Skip to main content
Skip to footer
Opens in a new tab
Home
CVE Analysis
How it Works
Resources
Pricing
Log in
Create Account
Home
CVE Analysis
How it Works
Resources
Pricing
Log in
Create Account
Severity:
medium
CVE-2025-13393: Featured Image from URL (FIFU) <= 5.3.1 Authenticated (Contributor+) Server-Side Request Forgery via 'fifu_input_url' PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-13393 affects the Featured Image From URL plugin (up to v5.3.1) with a medium severity (CVSS 4.3). Authenticated users can…
CVE-2025-69355: Tickera <= 3.5.6.4 Missing Authorization PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-69355 affects the Tickera Event Ticketing System plugin (up to v3.5.6.4) with a medium severity (CVSS 4.3) vulnerability. Patch to…
CVE-2025-12379: Shortcodes and extra features for Phlox theme <= 2.17.13 Authenticated (Contributor+) Stored Cross-Site Scripting via Modern Heading Widget PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-12379 affects the Auxin Elements plugin (up to version 2.17.13) with a medium severity CVSS score of 6.4. Authenticated attackers…
CVE-2025-14555: Countdown Timer Widget Countdown <= 2.7.7 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-14555 affects the Widget Countdown plugin (up to v2.7.7) with a medium severity CVSS score of 6.4. Authenticated attackers can…
CVE-2025-13967: Woodpecker for WordPress <= 3.0.4 Authenticated (Contributor+) Stored Cross-Site Scripting via 'form_name' Shortcode Attribute PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-13967 affects the Woodpecker plugin (up to v3.0.4) with a medium severity (CVSS 6.4) stored XSS vulnerability. Authenticated users can…
CVE-2025-13903: PullQuote <= 1.0 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-13903 affects the Pullquote plugin for WordPress (version 1.0) with a CVSS score of 6.4. This medium severity XSS vulnerability…
CVE-2025-13892: MG AdvancedOptions <= 1.2 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-13892 affects the MG AdvancedOptions plugin for WordPress, with a medium severity CVSS score of 6.1. Users should update from…
CVE-2025-13717: Contact Form vCard Generator <= 2.4 Missing Authorization to Unauthenticated Sensitive Information Exposure via 'wp-gvc-cf-download-id' Parameter PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-13717 affects the Contact Form vCard Generator plugin (up to v2.4) with a CVSS score of 5.3. Unauthenticated attackers can…
CVE-2025-13897: Client Testimonial Slider <= 2.0 Authenticated (Contributor+) Stored Cross-Site Scripting via 'aft_testimonial_meta_name' Metabox Field PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-13897 affects the Wp Client Testimonial plugin (up to v2.0) with a medium severity (CVSS 6.4) stored XSS vulnerability. Patch…
CVE-2025-13854: Curved Text <= 0.1 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-13854 affects the Curved Text plugin for WordPress (version 0.1) with a medium severity (CVSS 6.4) due to stored XSS…
CVE-2025-13893: Lesson Plan Book <= 1.3 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-13893 affects the Lesson Plan Book plugin for WordPress (up to v1.3) with a medium severity CVSS score of 6.1.…
CVE-2025-13704: Autogen Headers Menu <= 1.0.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'head_class' Shortcode Parameter PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-13704 affects the Autogen Headers Menu plugin for WordPress (versions up to 1.0.1) with a CVSS score of 6.4. Authenticated…
CVE-2025-14506: ConvertForce Popup Builder <= 0.0.7 Stored Cross-Site Scripting via entrance_animation PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-14506 affects the ConvertForce Popup Builder plugin (up to v0.0.7) with a CVSS score of 6.4. Authenticated attackers can exploit…
CVE-2025-13753: WP Table Builder <= 2.0.19 Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Table Creation PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-13753 affects WP Table Builder plugin versions up to 2.0.19, allowing unauthorized data modification by authenticated users. Upgrade to version…
CVE-2025-13729: Entry Views <= 1.0.0 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-13729 affects the Entry Views plugin for WordPress (v1.0.0) with a medium severity CVSS score of 6.4. Authenticated attackers can…
CVE-2025-14146: Booking Calendar <= 10.14.10 Unauthenticated Sensitive Information Exposure PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-14146 affects the Booking Calendar plugin (up to v10.14.10) with a CVSS score of 5.3. Unauthenticated attackers can access sensitive…
CVE-2025-13853: Nearby Now Reviews <= 5.2 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-13853 affects the Nearby Now Reviews plugin (up to v5.2) with a medium severity (CVSS 6.4) stored XSS vulnerability. Users…
CVE-2025-13862: Menu Card <= 0.8.0 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-13862 affects the Menu Card plugin for WordPress (up to version 0.8.0) with a CVSS score of 6.4. Authenticated attackers…
CVE-2025-13852: Debt.com Business in a Box <= 4.1.0 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-13852 affects the Debtcom Business In A Box plugin (up to v4.1.0) with a CVSS score of 6.4. Authenticated attackers…
CVE-2025-13908: The Tooltip <= 1.0.2 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-13908 affects The Tooltip plugin for WordPress (up to v1.0.2) with a medium severity (CVSS 6.4) Stored XSS vulnerability. Authenticated…
←
1
…
70
71
72
73
74
…
120
→