PT-2025-10410

Name of the Vulnerable Software and Affected Versions The Years Since – Timeless Texts plugin for WordPress versions up to, and including, 1.4.1 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's 'years-since' shortcod...

CVE-2025-21840 thermal/netlink: Prevent userspace segmentation fault by adjusting UAPI header

In the Linux kernel, the following vulnerability has been resolved: thermal/netlink: Prevent userspace segmentation fault by adjusting UAPI header The intel-lpmd tool 1, which uses the THERMALGENLATTRCPUCAPABILITY attribute to receive HFI events from kernel space, encounters a segmentation fault...

binutils:fuzz_objdump_safe: Heap-buffer-overflow in _bfd_elf_parse_attributes

Detailed Report: https://oss-fuzz.com/testcase?key=6601247063080960 Project: binutils Fuzzing Engine: libFuzzer Fuzz Target: fuzzobjdumpsafe Job Type: libfuzzerasanbinutils Platform Id: linux Crash Type: Heap-buffer-overflow READ 3 Crash Address: 0x5020000000b7 Crash State: bfdelfparseattributes...

Important: python3-jinja2

Issue Overview: Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker need...

Linux Distros Unpatched Vulnerability : CVE-2024-50128

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: net: wwan: fix global oob in wwanrtnlpolicy The variable wwanrtnllinkops assign a bigger...

CVE-2024-13757

The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mslayer shortcode in all versions up to, and including, 3.10.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-5667

CVE-2024-5667 concerns Stored DOM-Based Cross-Site Scripting via the Featherlight.js library bundled in multiple WordPress plugins. The Connected Documents confirm concrete details: authenticated attackers with contributor+ access can inject scripts that execute on users’ pages. The root cause is...

CVE-2024-13757

CVE-2024-13757 : Master Slider – Responsive Touch Slider (WordPress) is affected up to version 3.10.6. The stored cross-site scripting vulnerability occurs in the ms_layer shortcode due to insufficient input sanitization and output escaping. Exploitation requires authenticated access at Contribut...

Linux Distros Unpatched Vulnerability : CVE-2024-39504

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: netfilter: nftinner: validate mandatory meta and payload Check for mandatory netlink...

Linux Distros Unpatched Vulnerability : CVE-2024-26991

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: x86: Don't overflow lpageinfo when checking attributes Fix...

CVE-2024-9618

The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 2.0.7.2 due to insufficient input sanitization and output...

Cross-Site Scripting (XSS)

dom-expressions is vulnerable to Cross-site Scripting XSS. The vulnerability is due to the use of .replace with special replacement patterns $' or $\ in user-defined attributes of the Meta tag, allows an attackers can exploit this by injecting malicious payloads into meta tags, potentially...

PT-2025-9645

Name of the Vulnerable Software and Affected Versions The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress versions up to, and including, 2.0.7.2 Description The issue arises from insufficient input sanitization and outp...

CVE-2024-9019

The SecuPress Free — WordPress Security plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's secupresscheckbanipsform shortcode in all versions up to, and including, 2.2.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This...

CVE-2024-10563

The WooCommerce Cart Count Shortcode WordPress plugin before 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site...

PT-2025-9065

Name of the Vulnerable Software and Affected Versions Exclusive Addons for Elementor plugin for WordPress versions up to, and including, 2.7.6 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the Animated Text and Image Compariso...

CVE-2025-1689 ThemeMakers PayPal Express Checkout <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The ThemeMakers PayPal Express Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'paypal' shortcode in versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-6261

The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'FinalTilesGallery' shortcode in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes ...

SUSE CVE-2022-49418

In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix free of uninitialized nfs4label on referral lookup. Send along the already-allocated fattr along with nfs4fslocations, and drop the memcpy of fattr. We end up growing two more allocations, but this fixes up a crash as:...

PT-2025-8916

Name of the Vulnerable Software and Affected Versions Image Photo Gallery Final Tiles Grid plugin for WordPress versions up to, and including, 3.6.0 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the 'FinalTilesGallery'...