WordPress PDF for WPForms plugin <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via yeepdf_dotab Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via yeepdfdotab Shortcode vulnerability discovered by SOPROBRO in WordPress Plugin PDF for WPForms versions = 4.6.0...

PT-2025-4794 · Hewlett Packard · Hpe Aruba Networking Aos

The network management service is affected by an authenticated command injection issue in its command line interface, which could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system. Unfortunately, the specific versions of the network management...

CVE-2024-11874 Grid Accordion Lite <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Grid Accordion Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gridaccordion' shortcode in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WordPress GatorMail SmartForms plugin <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by SOPROBRO in WordPress Plugin GatorMail SmartForms versions = 1.1.0...

WordPress WP SPID Italia plugin <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by SOPROBRO in WordPress Plugin WP SPID Italia versions = 2.9...

WordPress Orbit Fox by ThemeIsle plugin <= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via titletag Parameter vulnerability discovered by Ankit Patel in WordPress Plugin Orbit Fox by ThemeIsle versions = 2.10.43...

CVE-2024-54997

MonicaHQ v4.1.1 was discovered to contain an authenticated Client-Side Injection vulnerability via the entry text field at /journal/entries/ID/edit...

CVE-2024-54997

MonicaHQ v4.1.1 was discovered to contain an authenticated Client-Side Injection vulnerability via the entry text field at /journal/entries/ID/edit...

CVE-2024-54997

MonicaHQ v4.1.1 was discovered to contain an authenticated Client-Side Injection vulnerability via the entry text field at /journal/entries/ID/edit...

Vaultwarden authenticated reflected cross-site scripting (XSS) vulnerability

Vaultwarden v1.32.5 was discovered to contain an authenticated reflected cross-site scripting XSS vulnerability via the component /api/core/mod.rs...

GHSA-VPRM-27PV-JP3W Vaultwarden authenticated reflected cross-site scripting (XSS) vulnerability

Vaultwarden v1.32.5 was discovered to contain an authenticated reflected cross-site scripting XSS vulnerability via the component /api/core/mod.rs...

WordPress SimplyRETS Real Estate IDX plugin <= 2.11.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by SOPROBRO in WordPress Plugin SimplyRETS Real Estate IDX versions = 2.11.3...

WordPress WP Travel plugin <= 10.0.0 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by shaman0x01 in WordPress Plugin WP Travel versions = 10.0.0...

WordPress 3DVieweronline plugin <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zakaria in WordPress Plugin 3DVieweronline versions = 2.2.2...

WordPress Muslim Prayer Time-Salah/Iqamah plugin <= 1.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by SOPROBRO in WordPress Plugin Muslim Prayer Time-Salah/Iqamah versions = 1.8.8...

WordPress Searchie plugin <= 1.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zakaria in WordPress Plugin Searchie versions = 1.17.0...

WordPress SKT Page Builder plugin <= 4.6 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by WordFence in WordPress Plugin SKT Page Builder versions = 4.7...

CVE-2024-12030 MDTF – Meta Data and Taxonomies Filter <= 1.3.3.5 - Authenticated (Contributor+) SQL Injection

The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to SQL Injection via the 'key' attribute of the 'mdfvalue' shortcode in all versions up to, and including, 1.3.3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

Drupal Email TFA module < 2.0.3 - Authenticated Broken Access Control vulnerability

Authenticated Broken Access Control vulnerability discovered by Ursin Cola in WordPress Module Email TFA versions 2.0.3...

WordPress MDTF – Meta Data and Taxonomies Filter plugin <= 1.3.3.5 - Authenticated (Contributor+) SQL Injection vulnerability

Authenticated Contributor+ SQL Injection vulnerability discovered by Thanh Nam Tran in WordPress Plugin MDTF versions = 1.3.3.5...