12455 matches found
WordPress plugin WPBifröst 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin... A security...
CVE-2025-10038: Incorrect Privilege Assignment
The Binary MLM Plan plugin for WordPress is vulnerable to limited Privilege Escalation in all versions up to, and including, 3.0. This is due to bmpuser role granting all users with the managebmp capability by default upon registration through the plugin's form. This makes it possible for...
CVE-2025-10303: Missing Authorization
The Library Management System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the owt7librarymanagementajaxhandler function in all versions up to, and including, 3.1. This makes it possible for authenticated attackers, with...
PT-2025-42301
Name of the Vulnerable Software and Affected Versions YourMembership Single Sign On – YM SSO Login plugin for WordPress versions up to and including 1.1.7 Description The YourMembership Single Sign On – YM SSO Login plugin for WordPress has a flaw that allows unauthorized access to data. A missin...
PT-2025-42311
Name of the Vulnerable Software and Affected Versions WordPress Zip Attachments plugin versions up to and including 1.6 Description The Zip Attachments plugin for WordPress has a flaw that allows unauthorized access to data. This is due to a missing capability check and a lack of post status...
WordPress plugin Library Management System 安全漏洞
The WordPress Library Management System plugin is a plugin for extending the functionality of WordPress, mainly used to help users manage website content, user data and system settings more efficiently. The WordPress Library Management System plugin suffers from an unauthorized data modification...
CVE-2025-10186: Missing Authorization
The WhyDonate – FREE Donate button – Crowdfunding – Fundraising plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the removerow function in all versions up to, and including, 4.0.15. This makes it possible for unauthenticated attackers to delete...
CVE-2025-11701: Missing Authorization
The Zip Attachments plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check as well as missing post status validation in the zacreatezipcallback function in all versions up to, and including, 1.6. This makes it possible for unauthenticated attackers to...
CVE-2025-10648: Missing Authorization
The YourMembership Single Sign On – YM SSO Login plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'moymdisplaytestattributes' function in all versions up to, and including, 1.1.7. This makes it possible for unauthenticated attackers to rea...
PT-2025-42298
Name of the Vulnerable Software and Affected Versions Find And Replace content for WordPress plugin versions prior to 1.2 Description The Find And Replace content for WordPress plugin for WordPress is susceptible to unauthorized Stored Cross-Site Scripting and Arbitrary Content Replacement. This ...
PT-2025-42292
Name of the Vulnerable Software and Affected Versions WPBifröst versions through 1.0.7 Description The WPBifröst – Instant Passwordless Temporary Login Links plugin for WordPress has an issue that allows authenticated attackers with Subscriber-level access or higher to create new administrative...
Microsoft Windows 安全漏洞
Microsoft Windows is a suite of operating systems for use on personal devices from the U.S.-based Microsoft Corporation Microsoft. A security vulnerability exists in Microsoft Windows that stems from an attacker's ability to elevate privileges by exploiting the vulnerability...
WordPress Cost Calculator Builder plugin unauthorized data modification vulnerability
WordPress Cost Calculator Builder plugin is a WordPress plugin for creating price estimation forms that supports quick generation of customized calculators via drag-and-drop form builder that can be embedded in website pages without programming. The WordPress Cost Calculator Builder plugin suffer...
WordPress Constructor plugin permission issue vulnerability
WordPress Constructor plugin is a framework for simplifying plugin development, mainly used to help developers quickly build and manage the plugin's components such as options pages, forms and custom fields. WordPress Constructor plugin suffers from a privilege issue vulnerability that stems from...
PT-2025-44381
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.17.0-rc2-tnguy.net-queue+ Description A use-after-free issue exists in the Linux kernel's ixgbe driver. Specifically, the devlink free function is called prematurely within the ixgbe remove path. This occurs...
CVE-2025-8682
The Newsup theme for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the newsupadmininfoinstallplugin function in all versions up to, and including, 5.0.10. This makes it possible for unauthenticated attackers to install the ansar-import plugin...
VulnCheck KEV: CVE-2025-2539
The File Away plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax function in all versions up to, and including, 3.9.9.0.1. This makes it possible for unauthenticated attackers, leveraging the use of a reversible weak algorithm, to read...
EUVD-2025-33847
The Newsup theme for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the newsupadmininfoinstallplugin function in all versions up to, and including, 5.0.10. This makes it possible for unauthenticated attackers to install the ansar-import plugin...
CVE-2025-8682
The Newsup theme for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the newsupadmininfoinstallplugin function in all versions up to, and including, 5.0.10. This makes it possible for unauthenticated attackers to install the ansar-import plugin...
