CVE-2025-3912 WS Form LITE – Drag & Drop Contact Form Builder for WordPress <= 1.10.35 - Missing Authorization to Unauthenticated Sensitive Information Exposure

The WS Form LITE – Drag & Drop Contact Form Builder for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getconfig' function in all versions up to, and including, 1.10.35. This makes it possible for unauthenticated attackers to...

PT-2025-17901 · WordPress · Ws Form Lite

Name of the Vulnerable Software and Affected Versions: WS Form LITE – Drag & Drop Contact Form Builder for WordPress versions prior to 1.10.36 Description: The issue allows unauthorized access to data due to a missing capability check on the get config function. This makes it possible for...

CVE-2025-3912: Missing Authorization

The WS Form LITE – Drag & Drop Contact Form Builder for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getconfig' function in all versions up to, and including, 1.10.35. This makes it possible for unauthenticated attackers to...

CVE-2025-46521

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Silver Muru WS Force Login Page ws-force-login-page allows Stored XSS.This issue affects WS Force Login Page: from n/a through = 3.0.3...

CVE-2025-46521

CVE-2025-46521 concerns the WordPress plugin "WS Force Login Page". The vulnerability is a cross‑site scripting (stored XSS) flaw caused by improper input neutralization, affecting versions from n/a up to and including 3.0.3. Public references in the provided documents corroborate stored XSS as t...

CVE-2025-46521 WordPress WS Force Login Page <= 3.0.3 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Silver Muru WS Force Login Page allows Stored XSS. This issue affects WS Force Login Page: from n/a through 3.0.3...

CVE-2025-46521: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Silver Muru WS Force Login Page ws-force-login-page allows Stored XSS.This issue affects WS Force Login Page: from n/a through = 3.0.3...

PT-2025-17825 · Unknown · Silver Muru Ws Force Login Page

Name of the Vulnerable Software and Affected Versions: Silver Muru WS Force Login Page versions n/a through 3.0.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an...

CVE-2025-31400

Cross-Site Request Forgery CSRF vulnerability in icyleaf WS Audio Player ws-audio-player allows Stored XSS.This issue affects WS Audio Player: from n/a through = 1.1.8...

CVE-2025-31400

Cross-Site Request Forgery CSRF vulnerability in icyleaf WS Audio Player ws-audio-player allows Stored XSS.This issue affects WS Audio Player: from n/a through = 1.1.8...

CVE-2025-31400

CVE-2025-31400 describes a CSRF leading to Stored XSS in the WS Audio Player (ICYLEAF WS Audio Player). Affected versions: WS Audio Player up to 1.1.8. The CVE entry, referenced by Patchstack and Wordfence, lists a CVSSv3.1 base score of 7.1 (HIGH) with network attack vector, low attack complexit...

CVE-2025-31400 WordPress WS Audio Player plugin <= 1.1.8 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in icyleaf WS Audio Player ws-audio-player allows Stored XSS.This issue affects WS Audio Player: from n/a through = 1.1.8...

CVE-2025-31400 WordPress WS Audio Player plugin <= 1.1.8 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in icyleaf WS Audio Player allows Stored XSS. This issue affects WS Audio Player: from n/a through 1.1.8...

WordPress plugin WS Audio Player 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

CVE-2025-31400: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in icyleaf WS Audio Player ws-audio-player allows Stored XSS.This issue affects WS Audio Player: from n/a through = 1.1.8...

The vulnerability of the set_ws_action() function in D-Link DAP-1620 wireless repeater software allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the setwsaction function in D-Link DAP-1620 wireless repeater microprogramming software lies in the fact that the operation’s output escapes the buffer and enters memory. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrity, and...

CVE-2025-2618

A vulnerability, which was classified as critical, has been found in D-Link DAP-1620 1.03. Affected by this issue is the function setwsaction of the file /dws/api/ of the component Path Handler. The manipulation leads to heap-based buffer overflow. The attack may be launched remotely. The exploit...

CVE-2024-11045

A Cross-Site WebSocket Hijacking CSWSH vulnerability in automatic1111/stable-diffusion-webui version 1.10.0 allows an attacker to clone a malicious server extension from a GitHub repository. The vulnerability arises from the lack of proper validation on WebSocket connections at...

CVE-2024-11045: Improper Access Control

A Cross-Site WebSocket Hijacking CSWSH vulnerability in automatic1111/stable-diffusion-webui version 1.10.0 allows an attacker to clone a malicious server extension from a GitHub repository. The vulnerability arises from the lack of proper validation on WebSocket connections at...

PT-2025-12489

Name of the Vulnerable Software and Affected Versions D-Link DAP-1620 version 1.03 Description A critical issue has been found in the function set ws action of the file /dws/api/ of the component Path Handler, leading to a heap-based buffer overflow. This issue can be exploited remotely. The...