| CVE ID | Title | Vendor | Product | Severity | CVSS Score | Published At | AI Analysis |
|---|---|---|---|---|---|---|---|
| CVE-2025-4966 | WP Online Users Stats <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via hk_dataset_results Function | hk1993 | WP Online Users Stats | Medium | 6.1 | 2025-06-06 06:42:52 | Deep Dive |
| CVE-2025-4964 | WP Online Users Stats <= 1.0.0 - Authenticated (Editor+) SQL Injection via table_name Parameter | hk1993 | WP Online Users Stats | Medium | 4.9 | 2025-06-06 06:42:52 | Deep Dive |
| CVE-2025-47580 | WordPress Front End Users plugin <= 3.2.35 - Broken Access Control vulnerability | Rustaurius | Front End Users | Medium | 5.4 | 2025-05-15 17:07:42 | Deep Dive |
| CVE-2024-13569 | Front End Users <= 3.2.32 - Reflected XSS | Unknown | Front End Users | 中危 | - | 2025-04-22 06:00:02 | Deep Dive |
| CVE-2025-23858 | WordPress Custom Users Order Plugin <= 4.2 - Reflected Cross Site Scripting (XSS) vulnerability | Hiren Patel | Custom Users Order | High | 7.1 | 2025-04-17 15:48:28 | Deep Dive |
| CVE-2025-32603 | WordPress WP Online Users Stats plugin <= 1.0.0 - SQL Injection vulnerability | HK | WP Online Users Stats | Critical | 9.3 | 2025-04-11 08:43:00 | Deep Dive |
| CVE-2025-2874 | User Submitted Posts <= 20241026 - Authenticated (Admin+) Stored Cross-Site Scripting | specialk | User Submitted Posts – Enable Users to Submit Posts from the Front End | Medium | 4.4 | 2025-04-03 07:21:22 | Deep Dive |
| CVE-2024-12410 | Front End Users <= 3.2.32 - Authenticated (Admin+) SQL injection | rustaurius | Front End Users | Medium | 4.9 | 2025-04-02 09:21:44 | Deep Dive |
| CVE-2025-2005 | Front-End-Only-Users <= 3.2.32 - Unauthenticated Arbitrary File Upload | rustaurius | Front End Users | Critical | 9.8 | 2025-04-02 09:21:43 | Deep Dive |
| CVE-2025-2332 | Export All Posts, Products, Orders, Refunds & Users <= 2.13 - Unauthenticated PHP Object Injection | smackcoders | Export All Posts, Products, Orders, Refunds & Users | Critical | 9.8 | 2025-03-27 05:22:30 | Deep Dive |
| CVE-2025-1973 | Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function | webtoffee | Export and Import Users and Customers | Medium | 4.9 | 2025-03-22 11:23:32 | Deep Dive |
| CVE-2025-1971 | Export and Import Users and Customers <= 2.6.2 - Authenticated (Admin+) PHP Object Injection via form_data Parameter | webtoffee | Export and Import Users and Customers | High | 7.2 | 2025-03-22 11:18:41 | Deep Dive |
| CVE-2025-1970 | Export and Import Users and Customers <= 2.6.2 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function | webtoffee | Export and Import Users and Customers | High | 7.6 | 2025-03-22 11:18:41 | Deep Dive |
| CVE-2025-1972 | Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function | webtoffee | Export and Import Users and Customers | Low | 2.7 | 2025-03-22 11:18:40 | Deep Dive |
| CVE-2025-28901 | WordPress Members page only for logged in users plugin <= 1.4.2 - CSRF to Stored XSS vulnerability | Naren | Members page only for logged in users | High | 7.1 | 2025-03-11 21:00:52 | Deep Dive |
| CVE-2025-26877 | WordPress Front End Users Plugin <= 3.2.30 - Cross Site Scripting (XSS) vulnerability | Rustaurius | Front End Users | Medium | 6.5 | 2025-02-25 14:17:51 | Deep Dive |
| CVE-2024-13563 | Front End Users <= 3.2.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via forgot-password Shortcode | rustaurius | Front End Users | Medium | 6.4 | 2025-02-15 08:25:05 | Deep Dive |
| CVE-2024-12315 | Export All Posts, Products, Orders, Refunds & Users <= 2.9.3 - Information Disclosure Through Unprotected Directory | smackcoders | Export All Posts, Products, Orders, Refunds & Users | High | 7.5 | 2025-02-12 08:25:43 | Deep Dive |
| CVE-2025-24689 | WordPress Import and export users and customers plugin 1.27.12 - Sensitive Data Exposure vulnerability | Javier Carazo | Import and export users and customers | Medium | 5.9 | 2025-01-27 14:22:18 | Deep Dive |
| CVE-2024-12637 | Moving Users <= 1.05 - Unauthenticated Sensitive Information Exposure | katsushi-kawamori | Moving Users | Medium | 5.3 | 2025-01-17 07:01:28 | Deep Dive |