6.4

CVSS3.1

CVE-2025-11826 - WP Company Info <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The WP Company Info plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' attribute of the 'social-networks' shortcode in all versions up to, and including, 1.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacke…

📅 Published: Nov. 21, 2025, 8:28 a.m. 🔄 Last Modified: Nov. 21, 2025, 2:55 p.m.

4.9

CVSS3.1

CVE-2025-11973 - 简数采集器 <= 2.6.3 - Authenticated (Admin+) Arbitrary File Read

The 简数采集器 plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.6.3 via the __kds_flag functionality that imports featured images. This makes it possible for authenticated attackers, with Adminstrator-level access and above, to read the contents of arbitr…

📅 Published: Nov. 21, 2025, 8:28 a.m. 🔄 Last Modified: Nov. 21, 2025, 3:13 p.m.

5.3

CVSS3.1

CVE-2025-12039 - BigBuy Dropshipping Connector for WooCommerce <= 2.0.5 - Unauthenticated IP Spoofing to phpinfo() E…

The BigBuy Dropshipping Connector for WooCommerce plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 2.0.5 due to insufficient IP address validation and use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for un…

📅 Published: Nov. 21, 2025, 8:28 a.m. 🔄 Last Modified: Nov. 21, 2025, 3:13 p.m.

6.4

CVSS3.1

CVE-2025-11803 - WPSite Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The WPSite Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'format' shortcode attribute in the wpsite_y shortcode and the 'before' attribute in the wpsite_postauthor shortcode in all versions up to, and including, 1.2. This is due to insufficient input sanitizati…

📅 Published: Nov. 21, 2025, 8:28 a.m. 🔄 Last Modified: Nov. 21, 2025, 3:13 p.m.

6.4

CVSS3.1

CVE-2025-11800 - Surbma | MiniCRM Shortcode <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Surbma | MiniCRM Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute of the 'minicrm' shortcode in all versions up to, and including, 2.0. This is due to insufficient input sanitization and output escaping. This makes it possible for auth…

📅 Published: Nov. 21, 2025, 7:31 a.m. 🔄 Last Modified: Nov. 21, 2025, 2:55 p.m.

8.8

CVSS3.1

CVE-2025-11985 - Realty Portal <= 0.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Upd…

The Realty Portal plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'rp_save_property_settings' function in versions 0.1 to 0.4.1. This makes it possible for authenticated attackers, with Subscriber…