CVE-2025-27283

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in rockgod100 Theme File Duplicator theme-file-duplicator allows Path Traversal.This issue affects Theme File Duplicator: from n/a through = 1.3...

CVE-2025-39438

Cross-Site Request Forgery CSRF vulnerability in momen2009 Theme Changer theme-changer allows Cross Site Request Forgery.This issue affects Theme Changer: from n/a through = 1.4...

GO-2025-3638 ServerHellos are accepted without checking TLS 1.3 downgrade canaries in github.com/refraction-networking/utls

Before version 1.7.0, utls did not implement the TLS 1.3 downgrade protection mechanism specified in RFC 8446 Section 4.1.3 when using a utls ClientHello spec. This allowed an active network adversary to downgrade TLS 1.3 connections initiated by a utls client to a lower TLS version e.g., TLS 1.2...

CVE-2025-46542

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeXpert Xpert Tab xpert-tab allows Stored XSS.This issue affects Xpert Tab: from n/a through = 1.3...

CVE-2025-46442

Cross-Site Request Forgery CSRF vulnerability in Casey Johnson Loan Calculator repayment-calculator allows Stored XSS.This issue affects Loan Calculator: from n/a through = 1.3...

CVE-2025-46442

CVE-2025-46442 is a CSRF to Stored XSS vulnerability affecting the WordPress Loan Calculator plugin for versions n/a through 1.3. The CVSS base score is 7.1 (HIGH). Exploitation details are not provided in the initial description beyond the CSRF/XSS combo; connected documents corroborate the CSRF...

CVE-2025-46442 WordPress Loan Calculator plugin <= 1.3 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Casey Johnson Loan Calculator repayment-calculator allows Stored XSS.This issue affects Loan Calculator: from n/a through = 1.3...

CVE-2025-46542

CVE-2025-46542 : WordPress plugin Xpert Tab (ThemeXpert) is affected by a stored XSS due to improper input neutralization during web page generation. Affected versions are 1.3 and earlier. The CVSS v3.1 base vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L with a base score of 6.5 (Medium). Public d...

CVE-2025-46506

CVE-2025-46506 describes a CSRF-to-Reflected XSS in the WordPress plugin WpZon – Amazon Affiliate Plugin (versions

CVE-2025-46506 WordPress WpZon – Amazon Affiliate Plugin plugin <= 1.3 - CSRF to XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Lora77 WpZon – Amazon Affiliate Plugin wpzon allows Reflected XSS.This issue affects WpZon – Amazon Affiliate Plugin: from n/a through = 1.3...

WordPress plugin Xpert Tab 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress plugin WpZon – Amazon Affiliate Plugin 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery...

uTLS ServerHellos are accepted without checking TLS 1.3 downgrade canaries

Description Before version 1.7.0, utls did not implement the TLS 1.3 downgrade protection mechanism specified in RFC 8446 Section 4.1.3 when using a utls ClientHello spec. This allowed an active network adversary to downgrade TLS 1.3 connections initiated by a utls client to a lower TLS version...

CVE-2025-22655

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Caio Web Dev CWD – Stealth Links cwd-stealth-links allows SQL Injection.This issue affects CWD – Stealth Links: from n/a through = 1.3...

CVE-2025-27295 WordPress Live css plugin <= 1.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpion Live css css-live allows Stored XSS.This issue affects Live css: from n/a through = 1.3...

CVE-2025-32557 WordPress WP Featured Screenshot Plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Rico Macchi WP Featured Screenshot allows Reflected XSS. This issue affects WP Featured Screenshot: from n/a through 1.3...

CVE-2025-32557 WordPress WP Featured Screenshot Plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Rico Macchi WP Featured Screenshot wp-featured-screenshot allows Reflected XSS.This issue affects WP Featured Screenshot: from n/a through = 1.3...

CVE-2025-39438 WordPress Theme Changer plugin <= 1.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in momen2009 Theme Changer allows Cross Site Request Forgery. This issue affects Theme Changer: from n/a through 1.3...

WordPress plugin WP Featured Screenshot 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress plugin Theme File Duplicator 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A path traversal vulnerability exists in...