Walker Core Vulnerabilities

The Walker Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.3.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages tha...

CVSS:

6.4

Affected:

up to 1.3.17

Fixed in:

1.3.18

Disclosed:

Nov 19, 2025

CVE-2025-67552 on NVD →

The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. An...

CVSS:

6.3

Affected:

up to 1.1.8

Fixed in:

1.1.8

Disclosed:

Mar 4, 2022

CVE-2022-4974 on NVD →