CVE-2024-8393 Woocommerce Blocks – Woolook <= 1.7.0 - Authenticated (Admin+) Local File Inclusion

The Woocommerce Blocks – Woolook plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7.0 via the via the 'tab' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary...

CVE-2025-7683 LatestCheckins <= 1 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The LatestCheckins plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1. This is due to missing or incorrect nonce validation on the 'LatestCheckins' page. This makes it possible for unauthenticated attackers to update settings and inject...

CVE-2025-7683

CVE-2025-7683 (LatestCheckins WordPress plugin) is a CSRF to Stored XSS vulnerability in versions up to 1 due to missing nonce validation on the LatestCheckins page. This enables unauthenticated attackers to alter settings and inject malicious scripts by tricking an admin into submitting a forged...

CVE-2025-7668 Linux Promotional Plugin <= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Linux Promotional Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorrect nonce validation on the 'inux-promotional-plugin.php' page. This makes it possible for unauthenticated attackers to update...

CVE-2025-7668 Linux Promotional Plugin <= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Linux Promotional Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorrect nonce validation on the 'inux-promotional-plugin.php' page. This makes it possible for unauthenticated attackers to update...

CVE-2025-7668

CVE-2025-7668 — Linux Promotional Plugin for WordPress is a CSRF to Stored XSS vulnerability affecting all versions up to 1.4. The issue arises from missing or incorrect nonce validation on the plugin’s linux-promotional-plugin.php page, enabling unauthenticated attackers to update settings and i...

CVE-2025-7684

The CVE-2025-7684 issue is confirmed for the WordPress plugin Last.fm Recent Album Artwork (versions up to and including 1.0.2). The root cause is missing/incorrect nonce validation on lastfm_albums_artwork.php, enabling Cross‑Site Request Forgery that can lead to a Stored Cross‑Site Scripting co...

CVE-2025-7684 Last.fm Recent Album Artwork <= 1.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Last.fm Recent Album Artwork plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to missing or incorrect nonce validation on the 'lastfmalbumsartwork.php' page. This makes it possible for unauthenticated attackers to update...

CVE-2025-7684 Last.fm Recent Album Artwork <= 1.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Last.fm Recent Album Artwork plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to missing or incorrect nonce validation on the 'lastfmalbumsartwork.php' page. This makes it possible for unauthenticated attackers to update...

CVE-2025-49895

Cross-Site Request Forgery CSRF vulnerability in iThemes ServerBuddy by PluginBuddy.Com allows Object Injection.This issue affects ServerBuddy by PluginBuddy.Com: from n/a through 1.0.5...

CVE-2025-49895 WordPress ServerBuddy by PluginBuddy.com plugin <= 1.0.5 - CSRF to PHP Object Injection vulnerability

Cross-Site Request Forgery CSRF vulnerability in iThemes ServerBuddy by PluginBuddy.Com allows Object Injection.This issue affects ServerBuddy by PluginBuddy.Com: from n/a through 1.0.5...

CVE-2025-49895

A Cross-Site Request Forgery (CSRF) vulnerability exists in the iThemes ServerBuddy by PluginBuddy.Com WordPress plugin, affecting versions up to and including 1.0.5 . This vulnerability allows an attacker to perform a CSRF attack that can lead to PHP Object Injection . No specific information re...

CVE-2025-49895 WordPress ServerBuddy by PluginBuddy.com plugin <= 1.0.5 - CSRF to PHP Object Injection vulnerability

Cross-Site Request Forgery CSRF vulnerability in iThemes ServerBuddy by PluginBuddy.Com allows Object Injection.This issue affects ServerBuddy by PluginBuddy.Com: from n/a through 1.0.5...

WordPress ServerBuddy by PluginBuddy.com plugin <= 1.0.5 - CSRF to PHP Object Injection vulnerability

CSRF to PHP Object Injection vulnerability discovered by Nguyen Xuan Chien Patchstack Alliance in WordPress Plugin ServerBuddy by PluginBuddy.com versions = 1.0.5...

CVE-2024-53946

The KuWFi 4G LTE AC900 router 1.0.13 is vulnerable to Cross-Site Request Forgery CSRF on its web management interface. This vulnerability allows an attacker to trick an authenticated admin user into performing unauthorized actions, such as exploiting a command injection vulnerability in...

WordPress plugin Linux Promotional Plugin 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...

PT-2025-33533 · WordPress · Last.Fm Recent Album Artwork

Name of the Vulnerable Software and Affected Versions: Last.fm Recent Album Artwork plugin for WordPress versions up to and including 1.0.2 Description: The Last.fm Recent Album Artwork plugin for WordPress is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation ...

PT-2025-33532 · WordPress · Latestcheckins

Name of the Vulnerable Software and Affected Versions: LatestCheckins plugin for WordPress version 1 Description: The LatestCheckins plugin for WordPress is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation on the 'LatestCheckins' page. This allows...

PT-2025-33518 · WordPress · Ithemes Serverbuddy

Name of the Vulnerable Software and Affected Versions: iThemes ServerBuddy versions n/a through 1.0.5 Description: A Cross-Site Request Forgery CSRF vulnerability exists in iThemes ServerBuddy by PluginBuddy.Com, allowing Object Injection. Recommendations: At the moment, there is no information...

PT-2025-33531 · WordPress · Linux Promotional Plugin For Wordpress

Name of the Vulnerable Software and Affected Versions: Linux Promotional Plugin for WordPress versions up to and including 1.4 Description: The Linux Promotional Plugin for WordPress is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation on the...