CVE-2025-46443 WordPress Animate plugin <= 0.5 - Server Side Request Forgery (SSRF) Vulnerability

Server-Side Request Forgery SSRF vulnerability in Adam Pery Animate animate allows Server Side Request Forgery.This issue affects Animate: from n/a through = 0.5...

PT-2025-15730 · Unknown · Comment Validation Reloaded

Name of the Vulnerable Software and Affected Versions: Comment Validation Reloaded versions 0.5 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

WordPress plugin Comment Validation Reloaded 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site request forgery...

CVE-2025-28873 WordPress Shuffle plugin <= 0.5 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Scott Taylor Shuffle shuffle allows Blind SQL Injection.This issue affects Shuffle: from n/a through = 0.5...

WordPress Shuffle plugin <= 0.5 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Theme Shuffle versions = 0.5...

CVE-2025-25103 WordPress Indeed API Plugin <= 0.5 - CSRF to Settings Change vulnerability

Cross-Site Request Forgery CSRF vulnerability in bnielsen Indeed API indeed-api allows Cross Site Request Forgery.This issue affects Indeed API: from n/a through = 0.5...

PT-2025-5932 · Unknown · Bnielsen Indeed Api

Name of the Vulnerable Software and Affected Versions: bnielsen Indeed API versions 0.5 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This is achieved by tricking the user into...

WordPress plugin Indeed API 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

WordPress Indeed API Plugin <= 0.5 - CSRF to Settings Change vulnerability

CSRF to Settings Change vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Indeed API versions = 0.5...

WordPress plugin Single-user-chat 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2025-22324

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Andon Ivanov OZ Canonical oz-canonical allows Reflected XSS.This issue affects OZ Canonical: from n/a through = 0.5...

CVE-2025-22324

CVE-2025-22324 | Affects OZ Canonical (Andon Ivanov). Root cause: improper input neutralization during web page generation, enabling a reflected XSS. Affected versions: OZ Canonical from n/a through 0.5. CVSS v3.1 base score 7.1 (HIGH). Exploitation status in connected docs: CVE entry shows explo...

PT-2025-4439 · Unknown · Oz Canonical

Name of the Vulnerable Software and Affected Versions: OZ Canonical versions 0.5 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows Reflected Cross-site Scripting XSS. This means an attacker can inject malicious scripts into ...

CVE-2024-47821

pyLoad is a free and open-source Download Manager. The folder /.pyload/scripts has scripts which are run when certain actions are completed, for e.g. a download is finished. By downloading a executable file to a folder in /scripts and performing the respective action, remote code execution can be...

PT-2024-33391 · Unknown · James Park Analyse Uploads

Name of the Vulnerable Software and Affected Versions: James Park Analyse Uploads versions 0.5 and earlier Description: A Relative Path Traversal issue affects James Park Analyse Uploads, allowing unauthorized access to files. The issue is related to the Analyse Uploads component. Recommendations...

WordPress plugin Analyse Uploads 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-45303 Discourse Calendar plugin event names susceptible to XSS

Discourse Calendar plugin adds the ability to create a dynamic calendar in the first post of a topic to Discourse. Rendering event names can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse’s default Content Security Policy. The issue ...

CVE-2024-45303

CVE-2024-45303 concerns the Discourse Calendar plugin, which allows dynamic calendars in topic first posts. The root issue is that rendering of event names can be exploited for cross-site scripting (XSS) when a site has modified or disabled Discourse’s default Content Security Policy. The vulnera...

CVE-2024-45303 Discourse Calendar plugin event names susceptible to XSS

Discourse Calendar plugin adds the ability to create a dynamic calendar in the first post of a topic to Discourse. Rendering event names can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse’s default Content Security Policy. The issue ...

PT-2024-31556 · Discourse · Discourse Calendar Plugin

Name of the Vulnerable Software and Affected Versions: Discourse Calendar plugin versions prior to 0.5 Description: The Discourse Calendar plugin is susceptible to XSS attacks when rendering event names. This issue only affects sites that have modified or disabled Discourse's default Content...