41794 matches found
CVE-2024-9182 Maspik - Advanced Spam protection < 2.1.3 - Admin+ Stored XSS
The Maspik WordPress plugin before 2.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...
CVE-2024-6690 WP Content Copy Protection & No Right Click (premium) < 15.3 - Open Redirect
The wccp-pro WordPress plugin before 15.3 contains an open-redirect flaw via the referrer parameter, allowing redirection of users to external sites...
CVE-2024-6693 WP Content Copy Protection & No Right Click (premium) <= 15.0 - Admin+ Stored XSS
The wccp-pro WordPress plugin before 15.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-11141 Sailthru Triggermail < 1.1 - Subscriber+ Stored XSS
The Sailthru Triggermail WordPress plugin through 1.1 does not sanitise and escape some of its settings and is missing CSRF protection which could allow subscribers to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-11141
The CVE-2024-11141 entry affects the Sailthru Triggermail WordPress plugin (versions 1.1 and earlier). The vulnerability arises because the plugin does not sanitize/escape certain settings and lacks CSRF protection, enabling Stored Cross-Site Scripting attacks even when unfiltered_html is disallo...
CVE-2024-11141 Sailthru Triggermail < 1.1 - Subscriber+ Stored XSS
The Sailthru Triggermail WordPress plugin through 1.1 does not sanitise and escape some of its settings and is missing CSRF protection which could allow subscribers to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-10098 ApplyOnline – Application Form Builder and Manager < 2.6.3 - Unauthenticated Application File Access
The ApplyOnline WordPress plugin before 2.6.3 does not protect uploaded files during the application process, allowing unauthenticated users to access them and any private information they contain...
GO-2025-3672 goshs route not protected, allows command execution in github.com/patrickhener/goshs
goshs route not protected, allows command execution in github.com/patrickhener/goshs...
Noyb Threatens Meta with Lawsuit for Violating GDPR to Train AI on E.U. User Data From May 27
Austrian privacy non-profit noyb none of your business has sent Meta's Irish headquarters a cease-and-desist letter, threatening the company with a class action lawsuit if it proceeds with its plans to train users' data for training its artificial intelligence AI models without an explicit opt-in...
CVE-2025-46721
nosurf is cross-site request forgery CSRF protection middleware for Go. A vulnerability in versions prior to 1.2.0 allows an attacker who controls content on the target site, or on a subdomain of the target site either via XSS, or otherwise to bypass CSRF checks and issue requests on user's behal...
Securing the Code: Building a Culture of Credential Protection in Dev Teams
Credential protection is key to preventing breaches. Secure APIs, rotate secrets and train devs to handle credentials safely…...
RHSA-2025:7569 Red Hat Security Advisory: yelp and yelp-xsl security update
Bulletin has no description...
[SECURITY] Fedora 42 Update: dnsdist-1.9.9-1.fc42
dnsdist is a highly DNS-, DoS- and abuse-aware loadbalancer. Its goal in life is to route traffic to the best server, delivering top performance to legitimate users while shunting or blocking abusive traffic...
WordPress plugin GDPR Framework By Data443 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A security vulnerability exists in...
PT-2025-21396 · WordPress · Applyonline
Name of the Vulnerable Software and Affected Versions: ApplyOnline WordPress plugin versions prior to 2.6.3 Description: The issue concerns the ApplyOnline WordPress plugin, which fails to protect files uploaded during the application process. This allows unauthenticated users to access these fil...
CFPB Quietly Kills Rule to Shield Americans From Data Brokers
Russell Vought, acting director of the Consumer Financial Protection Bureau, has canceled plans to more tightly regulate the sale of Americans’ sensitive personal data...
CVE-2025-47781
CVE-2025-47781 targets Rallly, an open-source scheduling tool. A 6-digit login token with weak entropy and no brute-force protection lets an unauthenticated attacker, knowing a valid email, brute-force the token within 15 minutes, potentially taking over the user’s account. Affected versions: up ...
Google’s Advanced Protection Now on Android
Google has extended its Advanced Protection features to Android devices. It's not for everybody, but something to be considered by high-risk users. Wired article, behind a paywall...