Security Intel Hub 231+

WordPress My Calendar <3.4.24 Authenticated Stored XSS Vulnerability (CVE-2024-1274)

WordPress User Activity Log IP Spoofing Vulnerability (CVE-2023-4279)

CVE-2023-2254 WordPress Ko-fi Button Plugin Stored XSS Vulnerability

WP Fastest Cache Unauthenticated SQL Injection (CVE-2023-6063) Analysis

### Vulnerability Key Information - **Vulnerability Name**: Unauthenticated SQL Injection Vulnerability Addressed in WP Fastest Cache 1.2.2 - **Affected Plugin**: WP Fastest Cache - **Plugin URL**: - …

CVE-2024-0420: MapPress Maps for WordPress < 2.88.15 Stored XSS Vulnerability

Based on the provided screenshot, the following is key vulnerability information obtained from the WPScan website: - **Vulnerability Name**: MapPress Maps for WordPress < 2.88.15 - Contributor+ Stored…

YaySMTP < 2.2.2 Stored XSS Vulnerability (CVE-2022-2372)

- **Vulnerability:** - **Title:** YaySMTP < 2.2.2 - Admin+ Stored Cross-Site Scripting - **CVE:** CVE-2022-2372 - **Description:** The plugin does not sanitize and escape some of its settings, allowin…

Flexi Plugin < 4.20 Reflected XSS Vulnerability (CVE-2022-0449)

### Key Information **Title**: Flexi - Guest Submit < 4.20 - Reflected Cross-Site Scripting **Description**: - The plugin fails to sanitize and escape various parameters before outputting certain page…

WP Mail Log < 1.1.3 Contributor+ SQL Injection (CVE-2023-5645)

- **Vulnerability Name**: WP Mail Log < 1.1.3 – Contributor+ SQL Injection in wml_logs endpoint - **Description**: The plugin fails to properly sanitize and escape parameters before using them in SQL …

Easy Contact Form Pro <1.1.1.9 Authenticated Stored XSS (CVE-2021-24168)

### Key Information #### Description - **Vulnerability Type**: Authenticated Stored Cross-Site Scripting (XSS) - **Affected Plugin**: Easy Contact Form Pro <svg/onload=alert(/XSS)` #### References - *…

Jetpack < 12.1.1 Arbitrary File Manipulation and RCE via API (CVE-2023-2996)

### Vulnerability Key Information - **Vulnerability Name**: Jetpack < 12.1.1 - Author+ Arbitrary File Manipulation via API - **Description**: - The plugin does not validate uploaded files, allowing us…

Icegram < 2.1.8 Contributor+ Stored XSS Vulnerability (CVE-2022-1776)

### Vulnerability Information **Title:** Icegram < 2.1.8 - Contributor+ Stored Cross-Site Scripting **Description:** - The plugin does not sanitize and escape certain campaign parameters, which could …

WordPress Landing Page Builder Authenticated Reflected XSS (CVE-2021-25067)

## Key Information ### Vulnerability Overview - **Name**: Landing Page Builder < 1.4.9.6 - Authenticated Reflected Cross-Site Scripting (XSS) - **Description**: This plugin is affected by reflected XS…

ArForms < 6.6 Unauthenticated RCE via File Upload Manipulation

## ArForms ------------------------------231372247329806589063676810774 Content-Disposition: form-data; name="token" 72JcFplqUK ------------------------------23137表247329806589063676810774-- ``` Acces…

Stored XSS in Simple SEO Plugin < 2.0.32 (CVE-2025-10357)

### Key Information #### Description - **Vulnerability Type**: Stored XSS (Cross-Site Scripting) - **Affected Scope**: Simple SEO plugin versions < 2.0.32 - **Issue Description**: The plugin fails to …

OrderConvo < 14 Unauthenticated Arbitrary File Read (CVE-2025-10162)

### Key Information #### Vulnerability Description - **Vulnerability Name**: OrderConvo < 14 - Unauthenticated Arbitrary File Read - **Description**: The plugin does not validate the file path to be d…

CVE-2025-9703: Stored XSS in Ultimate Addons for Elementor Lite < 2.5.0

### Critical Vulnerability Information #### Description - **Vulnerability Name**: Ultimate Addons for Elementor Lite < 2.5.0 - Author+ Stored XSS - **Description**: The plugin does not sanitize SVG fi…

CVE-2025-9512: Unauthenticated Stored XSS in WordPress Plugin schema-and-structured-data-for-wp

### Key Information #### Description - **Vulnerability Type**: Unauthenticated Stored-XSS - **Affected Versions**: Schema & Structured Data for WP & AMP < 1.50 #### Affected Plugin - **Plugin Name**: …

CVE-2025-5920: WordPress Sharable Password Protected Posts Unauthenticated Sensitive Data Exposure

### Key Information #### Vulnerability Description - **Vulnerability Name**: Sharable Password Protected Posts < 1.1.1 - Unauthenticated Password Protect Post Access - **Description**: The plugin allo…