WordPress Streamit plugin <= 4.0.2 - Authenticated (Subscriber+) Privilege Escalation via User Email Change/Account Takeover vulnerability

Authenticated Subscriber+ Privilege Escalation via User Email Change/Account Takeover vulnerability discovered by István Márton in WordPress Theme Streamit versions = 4.0.2...

WordPress Streamit Theme <= 4.0.1 is vulnerable to Arbitrary File Download

Software Streamit Type Theme Vulnerable versions = 4.0.1 Fixed in 4.0.2 OWASP Top 10 A3: Injection Classification Arbitrary File Download CVE CVE-2025-2519 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID 446a13c89b70 Credits István Márton Required privilege Subscriber...

CVE-2025-25977

CVE-2025-25977 is reported with concrete details in connected sources: canvg v4.0.2 is vulnerable via the Constructor of StyleElement, enabling arbitrary code execution with a network-accessible vector. The entry confirms the affected component (canvg) and version (4.0.2) and identifies the root ...

CVE-2024-13879 Stream <= 4.0.2 - Authenticated (Admin+) Server-Side Request Forgery

The Stream plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.0.2 due to insufficient validation on the webhook feature. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to...

CVE-2025-24714

CVE-2025-24714 — Cross-Site Request Forgery in the WordPress plugin “Bubble Menu – circle floating menu” (affecting versions up to 4.0.2). Technical detail from sources shows the issue is a CSRF vulnerability capable of unauthorized actions on behalf of an authenticated user. Patch/mitigation: up...

CVE-2024-56199

phpMyFAQ is vulnerable from versions 3.2.10 through 4.0.1 to an HTML injection in the FAQ editor (https://.../admin/index.php?action=editentry), enabling injected HTML that disrupts the page UI and can lead to DoS and degraded user experience. The issue is fixed in version 4.0.2; upgrading to 4.0...

phpMyFAQ 安全漏洞

phpMyFAQ is a multi-language, fully database-driven FAQ system by the individual developer Thorsten Rinne. A security vulnerability exists in phpMyFAQ version 3.2.10 up to and including version 4.0.2, which stems from malicious HTML content that can be injected into the FAQ editor, corrupting the...

PT-2025-3201 · Phpmyfaq · Phpmyfaq

Name of the Vulnerable Software and Affected Versions: phpMyFAQ versions 3.2.10 through 4.0.2 Description: The issue allows an attacker to inject malicious HTML content into the FAQ editor at "http://localhost/admin/index.php?action=editentry", resulting in a complete disruption of the FAQ page's...

AZL-54564 CVE-2024-45338 affecting package multus for versions less than 4.0.2-7

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service...

CVE-2023-39325 affecting package multus for versions less than 4.0.2-3

CVE-2023-39325 affecting package multus for versions less than 4.0.2-3. A patched version of the package is available...

CVE-2024-10672

The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the mpgupsertprojectsourceblock function in all versions up to, and including, 4.0.2. This makes it possible for authenticated attackers, with...

WordPress MPG Plugin <= 4.0.2 is vulnerable to Path Traversal

Software MPG Type Plugin Vulnerable versions = 4.0.2 Fixed in 4.0.3 OWASP Top 10 A1: Broken Access Control Classification Path Traversal CVE CVE-2024-10672 Patch priority Low CVSS severity Low 2.7 Developer Claim ownership PSID 3c7693c48068 Credits Arkadiusz Hydzik Required privilege Editor...

WordPress MPG Plugin <= 4.0.1 is vulnerable to Broken Access Control

Software MPG Type Plugin Vulnerable versions = 4.0.1 Fixed in 4.0.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-7424 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 61dc998feee8 Credits Rafshanzani Suhada Required privilege...

CVE-2023-3978 affecting package multus for versions less than 4.0.2-5

CVE-2023-3978 affecting package multus for versions less than 4.0.2-5. A patched version of the package is available...

WordPress Atarim Plugin <= 4.0.2 is vulnerable to Broken Access Control

Software Atarim Type Plugin Vulnerable versions = 4.0.2 Fixed in 4.0.3 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-7621 Patch priority Low CVSS severity Low 5.4 Developer Atarim PSID 410d656b7615 Credits Lucio Sá Required privilege Subscriber Published...

WordPress plugin Atarim 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

CVE-2022-32149 affecting package multus for versions less than 4.0.2-1

CVE-2022-32149 affecting package multus for versions less than 4.0.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2020-28852 affecting package multus for versions less than 4.0.2-1

CVE-2020-28852 affecting package multus for versions less than 4.0.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2021-38561 affecting package multus for versions less than 4.0.2-1

CVE-2021-38561 affecting package multus for versions less than 4.0.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2022-21698 affecting package multus for versions less than 4.0.2-1

CVE-2022-21698 affecting package multus for versions less than 4.0.2-1. An upgraded version of the package is available that resolves this issue...