WordPress CLP – Custom Login Page by NiteoThemes plugin <= 1.5.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nguyen Thi Huyen Trang - Skalucy in WordPress Plugin CLP – Custom Login Page by NiteoThemes versions = 1.5.5...

CVE-2025-31897

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Arrow Plugins Arrow Custom Feed for Twitter arrow-twitter-feed allows Stored XSS.This issue affects Arrow Custom Feed for Twitter: from n/a through = 1.5.3...

CVE-2025-31767

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in OTWthemes Post Custom Templates Lite post-custom-templates-lite allows Stored XSS.This issue affects Post Custom Templates Lite: from n/a through = 1.14...

CVE-2025-31769

Cross-Site Request Forgery CSRF vulnerability in NiteoThemes CLP – Custom Login Page by NiteoThemes clp-custom-login-page allows Cross Site Request Forgery.This issue affects CLP – Custom Login Page by NiteoThemes: from n/a through = 1.5.5...

CVE-2025-30210

Bruno is an open source IDE for exploring and testing APIs. Prior to 1.39.1, the custom tool-tip components which internally use react-tooltip were setting the content in this case the Environment name as raw HTML which then gets injected into DOM on hover. This, combined with loose Content...

CVE-2025-31897 WordPress Arrow Custom Feed for Twitter plugin <= 1.5.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Arrow Plugins Arrow Custom Feed for Twitter allows Stored XSS. This issue affects Arrow Custom Feed for Twitter: from n/a through 1.5.3...

CVE-2025-31897

CVE-2025-31897 affects the Arrow Custom Feed for Twitter WordPress plugin. The vulnerability is a Stored XSS due to improper neutralization of input during web page generation, with affected versions from n/a up to 1.5.3. The Wordfence detail shows this variant as Arrow Custom Feed for Twitter

CVE-2025-31769 WordPress CLP – Custom Login Page by NiteoThemes plugin <= 1.5.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in NiteoThemes CLP – Custom Login Page by NiteoThemes clp-custom-login-page allows Cross Site Request Forgery.This issue affects CLP – Custom Login Page by NiteoThemes: from n/a through = 1.5.5...

CVE-2025-31769

CVE-2025-31769 describes a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin “CLP – Custom Login Page by NiteoThemes”, affecting versions from n/a through 1.5.5. The issue stems from CSRF in the plugin (root cause details not explicitly provided in the documents). Impact is ...

CVE-2025-31769 WordPress CLP – Custom Login Page by NiteoThemes plugin <= 1.5.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in NiteoThemes CLP – Custom Login Page by NiteoThemes clp-custom-login-page allows Cross Site Request Forgery.This issue affects CLP – Custom Login Page by NiteoThemes: from n/a through = 1.5.5...

Incorrect Privilege Assignment

Overview Affected versions of this package are vulnerable to Incorrect Privilege Assignment that allows a Restricted Administrator user to change the password of an Administrator account and escalate privileges by taking over the Administrator account. Workaround This vulnerability can be avoided...

CVE-2025-30177 Apache Camel: Camel-Undertow Message Header Injection via Improper Filtering

Bypass/Injection vulnerability in Apache Camel in Camel-Undertow component under particular conditions. This issue affects Apache Camel: from 4.10.0 before 4.10.3, from 4.8.0 before 4.8.6. Users are recommended to upgrade to version 4.10.3 for 4.10.x LTS and 4.8.6 for 4.8.x LTS. Camel undertow...

CVE-2025-30177 Apache Camel: Camel-Undertow Message Header Injection via Improper Filtering

Bypass/Injection vulnerability in Apache Camel in Camel-Undertow component under particular conditions. This issue affects Apache Camel: from 4.10.0 before 4.10.3, from 4.8.0 before 4.8.6. Users are recommended to upgrade to version 4.10.3 for 4.10.x LTS and 4.8.6 for 4.8.x LTS. Camel undertow...

CVE-2024-12189 WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

The WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom widgets in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This...

Google Chrome security vulnerabilities

Google Chrome is a web browser from Google, Inc USA. A security vulnerability exists in Google Chrome that stems from an improper implementation in Custom Tabs...

Google Chrome security vulnerabilities

Google Chrome is a web browser from Google, an American company. Google Chrome suffers from a security bypass vulnerability that originates from an improper implementation in Custom Tabs. An attacker can exploit the vulnerability to bypass security restrictions...

Important: thunderbird

Issue Overview: Requests initiated through reader mode did not properly omit cookies with a SameSite attribute. This vulnerability affects Thunderbird 91.9, Firefox ESR 91.9, and Firefox 100. CVE-2022-29912 The parent process would not properly check whether the Speech Synthesis feature is...

PT-2025-14449 · Google +2 · Google Chrome +2

Name of the Vulnerable Software and Affected Versions: Google Chrome on Android versions prior to 135.0.7049.52 Description: The issue is related to an inappropriate implementation in Custom Tabs, allowing a remote attacker to perform privilege escalation via a crafted app if the user is convince...

chromium -- multiple security fixes

Chrome Releases reports: This update includes 13 security fixes: 376491759 Medium CVE-2025-3067: Inappropriate implementation in Custom Tabs. Reported by Philipp Beer TU Wien on 2024-10-31 401823929 Medium CVE-2025-3068: Inappropriate implementation in Intents. Reported by Simon Rawet on 2025-03-...

PT-2025-14087

Name of the Vulnerable Software and Affected Versions PowerPack Elementor Addons plugin for WordPress versions up to, and including, 2.9.0 Description The issue is related to Stored Cross-Site Scripting via the Custom Cursor Extension due to insufficient input sanitization and output escaping. Th...