CVE-2025-3780

The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wcfmredirecttosetup function in all versions up to, and including, 6.7.16. This makes i...

Jenkins plugin Warrior Framework 安全漏洞

Jenkins and Jenkins plugin are both Jenkins open source products.Jenkins is an application software. An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins plugin is an application software plugin. A security...

Jenkins plugin Sensedia Api Platform tools 安全漏洞

Jenkins and Jenkins plugin are both Jenkins open source products.Jenkins is an application software. An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins plugin is an application software plugin. A security...

Jenkins plugin Statistics Gatherer 安全漏洞

Jenkins and Jenkins plugin are both Jenkins open source products.Jenkins is an application software. An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins plugin is an application software plugin. A security...

PT-2025-28828 · WordPress · Wordpress Pie Register

Name of the Vulnerable Software and Affected Versions: WordPress Pie Register plugin versions ≤ 3.7.1.4 Description: An authentication bypass issue exists that allows unauthenticated attackers to impersonate arbitrary users by submitting a crafted POST request to the "login endpoint". By setting...

The vulnerability of the CADImage plugin in the IrfanView software, which is used for viewing and playing graphic, video, and audio files, allows a hacker to execute arbitrary code.

The vulnerability of the CADImage plugin in IrfanView, a program for viewing and playing graphic, video, and audio files, relates to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to execute arbitrary code using specially...

PT-2025-28915 · Jenkins · Jenkins Ibm Cloud Devops Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins IBM Cloud DevOps Plugin versions 2.0.16 and earlier Description: The Jenkins IBM Cloud DevOps Plugin stores SonarQube authentication tokens unencrypted in job config.xml files on the Jenkins controller. These tokens are accessible to...

Jenkins plugin Sensedia Api Platform tools 安全漏洞

Jenkins and Jenkins plugin are both Jenkins open source products.Jenkins is an application software. An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins plugin is an application software plugin. A security...

The vulnerability of the “Import from XML and YML” plugin exists due to the lack of protective measures for website structure. This allows attackers to execute XSS attacks.

The vulnerability of the “Import from XML, and YML” plugin exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

CVE-2025-4828

The CVE-2025-4828 entry concerns the WordPress Support Board plugin, where arbitrary file deletion is possible due to insufficient file path validation in sb_file_delete across all versions up to 3.8.0. This can lead to remote code execution when critical files (e.g., wp-config.php) are deleted. ...

CVE-2025-4855

CVE-2025-4855 concerns the WordPress plugin Support Board. Multiple sources confirm a vulnerability in all versions up to 3.8.0 where hardcoded default secrets in sb_encryption() enable unauthenticated bypass of authorization and the execution of arbitrary AJAX actions via sb_ajax_execute(). This...

CVE-2025-3780 WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.16 - Missing Authorization to Unauthenticated Plugin Settings Modification

The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wcfmredirecttosetup function in all versions up to, and including, 6.7.16. This makes i...

WordPress Simple Featured Image plugin <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via slideshow Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via slideshow Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin Simple Featured Image versions = 1.3.1...

WordPress Support Board plugin <= 3.8.0 - Unauthenticated Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion vulnerability discovered by Foxyyy in WordPress Plugin Support Board versions = 3.8.0...

WordPress Pakke Envíos plugin <= 1.0.2 - SQL Injection Vulnerability

SQL Injection Vulnerability discovered by Nguyen Kim Sang in WordPress Plugin Pakke Envíos versions = 1.0.2...

WordPress Internal Linking of Related Contents plugin <= 1.1.8 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by astra.r3verii Patchstack Alliance in WordPress Plugin Internal Linking of Related Contents versions = 1.1.8...

WordPress Learts Addons Plugin < 1.7.5 - SQL Injection Vulnerability

SQL Injection Vulnerability discovered by Bonds in WordPress Plugin Learts Addons versions 1.7.5...

CVE-2025-7327

CVE-2025-7327 – Widget for Google Reviews (WordPress) is a directory traversal vulnerability in all versions up to and including 1.0.15. An authenticated attacker with Subscriber-level access or higher can abuse the layout parameter to include and execute arbitrary PHP files on the server, enabli...

CVE-2025-5537

The Lightbox & Modal Popup WordPress Plugin – FooBox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alternative texts in all versions up to, and including, 2.7.34 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2025-5957

The Guest Support – Complete customer support ticket system for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'deleteMassTickets' function in all versions up to, and including, 1.2.2. This makes it possible for unauthenticated...