PT-2025-11253

Name of the Vulnerable Software and Affected Versions JobCareer | Job Board Responsive WordPress Theme versions up to, and including, 7.1 Description The JobCareer | Job Board Responsive WordPress Theme theme for WordPress is vulnerable to unauthorized access, modification, and loss of data due t...

CVE-2025-2216

A vulnerability, which was classified as critical, has been found in zzskzy Warehouse Refinement Management System 1.3. Affected by this issue is the function UploadCrash of the file /crash/log/SaveCrash.ashx. The manipulation of the argument file leads to unrestricted upload. The attack may be...

WordPress Responsive Google Map plugin <= 3.1.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Responsive Google Map versions = 3.1.5...

CVE-2025-28920

Missing Authorization vulnerability in Jogesh Responsive Google Map responsive-google-map allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Google Map: from n/a through = 3.1.5...

WordPress plugin Responsive Google Map 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2025-10953

Name of the Vulnerable Software and Affected Versions: Jogesh Responsive Google Map versions 3.1.5 and earlier Description: The issue is related to a Missing Authorization vulnerability in Jogesh Responsive Google Map, which allows exploiting incorrectly configured access control security levels...

CVE-2025-28920: Missing Authorization

Missing Authorization vulnerability in Jogesh Responsive Google Map responsive-google-map allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Google Map: from n/a through = 3.1.5...

CVE-2024-12119: Improper Neutralization of Input During Web Page Generation

The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the defaultgallerytitlesize parameter in all versions up to, and including, 2.4.29 due to insufficient input sanitization and output escapin...

CVE-2024-12114: Authorization Bypass Through User-Controlled Key

The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.29 via the foogalleryattachmentmodalsave AJAX action due to missing validation on a user controll...

CVE-2024-13655: Missing Authorization

The Flex Mag - Responsive WordPress News Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the propanelofajaxcallback function in all versions up to, and including, 3.5.2. This makes it possible f...

WordPress plugin Responsive Lightbox & Gallery 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-9810

Name of the Vulnerable Software and Affected Versions The Hero Mega Menu - Responsive WordPress Menu Plugin versions up to, and including, 1.16.5 Description The issue arises from insufficient file path validation in the hmenu delete menu function, allowing unauthenticated attackers to delete...

PT-2025-9806

Name of the Vulnerable Software and Affected Versions The Master Slider – Responsive Touch Slider plugin for WordPress versions up to, and including, 3.10.6 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's ms layer...

CVE-2024-11731: Improper Neutralization of Input During Web Page Generation

The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's msslider shortcode in all versions up to, and including, 3.10.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-13780: Missing Authorization

The Hero Mega Menu - Responsive WordPress Menu Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the hmenudeletemenu function in all versions up to, and including, 1.16.5. This makes it possible for unauthenticated attackers to delete...

CVE-2024-13779: Improper Neutralization of Input During Web Page Generation

The Hero Mega Menu - Responsive WordPress Menu Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'index' parameter in all versions up to, and including, 1.16.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2024-13757: Improper Neutralization of Input During Web Page Generation

The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mslayer shortcode in all versions up to, and including, 3.10.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-13778: Improper Neutralization of Special Elements used in an SQL Command

The Hero Mega Menu - Responsive WordPress Menu Plugin plugin for WordPress is vulnerable to SQL Injection via several functions in all versions up to, and including, 1.16.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

CVE-2025-1831

A vulnerability classified as critical has been found in zj1983 zz up to 2024-8. Affected is the function GetDBUser of the file src/main/java/com/futvan/z/system/zorg/ZorgAction.java. The manipulation of the argument userid leads to sql injection. It is possible to launch the attack remotely. The...

CVE-2025-26904

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in galop WP Responsive Auto Fit Text wp-responsive-slab-text allows DOM-Based XSS.This issue affects WP Responsive Auto Fit Text: from n/a through = 0.2...