WordPress Z-Downloads plugin < 1.11.6 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Minh Giang & Christopher Houk in WordPress Plugin Z-Downloads versions 1.11.6...

WordPress JavaScript Logic plugin <= 0.1 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by Daniel Ruf in WordPress Plugin JavaScript Logic versions = 0.1...

WordPress Simple Lightbox plugin < 2.9.4 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Pierre Rudloff in WordPress Plugin Simple Lightbox versions 2.9.4...

WordPress WooCommerce POS plugin <= 1.7.8 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Marek Mikita in WordPress Plugin WooCommerce POS versions = 1.7.8...

WordPress Travelpayouts plugin < 1.1.14 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Krzysztof Zając CERT PL in WordPress Plugin Travelpayouts versions 1.1.14...

WordPress LightPress Lightbox plugin < 2.3.4 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Pierre Rudloff in WordPress Plugin WP jQuery Lightbox versions 2.3.4...

Exploit for CVE-2025-24203

dirtyZero A simple customization toolbox that utilizes CVE-...

WordPress Product Time Countdown for WooCommerce plugin <= 1.6.2 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin Product Time Countdown for WooCommerce versions = 1.6.2...

WordPress WZ Followed Posts plugin <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by muhammad yudha in WordPress Plugin WZ Followed Posts - Display what visitors are reading versions = 3.1.0...

GHSA-8X27-JWJR-8545 SQL injection in ADOdb PostgreSQL driver pg_insert_id() method

Improper escaping of a query parameter may allow an attacker to execute arbitrary SQL statements when the code using ADOdb connects to a PostgreSQL database and calls pginsertid with user-supplied data. Note that the indicated Severity corresponds to a worst-case usage scenario. Impact PostgreSQL...

WordPress NewsBlogger Theme <= 0.2.5.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software NewsBlogger Type Theme Vulnerable versions = 0.2.5.4 Fixed in 0.2.5.5 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2025-1305 Patch priority Low CVSS severity Low 8.8 Developer Claim ownership PSID 0ec134d8edb7 Credits Gibran Abdillah...

WordPress Mailing Group Listserv plugin <= 3.0.4 - SQL Injection Vulnerability

SQL Injection Vulnerability discovered by timomangcut in WordPress Plugin Mailing Group Listserv versions = 3.0.4...

WordPress Frontend Dashboard plugin <= 2.2.5 - SQL Injection Vulnerability

SQL Injection Vulnerability discovered by Nguyen Ngoc Quang Bach maysbachs in WordPress Plugin Frontend Dashboard versions = 2.2.5...

WordPress Responsive Blocks plugin <= 2.0.2 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by zaim in WordPress Plugin Responsive Blocks versions = 2.0.2...

WordPress SKT Blocks plugin <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin SKT Blocks versions = 1.9...

WordPress Z Companion plugin <= 1.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by Avraham Shemesh in WordPress Plugin Z Companion versions = 1.1.1...

WordPress WP Delete User Accounts plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by muhammad yudha Patchstack Alliance in WordPress Plugin WP Delete User Accounts versions = 1.2.3...

WordPress Verowa Connect plugin <= 3.0.5 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Phan Trong Quan - VNPT Cyber Immunity in WordPress Plugin Verowa Connect versions = 3.0.5...

WordPress Hive Support plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by hunter85 in WordPress Plugin Hive Support versions = 1.2.10...

WordPress coreActivity: Activity Logging for WordPress plugin <= 2.7 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Yassine NEGGAOUI in WordPress Plugin coreActivity: Activity Logging plugin for WordPress versions = 2.7...