CVE-2026-66612

Unauthenticated reflected XSS vulnerability in the WordPress Aora theme (versions ≤ 1.3.19), exploitable via a crafted link requiring user interaction. CVSS 7.1 HIGH (network, no privileges). No fix version or exploitation details provided; monitor Patchstack advisory for updates.

CVE-2026-66612 WordPress Aora theme <= 1.3.19 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Aora = 1.3.19 versions...

CVE-2026-48129

Kestra CVE-2026-48129 concerns a path traversal in the task inputFiles feature. Before versions 1.3.19, 1.2.19, 1.1.19, and 1.0.43, rendered file names could be prefixed with ../, allowing a caller handling untrusted data or webhook data to create or overwrite files outside the task working direc...

CVE-2026-8503

Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids. Apache::Session::Generate::SHA256 generated session ids insecurely. The default session id generator returns a SHA-256 hash of the built-in rand function, the epoch time, and the PID, that is hashed...

CVE-2026-8503 Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids

Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids. Apache::Session::Generate::SHA256 generated session ids insecurely. The default session id generator returns a SHA-256 hash of the built-in rand function, the epoch time, and the PID, that is hashed...

CVE-2026-8503

CVE-2026-8503 affects Apache::Session::Generate::SHA256 in Perl (versions before 1.3.19). The default ID generator creates a SHA-256 hash of sources with low entropy (rand(), epoch, PID) and hashes that result again, making session IDs predictable. This predictable randomness can enable an attack...

EUVD-2025-38106

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Premmerce Premmerce premmerce allows PHP Local File Inclusion.This issue affects Premmerce: from n/a through = 1.3.19...

CVE-2025-60241

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Premmerce Premmerce premmerce allows PHP Local File Inclusion.This issue affects Premmerce: from n/a through = 1.3.19...

CVE-2025-60241 WordPress Premmerce plugin <= 1.3.19 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Premmerce Premmerce premmerce allows PHP Local File Inclusion.This issue affects Premmerce: from n/a through = 1.3.19...

PT-2025-45282

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Premmerce Premmerce premmerce allows PHP Local File Inclusion.This issue affects Premmerce: from n/a through = 1.3.19...

CVE-2025-64288

Cross-Site Request Forgery CSRF vulnerability in Premmerce Premmerce premmerce allows Cross Site Request Forgery.This issue affects Premmerce: from n/a through = 1.3.19...

EUVD-2025-36607

Cross-Site Request Forgery CSRF vulnerability in Premmerce Premmerce premmerce allows Cross Site Request Forgery.This issue affects Premmerce: from n/a through = 1.3.19...

CVE-2025-64288

Cross-Site Request Forgery CSRF vulnerability in Premmerce Premmerce premmerce allows Cross Site Request Forgery.This issue affects Premmerce: from n/a through = 1.3.19...

CVE-2025-64288 WordPress Premmerce plugin <= 1.3.19 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Premmerce Premmerce premmerce allows Cross Site Request Forgery.This issue affects Premmerce: from n/a through = 1.3.19...

CVE-2025-64288

The CVE-2025-64288 entry refers to a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress Premmerce plugin, affecting versions through 1.3.19. The issue is documented in multiple sources (NVD/Red Hat/EUVD/CIRCL/etc.) with consistent wording that Premmerce allows CSRF. The core affecte...

PT-2025-44264

Name of the Vulnerable Software and Affected Versions Premmerce versions through 1.3.19 Description A Cross-Site Request Forgery CSRF issue exists in Premmerce. This allows attackers to potentially perform actions on behalf of authenticated users without their knowledge. Recommendations Update...

WordPress plugin Premmerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...

CVE-2025-53989

CVE-2025-53989 concerns Crocoblock JetBlocks For Elementor (WordPress plugin). The vulnerability is a Stored Cross-Site Scripting (XSS) in JetBlocks For Elementor versions

WordPress Premmerce plugin <= 1.3.19 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Ryan Novotny in WordPress Plugin Premmerce versions = 1.3.19...

CVE-2024-43349

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in allbootstrapblocks All Bootstrap Blocks all-bootstrap-blocks.This issue affects All Bootstrap Blocks: from n/a through = 1.3.19...