30117 matches found
WordPress DT LMS – elearning, WordPress LMS Plugin plugin <= 1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification vulnerability
Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification vulnerability discovered by adhikara13 in WordPress Plugin DT LMS – elearning, WordPress LMS Plugin versions = 1.1...
CVE-2025-15695
The Translate WordPress with GTranslate WordPress plugin before 3.0.10 does not validate one of its settings before the bundled front-end scripts build markup from it, allowing users with a role as high as administrator to store JavaScript that runs in the session of any visitor to the site...
CVE-2026-74925 MultiVendorX 5.0.0 - 5.0.15 - Store Owner+ Privilege Escalation to Administrator
The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site...
CVE-2026-74925
The MultiVendorX WordPress plugin (versions 5.0.0-5.0.15 ) contains a privilege escalation vulnerability because it fails to restrict who can update its role and capability settings . This allows users with the vendor role to grant that role administrator-level capabilities , potentially leading ...
CVE-2025-15695 GTranslate < 3.0.10 - Admin+ Stored XSS
The Translate WordPress with GTranslate WordPress plugin before 3.0.10 does not validate one of its settings before the bundled front-end scripts build markup from it, allowing users with a role as high as administrator to store JavaScript that runs in the session of any visitor to the site...
CVE-2025-15695 GTranslate < 3.0.10 - Admin+ Stored XSS
The Translate WordPress with GTranslate WordPress plugin before 3.0.10 does not validate one of its settings before the bundled front-end scripts build markup from it, allowing users with a role as high as administrator to store JavaScript that runs in the session of any visitor to the site...
CVE-2025-15695
The Translate WordPress with GTranslate plugin (versions before 3.0.10 ) contains a Stored XSS vulnerability. The root cause is a failure to validate specific settings before bundled front-end scripts generate markup. This allows users with high-level privileges, such as administrators , to injec...
EUVD-2025-210888
The Translate WordPress with GTranslate WordPress plugin before 3.0.10 does not validate one of its settings before the bundled front-end scripts build markup from it, allowing users with a role as high as administrator to store JavaScript that runs in the session of any visitor to the site...
PT-2026-90052
Kiro IDE - Agent-Written Config - Data Exfiltration Attack Path - 1. Open a specially crafted untrusted repository in Kiro IDE. 2. The AI agent modifies the workspace configuration to point the Powers registry at an attacker-controlled endpoint. 3. Kiro asks the user to approve the change, but th...
PT-2026-89770
The Translate WordPress with GTranslate WordPress plugin before 3.0.10 does not validate one of its settings before the bundled front-end scripts build markup from it, allowing users with a role as high as administrator to store JavaScript that runs in the session of any visitor to the site...
CVE-2026-89332: Inclusion of Functionality from Untrusted Control Sphere
Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version 0.8.135 might allow remote unauthenticated actors to obtain sensitive information from a developer workstation. Crafted repository content can cause the agent to modify the...
CVE-2026-74925: Improper Privilege Management
The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site...
io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing
A flaw was found in Netty, a network application framework. A remote attacker, by sending a specially crafted SPDY/3.1 SETTINGS frame, could cause the SPDY SETTINGS decoder to create a large number of map entries. This excessive processing and memory allocation can lead to a denial of service DoS...
EUVD-2026-75624
In the silabser.sys Windows 8 driver for CP210x devices, a local unprivileged user can use incorrect driver settings to cause a kernel crash...
CVE-2026-15417 CP210x Denial of Service
In the silabser.sys Windows 8 driver for CP210x devices, a local unprivileged user can use incorrect driver settings to cause a kernel crash...
CVE-2026-15417 CP210x Denial of Service
In the silabser.sys Windows 8 driver for CP210x devices, a local unprivileged user can use incorrect driver settings to cause a kernel crash...
io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing
A flaw was found in Netty, a network application framework. A remote attacker, by sending a specially crafted SPDY/3.1 SETTINGS frame, could cause the SPDY SETTINGS decoder to create a large number of map entries. This excessive processing and memory allocation can lead to a denial of service DoS...
CVE-2026-81801
Subscriber Settings Change in WP-Stateless = 4.4.1 versions...