CVE

Pods is a powerful plugin for WordPress that allows users to create and manage custom post types, fields, and taxonomies. This plugin is widely used for extending WordPress’s native functionality and creating custom content types to suit different needs. However, a severe SQL Injection vulnerability (CVE-2025-1446) has been discovered in the Pods plugin. This vulnerability allows an attacker to inject malicious SQL queries via user input, potentially leading to unauthorized access to the WordPress database. If exploited, this flaw could result in data leakage, manipulation, or even full administrative control over the site.

Nested Pages is a popular WordPress plugin designed to help website administrators organize their pages and posts hierarchically. This plugin allows for easy drag-and-drop management of WordPress pages and custom post types, making it a valuable tool for many site

Calculated Fields Form is a WordPress plugin that enables users to create custom forms with calculated fields, ideal for use in forms that require mathematical calculations such as price estimators, financial forms, and surveys. While the plugin offers a lot of flexibility and customization options, it also contains a critical vulnerability (CVE-2024-13382). This vulnerability allows attackers to inject malicious JavaScript into form fields, which can then be executed by users interacting with the form. The result of exploiting this vulnerability is a potential backdoor access, allowing attackers to perform actions such as account takeover and unauthorized administrative control of the website. This issue impacts versions of the plugin with 50k+ installations, posing a serious security risk to many WordPress sites.

The Photo Gallery by 10Web plugin is a widely used WordPress plugin designed to help users create beautiful and organized image galleries on their websites. This plugin allows website owners to display their images in various formats, enhancing the visual appeal of their site. However, a severe vulnerability (CVE-2024-13124) has been discovered in the plugin, which allows an attacker to inject malicious JavaScript into the gallery’s title field. This Stored Cross-Site Scripting (XSS) vulnerability can lead to the execution of arbitrary scripts, enabling attackers to potentially create backdoor admin accounts and gain unauthorized access to the site. With over 200,000 installations, this flaw poses a significant threat to websites relying on this plugin.

The security of WordPress plugins is crucial for website integrity, as vulnerabilities can expose sites to attacks that compromise data and user trust. One such critical issue has been identified in the Photo Gallery, Images, Slider in Rbs Image Gallery plugin, affecting versions below 3.2.24. This vulnerability, CVE-2024-13384, allows attackers to exploit a Stored Cross-Site Scripting (XSS) vulnerability, leading to JavaScript backdoor creation. This article provides an in-depth analysis of the discovery, exploitation, and potential risks, along with recommendations to mitigate this issue.

The security of WordPress plugins is crucial for website integrity, as vulnerabilities can expose sites to attacks that compromise data and user trust. One such critical issue has been identified in the Photo Gallery, Images, Slider in Rbs Image Gallery plugin, affecting versions below 3.2.24. This vulnerability, CVE-2024-13384, allows attackers to exploit a Stored Cross-Site Scripting (XSS) vulnerability, leading to JavaScript backdoor creation. This article provides an in-depth analysis of the discovery, exploitation, and potential risks, along with recommendations to mitigate this issue.

Form Maker by 10Web is a popular WordPress plugin used to create forms and widgets for various purposes, such as contact forms, surveys, and user registration. The plugin is widely used by website administrators for its ease of use and flexibility. However, a critical vulnerability, CVE-2024-10558, has been discovered in the plugin, which allows attackers to inject malicious JavaScript into the “Title” field of a widget. This Stored Cross-Site Scripting (XSS) vulnerability can result in the execution of arbitrary JavaScript on the website, potentially leading to account takeover and the creation of backdoor access. The vulnerability can be exploited by any user with editor privileges or higher, posing a significant risk to WordPress websites using the plugin.

Podlove Podcast Publisher is a powerful WordPress plugin designed to streamline podcast publishing. It offers features like multi-format publishing, enhanced RSS feeds, an optimized web player, and metadata management. However, a critical stored Cross-Site Scripting (XSS) vulnerability (CVE-2024-13729) has been identified in versions prior to 4.1.24, allowing attackers to inject malicious scripts that could lead to unauthorized administrative actions

The Simple Basic Contact Form (SBCF) plugin is widely used in WordPress for implementing lightweight and efficient contact forms. Despite its focus on security and minimalism, a Stored Cross-Site Scripting (XSS) vulnerability has been identified, allowing an attacker to inject malicious scripts that execute in the browser of an administrator. This article explores the discovery, exploitation, and security implications of this vulnerability while providing recommendations for mitigation.

Site Reviews is a popular WordPress plugin designed to collect and display customer reviews on websites. It offers an easy-to-use interface for both site owners and customers to submit and view reviews. However, a critical vulnerability, CVE-2025-1232, has been discovered in the plugin. This flaw allows unauthenticated users to inject malicious JavaScript into the review form, which can lead to Stored Cross-Site Scripting (XSS) attacks. These attacks could result in unauthorized account creation with admin privileges, ultimately compromising the security of the affected website. With over 100,000 active installations, this vulnerability poses a significant threat to WordPress sites using the Site Reviews plugin.