Skip to main content
Skip to footer
Opens in a new tab
Home
CVE Analysis
How it Works
Resources
Pricing
Log in
Create Account
Home
CVE Analysis
How it Works
Resources
Pricing
Log in
Create Account
Severity:
high
CVE-2025-68853: Contact Manager <= 9.1 Unauthenticated PHP Object Injection PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-68853 affects the Contact Manager plugin for WordPress (up to version 9.1) with a high severity CVSS score of 8.1.…
CVE-2025-67979: WPForms Google Sheet Connector <= 4.0.1 Authenticated (Subscriber+) Remote Code Execution PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-67979 affects the GSheetConnector for WPForms plugin (versions
CVE-2025-67984: NPS computy <= 2.8.2 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-67984 affects the NPS Computy plugin for WordPress (up to version 2.8.2) with a high severity CVSS score of 7.2…
CVE-2025-69324: NEX-Forms <= 9.1.7 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-69324 affects the NEX-Forms plugin for WordPress (up to version 9.1.7) with a high severity CVSS score of 7.2. Users…
CVE-2025-15368: SportsPress <= 2.7.26 Authenticated (Contributor+) Local File Inclusion via Shortcode PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-15368 affects the SportsPress plugin (up to version 2.7.26) with a high severity CVSS score of 8.8. Authenticated attackers can…
CVE-2025-15268: Infility Global <= 2.14.46 Unauthenticated SQL Injection via Predictable API Key and IP Whitelist Bypass PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-15268 affects the Infility Global plugin for WordPress (up to version 2.14.46) with a high severity SQL injection vulnerability (CVSS…
CVE-2026-1375: Tutor LMS <= 3.9.5 Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and Deletion PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-1375 affects the Tutor LMS plugin (up to version 3.9.5) with a CVSS score of 8.1. Authenticated users can manipulate…
CVE-2026-0617: LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-0617 affects the LatePoint plugin (up to version 5.2.5) with a CVSS score of 7.2. This high-severity XSS vulnerability allows…
CVE-2026-1730: OS DataHub Maps <= 1.8.3 Authenticated (Author+) Arbitrary File Upload PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-1730 affects the OS DataHub Maps plugin for WordPress (up to v1.8.3) with a high severity CVSS score of 8.8.…
CVE-2026-1756: WP FOFT Loader <= 2.1.39 Authenticated (Author+) Arbitrary File Upload PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-1756 affects the WP FOFT Loader plugin (up to version 2.1.39) with a high severity CVSS score of 8.8. Authenticated…
CVE-2025-15285: SEO Flow by LupsOnline <= 2.2.1 Unauthenticated Arbitrary Post/Category Modification PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-15285 affects the Lupsonline Link Netwerk plugin (up to version 2.2.1) with a high severity CVSS score of 7.5. Unauthenticated…
CVE-2026-25326: CMSMasters Content Composer <= 1.4.5 Authenticated (Contributor+) Local File Inclusion PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-25326 affects the Cmsmasters Content Composer plugin for WordPress (up to v1.4.5) with a high severity CVSS score of 7.5.…
CVE-2026-1065: Form Maker by 10Web <= 1.15.35 Unauthenticated Stored Cross-Site Scripting via SVG file PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-1065 affects the Form Maker plugin (up to v1.15.35) with a high severity CVSS score of 7.2 due to stored…
CVE-2026-1058: Form Maker by 10Web <= 1.15.35 Unauthenticated Stored Cross-Site Scripting via Hidden Field PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-1058 affects the Form Maker plugin (up to v1.15.35) with a CVSS score of 7.1, allowing stored XSS attacks. Update…
CVE-2025-14554: Sell BTC Cryptocurrency Selling Calculator <= 1.5 Unauthenticated Stored Cross-Site Scripting via 'orderform_data' AJAX Action PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-14554 affects the Sell BTC - Cryptocurrency Selling Calculator plugin (up to v1.5) with a CVSS score of 7.2. Unauthenticated…
CVE-2026-23978: Gyan Elements <= 2.2.1 Authenticated (Contributor+) Local File Inclusion PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-23978 affects the Gyan Elements plugin for WordPress (up to version 2.2.1) with a CVSS score of 7.5. Authenticated users…
CVE-2025-67978: Educare <= 1.6.1 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-67978 affects the Educare WordPress plugin (up to 1.6.1) with a CVSS score of 7.2. This high-severity stored XSS vulnerability…
CVE-2025-69307: Medinik Core <= 1.3.6 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-69307 affects the Medinik Core plugin for WordPress (up to v1.3.6) with a CVSS score of 7.5. This high-severity SQL…
CVE-2025-69306: Electio Core <= 1.4 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-69306 affects the Electio Core plugin for WordPress (up to version 1.4) with a high severity score of 7.5. Unauthenticated…
CVE-2025-69308: Nestbyte Core <= 1.2 Unauthenticated SQL Injection PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-69308 affects the Nestbyte Core plugin for WordPress (up to v1.2) with a CVSS score of 7.5. This high-severity SQL…
←
1
…
25
26
27
28
29
…
36
→