WordPress Popup Maker plugin <= 1.20.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via popupID Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via popupID Parameter vulnerability discovered by Asaf Mozes in WordPress Plugin Popup Maker versions = 1.20.4...

Arbitrary File Upload

Overview Affected versions of this package are vulnerable to Arbitrary File Upload through the /upload/GoodsCategory/image component. An attacker can cause code execution by uploading a malicious file. Remediation There is no fixed version for xyz.erupt:erupt. References - GitHub Gist - Vulnerabl...

WordPress WC MyParcel Belgium plugin <= 4.5.5-beta - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Ryan Novotny in WordPress Plugin WC MyParcel Belgium versions = 4.5.5-beta...

WordPress WordPress Comments Import & Export plugin <= 2.4.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Missing Authorization to Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Jorgson in WordPress Plugin Comments Import & Export versions = 2.4.3...

WordPress Real Cookie Banner plugin < 5.1.6 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin Real Cookie Banner versions 5.1.6...

WordPress Contact Forms by Cimatti plugin <= 1.9.8 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Shivam Khanna Patchstack Alliance in WordPress Plugin Contact Forms by Cimatti versions = 1.9.8...

WordPress Royal Elementor Addons and Templates plugin <= 1.7.1020 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Brian Sans-Souci liardom in WordPress Plugin Royal Elementor Addons versions = 1.7.1020...

WordPress WidgetKit plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara Kinorth in WordPress Plugin WidgetKit versions = 2.5.4...

WordPress NinjaTeam Chat for Telegram plugin <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via username Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via username Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin NinjaTeam Chat for Telegram versions = 1.1...

Origin Validation Error

Overview gradio is a Python library for easily interacting with trained machine learning models Affected versions of this package are vulnerable to Origin Validation Error through the isvalidorigin function. An attacker can manipulate the origin validation by altering the localhostaliases argumen...

WordPress Map Block Leaflet plugin <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via url Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin Map Block Leaflet versions = 3.2.1...

WordPress Smash Balloon Instagram Feed plugin <= 6.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-plugin` Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via data-plugin Attribute vulnerability discovered by Asaf Mozes in WordPress Plugin Instagram Feed versions = 6.9.0...

WordPress Tournamatch plugin <= 4.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Chuck in WordPress Plugin Tournamatch versions = 4.6.1...

WordPress WP Attachments plugin <= 5.0.12 - Reflected Cross-Site Scripting via attachment_id Parameter vulnerability

Reflected Cross-Site Scripting via attachmentid Parameter vulnerability discovered by m3ssap0 in WordPress Plugin WP Attachments versions = 5.0.12...

Buffer Overflow

Overview Affected versions of this package are vulnerable to Buffer Overflow through the SRBRoot::addTag function. An attacker can corrupt memory and execute arbitrary code locally by overflowing the subtag struct. Remediation There is no fixed version for icu. References - Red Hat Bugzilla Bug -...

WordPress Volunteer Sign Up Sheets plugin < 5.5.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Poystick Patchstack Alliance in WordPress Plugin Volunteer Sign Up Sheets versions 5.5.5...

SUSE CVE-2025-47282

Gardener External DNS Management is an environment to manage external DNS entries for a kubernetes cluster. A security vulnerability was discovered in Gardener's External DNS Management prior to version 0.23.6 that could allow a user with administrative privileges for a Gardener project or a user...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read through the SkipSpaces function, where the pointer is checked after dereferencing it in the while loop condition. This allows an attacker to read memory locations that should not be accessible by supplying crafted inp...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read through the MDLImporter::InternReadFileQuake1 function. An attacker can read data outside the intended buffer boundaries by manipulating the input data to the function. Remediation There is no fixed version for assimp...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read through the LWOImporter::GetS0 function. An attacker can read data outside the intended buffer boundaries by manipulating the 'out' argument. Remediation There is no fixed version for assimp. References - GitHub Issue...