WordPress Internal Link Optimiser plugin <= 5.1.3 - CSRF to XSS vulnerability

CSRF to XSS vulnerability discovered by johska in WordPress Plugin Internal Link Optimiser versions = 5.1.3...

WordPress Mediavine Control Panel plugin <= 2.10.6 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by anhchangmutrang in WordPress Plugin Mediavine Control Panel versions = 2.10.6...

WordPress Hostel plugin <= 1.1.5.6 - SQL Injection Vulnerability

SQL Injection Vulnerability discovered by astra.r3verii in WordPress Plugin Hostel versions = 1.1.5.6...

WordPress WowStore plugin <= 4.2.4 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by astra.r3verii in WordPress Plugin WowStore versions = 4.2.4...

WordPress Fast eBay Listings plugin <= 2.12.15 - Open Redirection Vulnerability

Open Redirection Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Fast eBay Listings versions = 2.12.15...

WordPress Administrator Z plugin <= 2025.03.28 - Directory Traversal Vulnerability

Directory Traversal Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Administrator Z versions = 2025.03.28...

WordPress Custom CSS, JS & PHP plugin <= 2.4.1 - CSRF to RCE vulnerability

CSRF to RCE vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Custom CSS, JS & PHP versions = 2.4.1...

DEBIAN-CVE-2025-30215

NATS-Server is a High-Performance server for NATS.io, the cloud and edge native messaging system. In versions starting from 2.2.0 but prior to 2.10.27 and 2.11.1, the management of JetStream assets happens with messages in the $JS. subject namespace in the system account; this is partially expose...

CVE-2025-32385

EspoCRM is an Open Source Customer Relationship Management software. Prior to 9.0.5, Iframe dashlet allows user to display iframes with arbitrary URLs. As the sandbox attribute is not included in the iframe, the remote page can open popups outside of the iframe, potentially tricking users and...

Ethercreative Logs 3.0.3 - Path Traversal

Exploit Title: Ethercreative Logs 3.0.3 - Path Traversal Date: 2022.01.26 Exploit Author: Steffen Rogge, SC Vendor Homepage: https://github.com/ethercreative/logs Software Link: https://plugins.craftcms.com/logs Version: =3.0.4 impact: Medium found: 2021-07-06 SEC Consult Vulnerability Lab An...

PT-2025-16626 · Unknown · Yuya Hoshino Bulk Term Editor

Name of the Vulnerable Software and Affected Versions: Yuya Hoshino Bulk Term Editor versions 1.1.4 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. Recommendations: For Yuya Hoshin...

PT-2025-16734 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A vulnerability in the Linux kernel has been resolved, related to the powerpc/perf component. The issue arises from the introduction of the 'vpa pmu' PMU, which does not assign ownersh...

CVE-2025-32388 SvelteKit allows XSS via tracked search_params

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.20.6 , unsanitized search param names cause XSS vulnerability. You are affected if you iterate over all entries of event.url.searchParams inside a server load function. Attackers can explo...

CVE-2025-32388 SvelteKit allows XSS via tracked search_params

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.20.6 , unsanitized search param names cause XSS vulnerability. You are affected if you iterate over all entries of event.url.searchParams inside a server load function. Attackers can explo...

WordPress WP Staging Pro plugin <= 6.1.2 - Unauthenticated Information Exposure via getOutdatedPluginsRequest Function vulnerability

Unauthenticated Information Exposure via getOutdatedPluginsRequest Function vulnerability discovered by haidv35 in WordPress Plugin Wp Staging Pro versions = 6.1.2...

WordPress Feedify – Web Push Notifications plugin <= 2.4.5 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Feedify – Web Push Notifications versions = 2.4.5...

WordPress Simple Social Media Share Buttons plugin < 6.0.0 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin Simple Social Media Share Buttons versions 6.0.0...

CVE-2025-31494 AutoGPT allows cross-user sharing of node execution results through WebSockets API

AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. The AutoGPT Platform's WebSocket API transmitted node execution updates to subscribers based on the graphid+graphversion. Additionally, there was no che...

WordPress Responsive Addons for Elementor plugin <= 1.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'rael_title_tag' vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'raeltitletag' vulnerability discovered by Prissy in WordPress Plugin Responsive Addons for Elementor versions = 1.6.9...

WordPress Total processing card payments for WooCommerce plugin <= 7.1.6 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara Kinorth in WordPress Plugin Nomupay Payment Processing Gateway versions = 7.1.6...