CVE-2025-2594

The User Registration & Membership WordPress plugin before 4.1.3 does not properly validate data in an AJAX action when the Membership Addon is enabled, allowing attackers to authenticate as any user, including administrators, by simply using the target account's user ID...

CVE-2025-2594

The CVE-2025-2594 affects the WordPress plugin “User Registration & Membership” prior to version 4.1.3. Affected behavior: when the Membership Addon is enabled, data in an AJAX action is not properly validated, enabling an attacker to authenticate as any user (including administrators) by supplyi...

Open Source SACCO Management System 安全漏洞

Open Source SACCO Management System is an open source SACCO management system by Mayuri K., an individual developer. A security vulnerability exists in Open Source SACCO Management System v1.0, which is caused by a SQL injection vulnerability in the password parameter of /sacco/ajax.php...

PT-2025-17488 · WordPress · User Registration & Membership

Name of the Vulnerable Software and Affected Versions: User Registration & Membership WordPress plugin version 4.1.2 and earlier Description: The issue concerns the User Registration & Membership WordPress plugin, where data in an AJAX action is not properly validated when the Membership Addon is...

PT-2025-17349 · WordPress +1 · Order Delivery Date +1

Name of the Vulnerable Software and Affected Versions: Order Delivery Date WordPress plugin versions prior to 12.6.0 Description: The Order Delivery Date WordPress plugin before version 12.6.0 discloses arbitrary post titles including draft and private posts through an unauthenticated AJAX action...

WooCommerce Customers Manager 29.4 - Post-Authenticated SQL Injection

Exploit Title: WooCommerce Customers Manager 29.4 - Post-Authenticated SQL Injection Date: 2024-03-25 Exploit Author: Ivan Spiridonov - xbz0n Software Link: https://codecanyon.net/item/woocommerce-customers-manager/10965432 Version: 29.4 Tested on: Ubuntu 22.04 CVE: CVE-2024-0399 SQL Injection Th...

CVE-2025-32070

Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - AJAX Poll Extension allows Cross-Site Scripting XSS.This issue affects Mediawiki - AJAX Poll Extension: from 1.39 through 1.43...

CVE-2025-32070

Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - AJAX Poll Extension allows Cross-Site Scripting XSS.This issue affects Mediawiki - AJAX Poll Extension: from 1.39 through 1.43...

CVE-2025-32070 XSSes in AJAXPoll

Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - AJAX Poll Extension allows Cross-Site Scripting XSS.This issue affects Mediawiki - AJAX Poll Extension: from 1.39 through 1.43...

CVE-2025-32070

The CVE-2025-32070 entry concerns the MediaWiki AJAX Poll Extension, affected versions 1.39 through 1.43, with an underlying issue of improper input validation that enables Cross-Site Scripting (XSS) . Multiple connected sources confirm this as the root cause and impact. Practical consequence is ...

CVE-2025-32070 XSSes in AJAXPoll

Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - AJAX Poll Extension allows Cross-Site Scripting XSS.This issue affects Mediawiki - AJAX Poll Extension: from 1.39 through 1.43...

PT-2025-16134 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: Mediawiki - AJAX Poll Extension versions 1.39 through 1.43 Description: The issue is related to Improper Input Validation, which allows Cross-Site Scripting XSS in the Mediawiki - AJAX Poll Extension. Recommendations: For versions 1.39 throug...

CVE-2025-2719 Swatchly – WooCommerce Variation Swatches for Products (product attributes: Image swatch, Color swatches, Label swatches) 1.2.8 - 1.4.0 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update

The Swatchly – WooCommerce Variation Swatches for Products product attributes: Image swatch, Color swatches, Label swatches plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxdismiss function in versions 1.2.8 to 1.4.0. This makes ...

CVE-2025-3437

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in the ajaxactions.php file in all versions up to, and including, 1.4.66. This makes it possible for authenticate...

PT-2025-15416 · WordPress · Motors – Car Dealership & Classified Listings Plugin

Name of the Vulnerable Software and Affected Versions: Motors – Car Dealership & Classified Listings Plugin versions up to, and including, 1.4.66 Description: The issue allows authenticated attackers with Subscriber-level access and above to execute several initial set-up actions due to a missing...

PT-2025-15333 · WordPress · Simple Wp Events

Name of the Vulnerable Software and Affected Versions: Simple WP Events plugin for WordPress versions up to and including 1.8.17 Description: The issue arises from insufficient file path validation in the wpe delete file AJAX action, allowing unauthenticated attackers to delete arbitrary files on...

CVE-2024-13776

The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'dzsapdeletenotice' AJAX action in all versions up to, and including, 6.91. This makes i...

BIT-JOOMLA-2021-26033 [20210502] - Core - CSRF in AJAX reordering endpoint

An issue was discovered in Joomla! 3.0.0 through 3.9.26. A missing token check causes a CSRF vulnerability in the AJAX reordering endpoint...

Exploit for CVE-2025-30921

CVE-2025-30921 1️⃣ Component type WordPress plugin 2️...

CVE-2025-30149

OpenEMR is a free and open source electronic health records and medical practice management application. OpenEMR allows reflected cross-site scripting XSS in the AJAX Script interface\super\layoutlistitemsajax.php via the target parameter. This vulnerability is fixed in 7.0.3...