CVE-2024-12164

The WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpsslwpresetsettings function in all versions up to, and including, 1.6. This makes it possible for authenticated...

CVE-2024-13654

CVE-2024-13654 concerns the WordPress theme ZoxPress (

CVE-2024-13665

The CVE CVE-2024-13665 affects the Admire Extra WordPress plugin (versions up to 1.6). It is a Stored XSS via the space shortcode due to insufficient input sanitization/output escaping for authenticated users with Contributor+ privileges. Impact: arbitrary script injection on pages viewed by user...

CVE-2024-13656 Click Mag - Viral WordPress News Magazine/Blog Theme <= 3.6.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Deletion

The Click Mag - Viral WordPress News Magazine/Blog Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the propanelofajaxcallback function in all versions up to, and including, 3.6.0. This makes it...

CVE-2024-13653 ZoxPress - The All-In-One WordPress News Theme <= 2.12.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update

The ZoxPress - The All-In-One WordPress News Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'backupoptions' and 'restoreoptions' functions in all versions up to, and including, 2.12.0. Thi...

CVE-2024-12164 WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Settings Reset

The WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpsslwpresetsettings function in all versions up to, and including, 1.6. This makes it possible for authenticated...

CVE-2024-11746

CVE-2024-11746 affects the WordPress plugin “Discover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands Plugin” up to version 1.3.2. The issue is a Stored XSS via the product_brand shortcode due to insufficient input sanitization and output escaping on user-supplied at...

CVE-2024-13769 Puzzles | WP Magazine / Review with Store WordPress Theme + RTL <= 4.2.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting

The Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress is vulnerable to Stored Cross-Site Scripting due to a missing capability check on the 'themeoptionsajaxpostaction' AJAX action in all versions up to, and including, 4.2.4. This makes it possible for...

CVE-2024-13769

CVE-2024-13769 – Puzzles theme (WP Magazine / Review with Store WordPress Theme + RTL) Vulnerability: Stored Cross-Site Scripting due to a missing capability check on the theme_options_ajax_post_action AJAX action. Affected versions: all versions up to and including 4.2.4. Impact: Authenticated a...

CVE-2024-13541

The aDirectory – WordPress Directory Listing Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the adqsdeletelisting function in all versions up to, and including, 2.3. This makes it possible for authenticated attackers, with...

CVE-2024-13701

CVE-2024-13701 concerns the Liveticker (by stklcode) WordPress plugin. The vulnerability is a stored cross-site scripting (XSS) via the plugin’s liveticker shortcode, caused by insufficient input sanitization and output escaping on user-supplied attributes. Affected are all versions up to and inc...

CVE-2024-13701 Liveticker (by stklcode) <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Liveticker by stklcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'liveticker' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2025-6430 · Stklcode · The Liveticker

Name of the Vulnerable Software and Affected Versions: The Liveticker by stklcode plugin for WordPress versions up to, and including, 1.2.2 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'liveticker' shortcode due to insufficient input sanitization and output...

PT-2025-6468 · WordPress · Rise Blocks

Name of the Vulnerable Software and Affected Versions: Rise Blocks – A Complete Gutenberg Page Builder plugin for WordPress versions up to, and including, 3.6 Description: The issue is related to Stored Cross-Site Scripting via the titleTag parameter due to insufficient input sanitization and...

CVE-2024-0179

CVE-2024-0179 is an SMM Callout vulnerability in the AmdCpmDisplayFeatureSMM UEFI module that could allow locally authenticated attackers to overwrite SMRAM and execute arbitrary code. Root cause: insufficient input/data validation in the SMM callout mechanism. Impact: potential kernel- or ring-0...

CVE-2024-0179

SMM Callout vulnerability within the AmdCpmDisplayFeatureSMM driver could allow locally authenticated attackers to overwrite SMRAM, potentially resulting in arbitrary code execution...

CVE-2025-22467

CVE-2025-22467 describes a stack-based buffer overflow in Ivanti Connect Secure before 22.7R2.6 that allows a remote authenticated attacker to achieve remote code execution. Affected product/version: Ivanti Connect Secure prior to 22.7R2.6. Root cause: stack-based overflow in the admin/UI handlin...

CVE-2024-13506 GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.97 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display_name Parameter

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the displayname profile parameter in all versions up to, and including, 2.8.97 due to insufficient input sanitization and output escaping. This...

CVE-2025-0862 SuperSaaS – online appointment scheduling <= 2.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via after Parameter

The SuperSaaS – online appointment scheduling plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘after’ parameter in all versions up to, and including, 2.1.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...

CVE-2025-0862

CVE-2025-0862 describes a stored cross-site scripting flaw in the WordPress plugin SuperSaaS – online appointment scheduling . Affected versions up to and including 2.1.12 allow an authenticated attacker with Contributor+ privileges to inject arbitrary scripts via the after parameter, which execu...