WordPress wpForo Advanced Attachments plugin <= 3.1.3 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Christie BOUTIER in WordPress Plugin wpForo Advanced Attachments versions = 3.1.3...

WordPress WordPress Comments Import & Export plugin <= 2.4.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Missing Authorization to Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Jorgson in WordPress Plugin Comments Import & Export versions = 2.4.3...

WordPress Uncanny Automator plugin <= 6.4.0.2 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Denver Jackson in WordPress Plugin Uncanny Automator versions = 6.4.0.2...

CVE-2025-48958 Froxlor has an HTML Injection Vulnerability

Froxlor is open source server administration software. Prior to version 2.2.6, an HTML Injection vulnerability in the customer account portal allows an attacker to inject malicious HTML payloads in the email section. This can lead to phishing attacks, credential theft, and reputational damage by...

WordPress Offsprout Page Builder plugin 2.2.1-2.15.2 - Authenticated (Contributor+) Privilege Escalation via permission_callback Function

Authenticated Contributor+ Privilege Escalation via permissioncallback Function vulnerability discovered by kr0d in WordPress Plugin Offsprout Page Builder versions 2.2.1-2.15.2...

WordPress Woo Slider Pro <= 1.12 - Arbitrary Content Deletion Vulnerability

Arbitrary Content Deletion Vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin Woo Slider Pro versions = 1.12...

WordPress History Log by click5 plugin <= 1.0.13 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by SashaRyba in WordPress Plugin History Log by click5 versions = 1.0.13...

WordPress Blog Designer PRO plugin <= 3.4.7 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Seb in WordPress Plugin Blog Designer PRO versions = 3.4.7...

WordPress MaxiBlocks plugin <= 2.1.0 - Arbitrary Option Update to Privilege Escalation vulnerability

Arbitrary Option Update to Privilege Escalation vulnerability discovered by Aiden Thái An in WordPress Plugin MaxiBlocks versions = 2.1.0...

WordPress WordPress Gearside Developer Dashboard plugin <= 1.0.72 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Tommaso Gregori p1s1o in WordPress Plugin Gearside Developer Dashboard versions = 1.0.72...

SUSE SLED15 / SLES15 Security Update : brltty (SUSE-SU-2025:01582-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:01582-1 advisory. - Avoid having brlapi.key temporarily world-readable during creation bsc1235438. Tenable has extracted the preceding...

CVE-2025-5281

Inappropriate implementation in BFCache in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially obtain user information via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-5283

Use after free in libvpx in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-5064

Inappropriate implementation in Background Fetch API in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

WordPress Verge3D plugin <= 4.9.3 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Hiro Code016Hiro in WordPress Plugin Verge3D versions = 4.9.3...

WordPress Quick Contact Form plugin <= 8.2.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Quick Contact Form versions = 8.2.1...

Exploit for CVE-2025-1461

Vuetify VCalendar XSS Vulnerability POC CVE-2025-1461 This...

WordPress WP Posts Carousel <= 1.3.12 - PHP Object Injection Vulnerability

PHP Object Injection Vulnerability discovered by astra.r3verii Patchstack Alliance in WordPress Plugin WP Posts Carousel versions = 1.3.12...

SUSE CVE-2025-5064

Inappropriate implementation in Background Fetch API in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2025-5065

Inappropriate implementation in FileSystemAccess API in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...