CVE-2025-69186

WordPress Hospital Doctor Directory plugin <= 1.3.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in e-plugins Hospital Doctor Directory hospital-doctor-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hospital Doctor Directory: from n/a through <= 1.3.9.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

E-plugins Wordpress

Products

Hospital & Doctor Directory Wordpress

CVE-2025-69187

WordPress Final User plugin <= 1.2.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in e-plugins Final User final-user allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Final User: from n/a through <= 1.2.5.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

E-plugins Wordpress

Products

Final User Wordpress

CVE-2025-69188

WordPress fitness-trainer plugin <= 1.7.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in e-plugins fitness-trainer fitness-trainer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects fitness-trainer: from n/a through <= 1.7.1.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

E-plugins Wordpress

Products

Fitness Trainer Wordpress

CVE-2025-69190

WordPress Listihub theme <= 1.0.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in e-plugins Listihub listihub allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Listihub: from n/a through <= 1.0.6.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2025-69191

WordPress ListingHub plugin <= 1.2.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in e-plugins ListingHub listinghub allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ListingHub: from n/a through <= 1.2.7.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2025-69192

WordPress Real Estate Pro plugin <= 2.1.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in e-plugins Real Estate Pro real-estate-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Real Estate Pro: from n/a through <= 2.1.5.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

E-plugins Wordpress

Products

Real Estate Pro Wordpress

CVE-2025-69193

WordPress WP Membership plugin <= 1.6.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in e-plugins WP Membership wp-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Membership: from n/a through <= 1.6.4.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

E-plugins Wordpress

Products

Wp Membership Wordpress

CVE-2025-69292

WordPress WP Membership plugin <= 1.6.4 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in e-plugins WP Membership wp-membership allows Privilege Escalation.This issue affects WP Membership: from n/a through <= 1.6.4.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

E-plugins Wordpress

Products

Wp Membership Wordpress

CVE-2025-69293

WordPress Final User plugin <= 1.2.5 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in e-plugins Final User final-user allows Privilege Escalation.This issue affects Final User: from n/a through <= 1.2.5.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

E-plugins Wordpress

Products

Final User Wordpress

CVE-2025-69294

WordPress PeakShops theme <= 1.5.9 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in fuelthemes PeakShops peakshops allows Object Injection.This issue affects PeakShops: from n/a through <= 1.5.9.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Fuelthemes Wordpress

Products

Peakshops Wordpress

CVE-2025-69295

WordPress Coven Core plugin <= 1.3 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Coven Core coven-core allows Blind SQL Injection.This issue affects Coven Core: from n/a through <= 1.3.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Teconcetheme Wordpress

Products

Coven Core Wordpress

CVE-2025-69296

WordPress Aardvark theme <= 4.6.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhostPool Aardvark aardvark allows Reflected XSS.This issue affects Aardvark: from n/a through <= 4.6.3.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Ghostpool Wordpress

Products

Aardvark Wordpress

CVE-2025-69297

WordPress Aardvark Plugin plugin <= 2.19 - Broken Access Control vulnerability

Missing Authorization vulnerability in GhostPool Aardvark Plugin aardvark-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Aardvark Plugin: from n/a through <= 2.19.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Ghostpool Wordpress

Products

Aardvark Plugin Wordpress

CVE-2025-69299

WordPress Oxygen theme <= 6.0.8 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery (SSRF) vulnerability in Laborator Oxygen oxygen allows Server Side Request Forgery.This issue affects Oxygen: from n/a through <= 6.0.8.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Laborator Wordpress

Products

Oxygen Wordpress

CVE-2025-69305

WordPress Crete Core plugin <= 1.4.3 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Crete Core crete-core allows Blind SQL Injection.This issue affects Crete Core: from n/a through <= 1.4.3.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Teconcetheme Wordpress

Products

Crete Core Wordpress

CVE-2025-69301

WordPress PhotoMe theme <= 5.6.11 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeGoods PhotoMe photome allows Object Injection.This issue affects PhotoMe: from n/a through <= 5.6.11.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Themegoods Wordpress

Products

Photome Wordpress

CVE-2025-69302

WordPress DesignThemes Core Features plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Core Features designthemes-core-features allows Reflected XSS.This issue affects DesignThemes Core Features: from n/a through <= 2.3.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Designthemes Wordpress

Products

Designthemes Core Features Wordpress

CVE-2025-69304

WordPress Allmart plugin <= 1.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Allmart allmart-core allows Blind SQL Injection.This issue affects Allmart: from n/a through <= 1.1.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Teconcetheme Wordpress

Products

Allmart Wordpress

CVE-2025-69306

WordPress Electio Core plugin <= 1.4 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Electio Core electio-core allows Blind SQL Injection.This issue affects Electio Core: from n/a through <= 1.4.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Teconcetheme Wordpress

Products

Electio Core Wordpress

CVE-2025-69307

WordPress Medinik Core plugin <= 1.3.6 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Medinik Core medinik-core allows Blind SQL Injection.This issue affects Medinik Core: from n/a through <= 1.3.6.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Teconcetheme Wordpress

Products

Medinik Core Wordpress