Title	CVE ID	CVSS	Vector	Date
WPBifröst – Instant Passwordless Temporary Login Links <= 1.0.7 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation	CVE-2025-10299	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	October 14, 2025
External Login <= 1.11.2 - Unauthenticated SQL Injection via log	CVE-2025-11177	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	October 14, 2025
External Login <= 1.11.2 - Authenticated (Subscriber+) Sensitive Data Exposure via Test Connection	CVE-2025-11196	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	October 14, 2025
Login with YourMembership - YM SSO Login <= 1.1.7 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'moym_display_test_attributes'	CVE-2025-10648	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	October 14, 2025
WhyDonate – FREE Donate button – Crowdfunding – Fundraising <= 4.0.15 - Missing Authorization to Unauthenticated wp_wdplugin_style Rww Deletion	CVE-2025-10186	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	October 14, 2025
Task Scheduler <= 1.6.3 - Authenticated (Admin+) Blind Server-Side Request Forgery	CVE-2025-10056	4.4	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N	October 14, 2025
Oceanpayment CreditCard Gateway <= 6.0 - Missing Authentication to Unauthenticated Order Status Update	CVE-2025-11728	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	October 14, 2025
Zip Attachments <= 1.6 - Missing Authorization to Unauthenticated Private And Password-Protected Posts Attachment Disclosure	CVE-2025-11701	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	October 14, 2025
Zip Attachments <= 1.6 - Missing Authorization to Limited File Deletion	CVE-2025-11692	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	October 14, 2025
OwnID Passwordless Login <= 1.3.4 - Authentication Bypass	CVE-2025-10294	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	October 14, 2025
WP Headless CMS Framework <= 1.15 - Unauthenticated Protection Mechanism Bypass	CVE-2025-11260	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	October 14, 2025
Code Quality Control Tool <= 2.1 - Unauthenticated Information Exposure via Log Files	CVE-2025-8484	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	October 10, 2025
CM Registration – Tailored tool for seamless login and invitation-based registrations <= 2.5.6 - Open Redirect	CVE-2025-11167	4.7	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N	October 10, 2025
Integrate Dynamics 365 CRM <= 1.0.9 - Missing Authorization	CVE-2025-10746	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	October 3, 2025
OAuth Single Sign On – SSO (OAuth Client) <= 6.26.12 - Authentication Bypass via get_resource_owner_from_id_token()	CVE-2025-9485	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	October 3, 2025
Smart Docs <= 1.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting	CVE-2025-9333	5.5	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N	October 2, 2025
TableGen – Data Table Generator <= 1.3.1 - Authenticated (Admin+) Stored Cross-Site Scripting	CVE-2025-10053	4.4	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N	October 2, 2025
ContentMX Content Publisher <= 1.0.6 - Cross-Site Request Forgery	CVE-2025-9889	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	October 2, 2025
MPWizard – Create Mercado Pago Payment Links <= 1.2.1 - Cross-Site Request Forgery to Arbitrary Post Deletion	CVE-2025-9885	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	October 2, 2025
Backup Bolt <= 1.4.1 - Authenticated (Admin+) Arbitrary File Download	CVE-2025-10306	3.8	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N	October 2, 2025

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation