WordPress Administrative Shortcodes plugin <= 0.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'login' and 'logout' Shortcode Attributes vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'login' and 'logout' Shortcode Attributes vulnerability discovered by zaim in WordPress Plugin Administrative Shortcodes versions = 0.3.4...

WordPress Administrative Shortcodes plugin <= 0.3.4 - Authenticated (Contributor+) Local File Inclusion via 'slug' Shortcode Attribute vulnerability

Authenticated Contributor+ Local File Inclusion via 'slug' Shortcode Attribute vulnerability discovered by zaim in WordPress Plugin Administrative Shortcodes versions = 0.3.4...

WordPress Plugin Administrative Shortcodes Cross-Site Script Vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be installed t...

PT-2026-4588

The Administrative Shortcodes plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.3.4 via the 'slug' attribute of the 'get template' shortcode. This is due to insufficient path validation on user-supplied input passed to the get template part functio...

EUVD-2020-0062

Malware in sbrugna...

EUVD-2021-1064

Malware in sbrugna...

EUVD-2021-1726

Malware in sbrugna...

EUVD-2025-29241

Malicious code in bioql PyPI...

EUVD-2025-28330

Malicious code in bioql PyPI...

EUVD-2025-30492

Malicious code in bioql PyPI...

EUVD-2024-45587

Malicious code in bioql PyPI...

EUVD-2022-0356

Malicious code in bioql PyPI...

CVE-2025-58685

Missing Authorization vulnerability in cecabank Cecabank WooCommerce Plugin cecabank-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cecabank WooCommerce Plugin: from n/a through = 0.3.4...

WordPress Cecabank WooCommerce plugin plugin <= 0.3.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Bao - BlueRock in WordPress Plugin Cecabank WooCommerce Plugin versions = 0.3.4...

CVE-2025-58685

CVE-2025-58685 affects the Cecabank WooCommerce Plugin for WordPress (versions up to 0.3.4). The issue is a Missing Authorization vulnerability caused by incorrectly configured access control, allowing unauthenticated access to restricted functionality. Wordfence data lists base score 5.3 (Medium...

CVE-2025-58685 WordPress Cecabank WooCommerce plugin plugin <= 0.3.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in cecabank Cecabank WooCommerce Plugin cecabank-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cecabank WooCommerce Plugin: from n/a through = 0.3.4...

WordPress plugin Cecabank WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to set up personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...

CVE-2025-59331

is-arrayish checks if an object can be used like an Array. On 8 September 2025, an npm publishing account for is-arrayish was taken over after a phishing attack. Version 0.3.3 was published, functionally identical to the previous patch version, but with a malware payload added attempting to...

CVE-2025-59331

CVE-2025-59331 concerns the npm package is-arrayish. Version 0.3.3 was published after an attacker gained control of a publishing account and inserted a malware payload intended to redirect cryptocurrency transactions in browser environments. Local/server/CLI contexts are not affected. The issue ...

CVE-2025-59331 [email protected] contains malware after npm account takeover

is-arrayish checks if an object can be used like an Array. On 8 September 2025, an npm publishing account for is-arrayish was taken over after a phishing attack. Version 0.3.3 was published, functionally identical to the previous patch version, but with a malware payload added attempting to...