CVE-2025-60136

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in cartpauj User Notes user-notes allows Stored XSS.This issue affects User Notes: from n/a through = 1.0.2...

WordPress User Notes plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nabil Irawan in WordPress Plugin User Notes versions = 1.0.2...

CVE-2025-60136 WordPress User Notes plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in cartpauj User Notes user-notes allows Stored XSS.This issue affects User Notes: from n/a through = 1.0.2...

CVE-2025-60136 WordPress User Notes plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in cartpauj User Notes user-notes allows Stored XSS.This issue affects User Notes: from n/a through = 1.0.2...

CVE-2025-60136

CVE-2025-60136 is a Stored XSS vulnerability in WordPress plugin User Notes (versions up to 1.0.2). It arises from improper input neutralization during web page generation. The CVSS 3.1 score is 5.9 (Medium) with vector AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L; exploit requires high privileges and use...

PT-2025-39579

Name of the Vulnerable Software and Affected Versions cartpauj User Notes versions through 1.0.2 Description The software contains a flaw due to improper handling of user-supplied data when creating web pages, leading to a Stored Cross-site Scripting XSS condition. This allows an attacker to inje...

GHSA-34Q3-8X9V-J957 toggle-array vulnerable to prototype pollution

toggle-array is a package designed to enables a property on the object at the specified index, while disabling the property on all other objects. A Prototype Pollution vulnerability in the enable and disable function of toggle-array v1.0.1 and before allows attackers to inject properties on...

CVE-2025-58969

Missing Authorization vulnerability in Greg Winiarski Custom Login URL custom-login-url allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Login URL: from n/a through = 1.0.2...

Drupal Plausible tracking module < 1.0.2 - Unauthenticated Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS vulnerability discovered by Pierre Rudloff prudloff in WordPress Module Plausible tracking versions 1.0.2...

CVE-2025-58969

Missing Authorization vulnerability in Greg Winiarski Custom Login URL custom-login-url allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Login URL: from n/a through = 1.0.2...

WordPress Custom Login URL Plugin <= 1.0.2 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Nabil Irawan in WordPress Plugin Custom Login URL versions = 1.0.2...

CVE-2025-58969

CVE-2025-58969 affects the Custom Login URL WordPress plugin. The connected document confirms a Missing Authorization issue in Custom Login URL, enabling Unauthorized updates to plugin options via wcmlim_settings_ajax_handler, with affected versions up to and including 1.0.2. The patch for this v...

WordPress plugin Custom Login URL 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

PT-2025-39029

Name of the Vulnerable Software and Affected Versions WordPress Custom Login URL versions through 1.0.2 Description A missing authorization issue exists in Greg Winiarski Custom Login URL, allowing exploitation of incorrectly configured access control security levels. Recommendations Update to a...

CVE-2025-9891 User Sync – Remote User Sync <= 1.0.2 - Cross-Site Request Forgery to Plugin Deactivation

The User Sync – Remote User Sync plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to missing or incorrect nonce validation on the mousersyncformhandler function. This makes it possible for unauthenticated attackers to...

CVE-2025-58451

Cattown is a JavaScript markdown parser. Versions prior to 1.0.2 used regular expressions with inefficient, potentially exponential worst-case complexity. This could cause excessive CPU usage due to excessive backtracking on crafted inputs. In turn, the excessive CPU usage could lead to resource...

GHSA-3J7M-5G4Q-GFPC TinyEnv: Missing .env file not required — may cause unexpected behavior

Impact TinyEnv did not require the .env file to exist when loading environment variables. This could lead to unexpected behavior where the application silently ignores missing configuration, potentially causing insecure defaults or deployment misconfigurations. Affected versions: - 1.0.1 → 1.0.2 ...

Cattown is Vulnerable to Uncontrolled Resource Consumption through Inefficient Regular Expression Complexity

Overview A security review of the Cattown identified multiple weaknesses that could potentially impact its stability and security. Affected Versions - All versions below 1.0.2 Description of Vulnerabilities 1. CWE-1333: Inefficient Regular Expression Complexity The package used regular expression...

GHSA-455V-W7R9-3VV9 Cattown is Vulnerable to Uncontrolled Resource Consumption through Inefficient Regular Expression Complexity

Overview A security review of the Cattown identified multiple weaknesses that could potentially impact its stability and security. Affected Versions - All versions below 1.0.2 Description of Vulnerabilities 1. CWE-1333: Inefficient Regular Expression Complexity The package used regular expression...

TinyEnv 安全漏洞

TinyEnv is an environment variable loader for Dat Duy Personal Developer. A security vulnerability exists in TinyEnv versions 1.0.1, 1.0.2, 1.0.9, and 1.0.10, which stems from a checking deficiency in the .env file that could lead to unsafe default configurations...