WordPress plugin Everest Forms 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

CVE-2025-32522

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Saad Iqbal License Manager for WooCommerce license-manager-for-woocommerce allows Reflected XSS.This issue affects License Manager for WooCommerce: from n/a through = 3.0.9...

WordPress plugin License Manager for WooCommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2025-28921

CVE-2025-28921 is a Reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin SpatialMatch IDX (NotFound SpatialMatch IDX). Affected versions are up to 3.0.9. The CVE description notes improper neutralization of input during web page generation, enabling reflected XSS. The associ...

VulnCheck KEV: CVE-2024-3809

The Porto Theme - Functionality plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.9 via the 'slideshowtype' post meta. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute...

Relative Path Traversal

Overview Affected versions of this package are vulnerable to Relative Path Traversal through the manipulation of the file path in StaticMappings.java using a relative path such as '../filedir'. An attacker can access files and directories stored outside of the web server's root directory by...

GHSA-X8Q6-CCHR-P7M6 Solon Path Traversal

A vulnerability classified as problematic was found in opensolon Solon up to 3.0.8. This vulnerability affects unknown code of the file solon-projects/solon-web/solon-web-staticfiles/src/main/java/org/noear/solon/web/staticfiles/StaticMappings.java. The manipulation leads to path traversal:...

CVE-2025-1584

Solon up to 3.0.8 is affected by a path traversal in StaticMappings.java (StaticMappings.java) that can be triggered remotely via a ../filedir payload. Public exploit information exists; upgrading to 3.0.9 mitigates the issue. The patch is identified as f46e47fd1f8455b9467d7ead3cdb0509115b2ef1. A...

CVE-2025-1584 opensolon Solon StaticMappings.java path traversal

A vulnerability classified as problematic was found in opensolon Solon up to 3.0.8. This vulnerability affects unknown code of the file solon-projects/solon-web/solon-web-staticfiles/src/main/java/org/noear/solon/web/staticfiles/StaticMappings.java. The manipulation leads to path traversal:...

CVE-2024-38764 WordPress i-transform theme <= 3.0.9 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Marsian allows Cross Site Request Forgery.This issue affects i-transform: from n/a through 3.0.9...

PT-2024-36131 · Unknown · Prodigy Commerce

Name of the Vulnerable Software and Affected Versions: Prodigy Commerce versions 3.0.9 and earlier Description: The issue is related to a Missing Authorization vulnerability in Prodigy Commerce, allowing the exploitation of incorrectly configured access control security levels. Recommendations: F...

WordPress plugin Prodigy Commerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-53781

CVE-2024-53781 refers to a CSRF-to-Stored XSS vulnerability in the WordPress plugin SpatialMatch IDX (

WordPress plugin SpatialMatch IDX 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request...

PT-2024-35894 · Home Junction · Spatialmatch Idx

Name of the Vulnerable Software and Affected Versions: Home Junction SpatialMatch IDX versions n/a through 3.0.9 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

WordPress SpatialMatch IDX plugin <= 3.0.9 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin SpatialMatch IDX versions = 3.0.9...

GHSA-8237-957H-H2C2 FileManager Deserialization of Untrusted Data vulnerability

Impact Deserialization of untrusted data from the mimes parameter could lead to remote code execution. Patches Fixed in 3.0.9 Workarounds Not needed, a composer update will solve it in a non-breaking way. References Reported responsibly Vladislav Gladkiy at Positive Technologies...

CVE-2024-52306

FileManager provides a Backpack admin interface for files and folder. Prior to 3.0.9, deserialization of untrusted data from the mimes parameter could lead to remote code execution. This vulnerability is fixed in 3.0.9...

CVE-2024-52306 FileManager Deserialization of Untrusted Data

FileManager provides a Backpack admin interface for files and folder. Prior to 3.0.9, deserialization of untrusted data from the mimes parameter could lead to remote code execution. This vulnerability is fixed in 3.0.9...

PT-2024-16298 · Vince · Vince

Name of the Vulnerable Software and Affected Versions: VINCE versions prior to 3.0.9 Description: The issue allows exposure of user information to authenticated users. Recommendations: For versions prior to 3.0.9, update to version 3.0.9 or later to resolve the issue...