podcast
(30 gg free)