CVE-2025-69365

WordPress Uroan Core plugin <= 1.4.4 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Uroan Core uroan-core allows Blind SQL Injection.This issue affects Uroan Core: from n/a through <= 1.4.4.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Teconcetheme Wordpress

Products

Uroan Core Wordpress

CVE-2025-69366

WordPress Emerce Core plugin <= 1.8 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Emerce Core emerce-core allows Blind SQL Injection.This issue affects Emerce Core: from n/a through <= 1.8.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Teconcetheme Wordpress

Products

Emerce Core Wordpress

CVE-2025-69367

WordPress Oyster - Photography WordPress Theme theme <= 4.4.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GT3themes Oyster - Photography WordPress Theme oyster allows DOM-Based XSS.This issue affects Oyster - Photography WordPress Theme: from n/a through <= 4.4.3.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Gt3themes Wordpress

Products

Oyster - Photography Wordpress Theme Wordpress

CVE-2025-6814

Booking X 1.0 - 1.1.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via export_now() Function

The Booking X plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_now() function in versions 1.0 to 1.1.2. This makes it possible for unauthenticated attackers to download all plugin data, including user accounts, user meta, and PayPal credentials, by issuing a crafted POST request.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2025-68088

WordPress Huger for Elementor plugin <= 1.1.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in merkulove Huger for Elementor huger-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Huger for Elementor: from n/a through <= 1.1.5.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Merkulove Wordpress

Products

Huger For Elementor Wordpress

CVE-2025-68086

WordPress Reformer for Elementor plugin <= 1.0.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in merkulove Reformer for Elementor reformer-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Reformer for Elementor: from n/a through <= 1.0.6.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Merkulove Wordpress

Products

Reformer For Elementor Wordpress

CVE-2025-68078

WordPress Salient Portfolio theme <= 1.8.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeNectar Salient Portfolio salient-portfolio allows Stored XSS.This issue affects Salient Portfolio: from n/a through <= 1.8.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Themenectar Wordpress

Products

Salient Core Wordpress

CVE-2025-68076

WordPress Stockholm Core plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Select-Themes Stockholm Core stockholm-core allows Stored XSS.This issue affects Stockholm Core: from n/a through <= 2.4.6.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Select-themes Wordpress

Products

Stockholm Core Wordpress

CVE-2025-68072

WordPress Easy Property Listings plugin <= 3.5.20 - Broken Access Control vulnerability

Missing Authorization vulnerability in Merv Barrett Easy Property Listings easy-property-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Property Listings: from n/a through <= 3.5.20.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Merv Barrett Wordpress

Products

Easy Property Listings Wordpress

CVE-2025-68050

WordPress Leadpages plugin <= 1.1.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Leadpages Leadpages leadpages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Leadpages: from n/a through <= 1.1.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Leadpages Wordpress

Products

Leadpages Wordpress

CVE-2025-68048

WordPress NextMove Lite plugin <= 2.23.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in XLPlugins NextMove Lite woo-thank-you-page-nextmove-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NextMove Lite: from n/a through <= 2.23.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Xlplugins

Products

Wordpress Nextmove

CVE-2025-69368

WordPress SOHO - Photography WordPress Theme theme <= 3.0.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GT3themes SOHO - Photography WordPress Theme soho allows DOM-Based XSS.This issue affects SOHO - Photography WordPress Theme: from n/a through <= 3.0.3.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Gt3themes Wordpress

Products

Soho - Photography Wordpress Theme Wordpress

CVE-2025-68047

WordPress Eventin plugin <= 4.1.3 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Arraytics Eventin wp-event-solution allows Object Injection.This issue affects Eventin: from n/a through <= 4.1.3.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Arraytics Wordpress

Products

Eventin Wordpress

CVE-2025-68046

WordPress Contact Form & Lead Form Elementor Builder plugin <= 2.0.1 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeHunk Contact Form & Lead Form Elementor Builder lead-form-builder allows Retrieve Embedded Sensitive Data.This issue affects Contact Form & Lead Form Elementor Builder: from n/a through <= 2.0.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Themehunk Wordpress

Products

Contact Form & Lead Form Elementor Builder Wordpress

CVE-2025-7695

Dataverse Integration 2.77 - 2.81 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via reset_password_link REST Route

The Dataverse Integration plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization checks within its reset_password_link REST endpoint in versions 2.77 through 2.81. The endpoint’s handler accepts a client-supplied id, email, or login, looks up that user, and calls get_password_reset_key() unconditionally. Because it only checks that the caller is authenticated, and not that they own or may edit the target account, any authenticated attacker, with Subscriber-level access and above, can obtain a password reset link for an administrator and hijack that account.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2025-68043

WordPress LottieFiles plugin <= 3.0.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in LottieFiles LottieFiles lottiefiles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LottieFiles: from n/a through <= 3.0.0.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Lottiefiles Wordpress

Products

Lottiefiles Wordpress

CVE-2025-68042

WordPress Travelpayouts plugin <= 1.2.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Travelpayouts Travelpayouts travelpayouts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Travelpayouts: from n/a through <= 1.2.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Travelpayouts Wordpress

Products

Travelpayouts Wordpress

CVE-2025-68041

WordPress Omnichannel for WooCommerce plugin <= 1.3.65 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codisto Omnichannel for WooCommerce codistoconnect allows Stored XSS.This issue affects Omnichannel for WooCommerce: from n/a through <= 1.3.65.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Codisto Wordpress

Products

Omnichannel For Woocommerce Wordpress

CVE-2025-68037

WordPress Export Media URLs plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atlas Gondal Export Media URLs export-media-urls allows Reflected XSS.This issue affects Export Media URLs: from n/a through <= 2.2.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Atlasgondal Wordpress

Products

Export Media Urls Wordpress

CVE-2025-69370

WordPress Capella theme <= 2.5.5 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeGoods Capella capella allows Object Injection.This issue affects Capella: from n/a through <= 2.5.5.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Themegoods Wordpress

Products

Capella Wordpress