CVE-2025-32640 WordPress One Click Accessibility plugin <= 3.1.0 - Cross-Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Elementor Ally pojo-accessibility allows Stored XSS.This issue affects Ally: from n/a through = 3.1.0...

CVE-2025-32640 WordPress One Click Accessibility plugin <= 3.1.0 - Cross-Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Elementor One Click Accessibility allows Stored XSS. This issue affects One Click Accessibility: from n/a through 3.1.0...

CVE-2025-32640

CVE-2025-32640 is a stored XSS in the WordPress plugin Ally – Web Accessibility & Usability (One Click Accessibility). The issue affects the One Click Accessibility component up to version 3.1.0 and requires authenticated access (Administrator+) to exploit. The connected Wordfence disclosure list...

WordPress Accessibility Suite by Ability, Inc plugin <= 4.18 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Aiden Thái An in WordPress Plugin Accessibility Suite versions = 4.18...

PT-2025-15808

Name of the Vulnerable Software and Affected Versions: Elementor One Click Accessibility versions n/a through 3.1.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an...

WordPress plugin One Click Accessibility 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerability...

CVE-2025-32640: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Elementor Ally pojo-accessibility allows Stored XSS.This issue affects Ally: from n/a through = 3.1.0...

WordPress Accessibility Suite plugin <= 4.18 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by theviper17 in WordPress Plugin Accessibility Suite versions = 4.18...

The vulnerability of the MongoDB database management system server, related to the absence of authentication procedures, allows attackers to compromise the confidentiality and accessibility of protected information.

The vulnerability of the MongoDB database management system server is related to the absence of authentication procedures. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and accessibility of the protected information...

The vulnerability in the software for optimizing and deploying AI-based application solutions from AMD Ryzen AI, related to integer overflow, allows attackers to compromise the integrity and accessibility of protected information.

The vulnerability of software for optimizing and deploying AI-based applications related to AMD Ryzen AI is associated with a numerical overflow condition. Exploiting this vulnerability can allow attackers to compromise the integrity and accessibility of protected information...

OESA-2025-1378 firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. Security Fixes: A malicious webpage could have triggered a use-after-free, memory corruption, and a potentially exploitable crash. This bug could only be triggered when accessibility was...

The vulnerability of the BmpInput::read_native_scanline() function in the src/bmp.imageio/bmpinput.cpp module of the OpenImageIO library allows an attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the BmpInput::readnativescanline function in the src/bmp.imageio/bmpinput.cpp module of the OpenImageIO library is related to writing beyond the buffer boundaries. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

Apple Backports Critical Fixes for 3 Recent 0-Days Impacting Older iOS and macOS Devices

Apple on Monday backported fixes for three vulnerabilities that have come under active exploitation in the wild to older models and previous versions of the operating systems. The vulnerabilities in question are listed below - CVE-2025-24085 CVSS score: 7.3 - A use-after-free bug in the Core Medi...

The vulnerability of the `btrfs_encoded_read_endio()` function in the `fs/btrfs/inode.c` module of the Linux kernel allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the btrfsencodedreadendio function in the fs/btrfs/inode.c module of the Linux kernel is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of protected...

The vulnerability of the dbAdjTree() function in the fs/jfs/jfs_dmap.c module of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the dbAdjTree function in the fs/jfs/jfsdmap.c module of the Linux operating system is related to unvalidated array indexing. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

Vulnerability of the pvr2_context_exit() function in the drivers/media/usb/pvrusb2/pvrusb2-context.c file – This driver is a Linux kernel-based driver for supporting multimedia devices connected via USB. It allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

Vulnerability of the pvr2contextexit function in the drivers/media/usb/pvrusb2/pvrusb2-context.c module – The Linux kernel’s USB multimedia device driver architecture relies on the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the...

The vulnerability of the accountablemapping() function in the mm/mmap.c module of the Linux operating system allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the accountablemapping function in the mm/mmap.c module of the Linux kernel is related to improper control of resource identifiers “resource leakage”. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the...

About the security content of iOS 16.7.11 and iPadOS 16.7.11

About the security content of iOS 16.7.11 and iPadOS 16.7.11 This document describes the security content of iOS 16.7.11 and iPadOS 16.7.11. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred...

New Android Trojan Crocodilus Abuses Accessibility to Steal Banking and Crypto Credentials

Cybersecurity researchers have discovered a new Android banking malware called Crocodilus that's primarily designed to target users in Spain and Turkey. "Crocodilus enters the scene not as a simple clone, but as a fully-fledged threat from the outset, equipped with modern techniques such as remot...

GHSA-RV78-QQRQ-73M5 Directus's S3 assets become unavailable after a burst of HEAD requests

Summary There's some tools that use Directus to sync content and assets. Some of those tools use HEAD method, like Shopify, to check the existence of files. Although, when making many HEAD requests at once, at some point, all assets are being served as 403. Details When I was investigating this...