Slider & Popup Builder by Depicter CVE-2025-2011: Unauthenticated SQL Injection (100,000+ Sites, CVSS 9.3)
CVE-2025-2011 is a critical unauthenticated SQL injection in Slider & Popup Builder by Depicter (versions up to 3.6.1)…
Category
CVE
Security vulnerability reports and CVE analysis for WordPress plugins, themes, and core.
Email Subscribers by Icegram Express CVE-2024-2876: Unauthenticated SQL Injection (CVSS 9.8)
CVE-2024-2876 is a critical unauthenticated SQL injection flaw in the popular Email Subscribers by Icegram Express plugin, scoring…
NotificationX CVE-2024-1698: Unauthenticated SQL Injection in a 30,000-Site WordPress Plugin (CVSS 9.8)
NotificationX, the popular FOMO and social-proof plugin for WordPress, contained an unauthenticated SQL injection flaw (CVE-2024-1698, CVSS 9.8)…
Alone Theme CVE-2025-5394: Unauthenticated File Upload to RCE, Actively Exploited (CVSS 9.8)
A critical flaw in the Alone – Charity Multipurpose Non-profit WordPress theme (CVE-2025-5394, CVSS 9.8) let unauthenticated attackers…
Profile Builder CVE-2024-6695: Unauthenticated Privilege Escalation to Admin (CVSS 9.8)
A critical flaw (CVE-2024-6695, CVSS 9.8) in the Profile Builder plugin let unauthenticated attackers register their way into…
CVE-2025-11749: AI Engine Plugin Leaked Admin Bearer Tokens on 100,000+ WordPress Sites (CVSS 9.8)
A critical flaw in the popular AI Engine plugin exposed a secret Bearer Token through an unauthenticated REST…
Motors Theme CVE-2025-4322: Unauthenticated Admin Account Takeover on 22,000+ WordPress Sites (CVSS 9.8)
CVE-2025-4322 is a critical flaw in the premium Motors WordPress theme that let unauthenticated attackers reset any user's…
Modern Events Calendar CVE-2024-5441: Arbitrary File Upload to RCE on 150,000 WordPress Sites (CVSS 8.8)
A missing file-type check in Modern Events Calendar (CVE-2024-5441, CVSS 8.8) let low-privileged and even unauthenticated users upload…
CVE-2024-8672: Contributor-to-RCE in the Widget Options Plugin (100,000+ Sites, CVSS 9.9)
A critical flaw in Widget Options, a WordPress plugin on 100,000+ sites, let any Contributor-level user run arbitrary…
WP Ghost CVE-2025-26909: Unauthenticated LFI to RCE in a 200,000-Site Security Plugin (CVSS 9.6)
A critical flaw in WP Ghost (Hide My WP Ghost), a WordPress security plugin with over 200,000 installs,…