CVE-2025-58799 WordPress Custom WooCommerce Checkout Fields Editor Plugin <= 1.3.4 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in themelocation Custom WooCommerce Checkout Fields Editor add-fields-to-checkout-page-woocommerce allows Cross Site Request Forgery.This issue affects Custom WooCommerce Checkout Fields Editor: from n/a through = 1.3.4...

CVE-2025-58799

CVE-2025-58799 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the WordPress plugin Custom WooCommerce Checkout Fields Editor (themelocation) up to version 1.3.4. The issue is confirmed by multiple sources in the connected documents (Patchstack, CVE records, Red Hat advisory refere...

WordPress Site Info Plugin <= 1.1 - Sensitive Data Exposure Vulnerability

Sensitive Data Exposure Vulnerability discovered by Bao BlueRock in WordPress Plugin Site Info versions = 1.1...

WordPress Carousel Ultimate Plugin <= 1.8 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Nabil Irawan in WordPress Plugin Carousel Ultimate versions = 1.8...

WordPress Custom WooCommerce Checkout Fields Editor Plugin <= 1.3.4 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Custom WooCommerce Checkout Fields Editor versions = 1.3.4...

WordPress Elementor Element Condition Plugin <= 1.0.5 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Que Thanh Tuan Blue Rock in WordPress Plugin Elementor Element Condition versions = 1.0.5...

PT-2025-36139

Name of the Vulnerable Software and Affected Versions: themelocation Custom WooCommerce Checkout Fields Editor versions through 1.3.4 Description: The software contains a Cross-Site Request Forgery CSRF flaw. This issue allows attackers to perform actions on behalf of authenticated users...

WordPress plugin Custom WooCommerce Checkout Fields Editor Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

The vulnerability of the Despeckle Plugin component of the GIMP graphic editor, which arises from exceeding the buffer memory limit, allows attackers to trigger a system failure or execute arbitrary code.

The vulnerability of the Despeckle Plugin component of the GIMP graphic editor is related to the execution of code beyond the boundaries of the memory buffer. Exploiting this vulnerability can allow an attacker to cause a system failure or execute arbitrary code...

ROS-20250905-10

Vulnerability of ImageMagick console graphic editor related to integer overflow on BMP encoder step calculation. calculation of BMP encoder bitmap string step. Exploitation of the vulnerability could allow an attacker, acting remotely, to execute arbitrary code...

CVE-2025-41057

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataAddonlayouts' and 'dataAddonlayoutsexcept' parameters in /apprain/developer/addons/update/richtexteditor...

CVE-2025-41057

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataAddonlayouts' and 'dataAddonlayoutsexcept' parameters in /apprain/developer/addons/update/richtexteditor...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the dataAddonlayouts and dataAddonlayoutsexcept parameters in the /apprain/developer/addons/update/richtexteditor process. An attacker can execute arbitrary JavaScript code in the context of another user by...

CVE-2025-41057 Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataAddonlayouts' and 'dataAddonlayoutsexcept' parameters in /apprain/developer/addons/update/richtexteditor...

CVE-2025-41057 Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataAddonlayouts' and 'dataAddonlayoutsexcept' parameters in /apprain/developer/addons/update/richtexteditor...

CVE-2025-41057

CVE-2025-41057 (appRain CMF 4.0.5) : A stored authenticated XSS vulnerability exists due to insufficient validation of user input in the API endpoint /apprain/developer/addons/update/rich_text_editor, specifically via the data[Addon][layouts] and data[Addon][layouts_except] parameters. This could...

CVE-2025-9519

The Easy Timer plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.1 via the plugin's shortcodes. This is due to insufficient restriction of shortcode attributes. This makes it possible for authenticated attackers, with Editor-level access and...

In Emacs before 29.3, LaTeX preview is enabled by default for e-mail attachments.

...

CVE-2025-9519

CVE-2025-9519 affects the WordPress plugin Easy Timer (≤ 4.2.1). The issue enables Remote Code Execution via shortcode attributes due to insufficient restriction, exploitable by authenticated users with Editor level access or higher. Reported CVSS v3.1 base score 7.2 (HIGH) with network access, h...

CVE-2025-9519 Easy Timer <= 4.2.1 - Authenticated (Editor+) Remote Code Execution via Shortcode

The Easy Timer plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.1 via the plugin's shortcodes. This is due to insufficient restriction of shortcode attributes. This makes it possible for authenticated attackers, with Editor-level access and...