WordPress Popular Posts by Webline plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Popular Posts by Webline versions = 1.1.1...

CVE-2025-9984

The Featured Image from URL FIFU plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the fifuapidebugposts function in all versions up to, and including, 5.2.7. This makes it possible for unauthenticated attackers to read private/password protect...

CVE-2025-9984 Featured Image from URL (FIFU) <= 5.2.7 - Missing Authorization to Password Protected Post Disclosure

The Featured Image from URL FIFU plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the fifuapidebugposts function in all versions up to, and including, 5.2.7. This makes it possible for unauthenticated attackers to read private/password protect...

CVE-2025-10037 Featured Image from URL (FIFU) <= 5.2.7 - Authenticated (Admin+) SQL Injection

The Featured Image from URL FIFU plugin for WordPress is vulnerable to SQL Injection via the getpostswithinternalfeaturedimage function in all versions up to, and including, 5.2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2025-9984

CVE-2025-9984 (FIFU, Featured Image from URL, WordPress) : The FIFU plugin is vulnerable to an unauthorized access exposure due to a missing capability check in fifu_api_debug_posts(). This allows unauthenticated attackers to read private/password protected posts in all versions up to 5.2.7. Conn...

CVE-2025-9984 Featured Image from URL (FIFU) <= 5.2.7 - Missing Authorization to Password Protected Post Disclosure

The Featured Image from URL FIFU plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the fifuapidebugposts function in all versions up to, and including, 5.2.7. This makes it possible for unauthenticated attackers to read private/password protect...

WordPress plugin Featured Image from URL 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

PT-2025-39498

Name of the Vulnerable Software and Affected Versions Featured Image from URL FIFU plugin for WordPress versions through 5.2.7 Description The plugin is susceptible to unauthorized data access because of a missing capability check within the fifu api debug posts function. This allows...

GHSA-8MJQ-32X3-22QF Duplicate Advisory: Malicious versions of Nx were published

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-cxm3-wv7p-598c. This link is maintained to preserve external references. Original Description Malicious code was inserted into the Nx build system package and several related plugins. The tampered package was...

CVE-2025-57205

iNiLabs School Express SMS Express 6.2 is affected by a Stored Cross-Site Scripting XSS vulnerability in the content-management features available to authenticated admin users. The vulnerability resides in POSTed editor parameters submitted to the /posts/edit/id endpoint and similarly in Notice a...

CVE-2025-57205

iNiLabs School Express SMS Express 6.2 is affected by a Stored Cross-Site Scripting XSS vulnerability in the content-management features available to authenticated admin users. The vulnerability resides in POSTed editor parameters submitted to the /posts/edit/id endpoint and similarly in Notice a...

CVE-2025-57205

iNiLabs School Express SMS Express 6.2 is affected by a Stored Cross-Site Scripting XSS vulnerability in the content-management features available to authenticated admin users. The vulnerability resides in POSTed editor parameters submitted to the /posts/edit/id endpoint and similarly in Notice a...

CVE-2025-57205

Inilabs School Express (SMS Express) 6.2 is affected by a Stored XSS in content-management editors (POST /posts/edit/{id} and similar for Notices/Pages). The root cause is insufficient input sanitization and output encoding for editor parameters; payloads are saved and later rendered unsanitized,...

CVE-2025-9905

creationtimestamp| type| source ---|---|--- 2025-09-19 10:32:08+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3lz6nxomxeo2b 2025-09-19 11:27:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lz6r36ijyp2t 2025-09-19 16:28:32+00:00| published-proof-of-concept|...

CVE-2025-30187

creationtimestamp| type| source ---|---|--- 2025-09-18 11:17:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lz47ztxdzp2g 2025-10-02 20:42:51+00:00| seen| https://bsky.app/profile/ferramentaslinux.bsky.social/post/3m2ag5mcysc2t...

CVE-2025-30519

creationtimestamp| type| source ---|---|--- 2025-09-18 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-07 2025-09-18 20:03:59+00:00| seen| https://bsky.app/profile/pigondrugs.bsky.social/post/3lz55hd4prc27 2025-09-19 01:32:16+00:00| seen|...

CVE-2025-54754

creationtimestamp| type| source ---|---|--- 2025-09-18 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-06 2025-09-18 20:03:18+00:00| seen| https://bsky.app/profile/pigondrugs.bsky.social/post/3lz55g3jmvi2g 2025-09-18 21:29:01+00:00| seen|...

CVE-2025-10493

creationtimestamp| type| source ---|---|--- 2025-09-18 07:27:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lz3t6amegp2x 2025-12-25 18:30:11+00:00| seen| https://bsky.app/profile/exploitdb-bot.bsky.social/post/3matfvqfi2l2u 2025-12-26 21:03:02+00:00| seen|...

CVE-2023-49564

creationtimestamp| type| source ---|---|--- 2025-09-18 07:17:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lz3smdpk672c 2025-09-18 08:27:48+00:00| seen| https://gist.github.com/Darkcrai86/d31f51c58973cf36f4efdaaec55924df 2025-09-19 12:49:10+00:00| seen|...

CVE-2025-59340

creationtimestamp| type| source ---|---|--- 2025-09-18 04:32:10+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3lz3jf3gfbn2w 2025-09-19 07:32:32+00:00| seen| https://bsky.app/profile/crowdcyber.bsky.social/post/3lz6dwkaulg2c 2025-09-19 13:13:41+00:00| seen|...