CVE-2025-25136

CVE-2025-25136 is a stored Cross‑Site Scripting (XSS) vulnerability in the WordPress plugin “Optimate Ads” (versions up to 1.0.3, per multiple sources). The issue is described as improper neutralization of input during web page generation, enabling stored XSS. Public advisories indicate a MEDIUM ...

CVE-2025-25071 WordPress Vignette Ads plugin <= 0.2 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in topplugins Vignette Ads vignete-ads allows Stored XSS.This issue affects Vignette Ads: from n/a through = 0.2...

CVE-2025-25071 WordPress Vignette Ads plugin <= 0.2 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in topplugins Vignette Ads vignete-ads allows Stored XSS.This issue affects Vignette Ads: from n/a through = 0.2...

CVE-2025-25071

CVE-2025-25071 : CSRF to Stored XSS in the WordPress plugin Vignette Ads (versions n/a through 0.2). The vulnerability is triggered via Cross-Site Request Forgery in the plugin, with the impact being stored XSS as reported in multiple sources (WordPress/NVD, Patchstack entries). Affected product/...

WordPress plugin Vignette Ads 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site request forge...

WordPress plugin Optimate Ads 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-5910 · Unknown · Vignette Ads

Name of the Vulnerable Software and Affected Versions: Vignette Ads versions n/a through 0.2 Description: A Cross-Site Request Forgery CSRF issue in Vignette Ads allows Stored XSS. This means an attacker can trick a user into performing unintended actions on the web application, potentially leadi...

CVE-2025-25071: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in topplugins Vignette Ads vignete-ads allows Stored XSS.This issue affects Vignette Ads: from n/a through = 0.2...

CVE-2025-25136: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in shujahat21 Optimate Ads optimate-ads allows Stored XSS.This issue affects Optimate Ads: from n/a through = 1.0.3...

CVE-2024-52428

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Peter Ads Booster by Ads Pro free-wp-booster-by-ads-pro allows PHP Local File Inclusion.This issue affects Ads Booster by Ads Pro: from n/a through = 1.12...

CVE-2024-6431

The Media.net Ads Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and missing capability check in the 'sendMail' function in all versions up to, and including, 2.10.13. This makes it possible for authenticated attackers, with subscriber-lev...

CVE-2024-42374

BEx Web Java Runtime Export Web Service does not sufficiently validate an XML document accepted from an untrusted source. An attacker can retrieve information from the SAP ADS system and exhaust the number of XMLForm service which makes the SAP ADS rendering PDF creation unavailable. This affects...

WordPress Optimate Ads plugin <= 1.0.3 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability discovered by Abdi Pranata in WordPress Plugin Optimate Ads versions = 1.0.3...

WordPress Vignette Ads plugin <= 0.2 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Vignette Ads versions = 0.2...

Malvertising Scam Uses Fake Google Ads to Hijack Microsoft Advertising Accounts

Cybersecurity researchers have discovered a malvertising campaign that's targeting Microsoft advertisers with bogus Google ads that aim to take them to phishing pages that are capable of harvesting their credentials. "These malicious ads, appearing on Google Search, are designed to steal the logi...

CVE-2024-12041: Exposure of Private Personal Information to an Unauthorized Actor

The Directorist: AI-Powered WordPress Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 8.0.12 via the /wp-json/directorist/v1/users/ endpoint. This makes it possible for unauthenticated attacker...

ClickFix vs. traditional download in new DarkGate campaign

During the past several months there have been numerous malware campaigns that use a technique something referred to as "ClickFix". It often consists of a fake CAPTCHA or similar traffic validation page where visitors are instructed to paste and execute code in order to proceed. We have started t...

Microsoft advertisers phished via malicious Google ads

Just days after we uncovered a campaign targeting Google Ads accounts, a similar attack has surfaced, this time aimed at Microsoft advertisers. These malicious ads, appearing on Google Search, are designed to steal the login information of users trying to access Microsoft's advertising platform...

CVE-2025-23914

Deserialization of Untrusted Data vulnerability in muzaara Muzaara Google Ads Report muzaara-adwords-optimize-dashboard allows Object Injection.This issue affects Muzaara Google Ads Report: from n/a through = 3.1...

CVE-2025-23914

CVE-2025-23914 is an unauthenticated PHP object injection (deserialization of untrusted data) affecting the WordPress plugin: Optimize Your Campaigns – Google Shopping – Google Ads – Google Adwords (Muzaara) up to version 3.1. The vulnerability has a CVSS v3.1 base score of 9.8 (CRITICAL) with ne...