WordPress security by component

ProjectList

Plugin description

ProjectList is a WordPress component with 2 published CVE records in this archive. The latest tracked vulnerability was published Nov 25, 2025; the highest CVE/CNA score is 7.2.

Plugin slug: projectlist

Latest vulnerability

CVE-2025-13376: ProjectList: Dangerous file upload

ProjectList is affected by dangerous file upload. Exploitation requires at least editor-level access. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.

PublishedNov 25, 2025

Safe version guidanceSee mitigation notes

		Safe version
Nov 25, 2025	CVE-2025-13376 ProjectList: Dangerous file upload ProjectList is affected by dangerous file upload. Exploitation requires at least editor-level access. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.	See mitigation notes	CVE7.2 NVDPending
Nov 25, 2025	CVE-2025-13370 ProjectList: SQL injection ProjectList is affected by SQL injection. Exploitation requires at least editor-level access. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE4.9 NVDPending