WordPress ThemeREX Addons plugin <= 2.32.3 - Unauthenticated Arbitrary File Upload in trx_addons_uploads_save_data vulnerability

Unauthenticated Arbitrary File Upload in trxaddonsuploadssavedata vulnerability discovered by Tonn in WordPress Plugin ThemeREX Addons versions = 2.32.3...

January 28, 2025—KB5050094 (OS Build 26100.3037) Preview

None None...

CVE-2025-24671

CVE-2025-24671 : Deserialization of untrusted data in the Save as PDF plugin by Pdfcrowd (versions

CVE-2025-24671 WordPress Save as PDF Plugin by Pdfcrowd Plugin <= 4.4.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Pdfcrowd Dev Team Save as PDF save-as-pdf-by-pdfcrowd allows Object Injection.This issue affects Save as PDF: from n/a through = 4.4.0...

PT-2025-5491

Name of the Vulnerable Software and Affected Versions Pdfcrowd Save as PDF plugin versions n/a through 4.4.0 Description The issue is related to the deserialization of untrusted data, allowing object injection in the Pdfcrowd Save as PDF plugin. This enables potential attackers to inject objects,...

The vulnerability of the `saveRequestFiles` function in the Fastify JavaScript software framework allows a hacker to trigger a service failure.

The vulnerability of the saveRequestFiles function in the Fastify JavaScript software framework is related to the use of incorrect authentication tokens due to unlimited resource distribution. Exploiting this vulnerability could allow a malicious actor to cause service failures by sending special...

WordPress plugin Save as PDF plugin by Pdfcrowd 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin Save as PDF plugi...

CVE-2025-24671: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in Pdfcrowd Dev Team Save as PDF save-as-pdf-by-pdfcrowd allows Object Injection.This issue affects Save as PDF: from n/a through = 4.4.0...

PT-2025-1676 · WordPress · Vikbooking Hotel Booking Engine & Pms

Name of the Vulnerable Software and Affected Versions: VikBooking Hotel Booking Engine & PMS plugin for WordPress versions up to, and including, 1.7.2 Description: The issue is due to missing or incorrect nonce validation on the save function, making it possible for unauthenticated attackers to...

WordPress plugin Youzify 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2025-2137 · WordPress · Youzify

Name of the Vulnerable Software and Affected Versions: Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress versions up to, and including, 1.3.2 Description: The issue is related to unauthorized access due to a missing capability check on the save addon k...

CVE-2025-24033 @fastify/multipart vulnerable to unlimited consumption of resources

@fastify/multipart is a Fastify plugin for parsing the multipart content-type. Prior to versions 8.3.1 and 9.0.3, the saveRequestFiles function does not delete the uploaded temporary files when user cancels the request. The issue is fixed in versions 8.3.1 and 9.0.3. As a workaround, do not use...

CVE-2025-23960

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in basteln3rk Save & Import Image from URL save-import-image-from-url allows Reflected XSS.This issue affects Save & Import Image from URL: from n/a through = 0.7...

CVE-2025-23960

CVE-2025-23960 describes a Reflected XSS vulnerability in the WordPress plugin Save & Import Image from URL . Affected: plugin versions up to 0.7 (listed as from n/a through 0.7). Root cause: improper neutralization of input during web page generation, enabling reflection of injected payloads. Im...

CVE-2025-23960 WordPress Save & Import Image from URL Plugin <= 0.7 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in basteln3rk Save & Import Image from URL save-import-image-from-url allows Reflected XSS.This issue affects Save & Import Image from URL: from n/a through = 0.7...

PT-2025-5234 · Unknown · Basteln3Rk Save & Import Image From Url

Name of the Vulnerable Software and Affected Versions: basteln3rk Save & Import Image from URL versions n/a through 0.7 Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting'. This allows for Reflected XSS in the Save...

PT-2025-1271

Name of the Vulnerable Software and Affected Versions @fastify/multipart versions prior to 8.3.1 @fastify/multipart versions prior to 9.0.3 Description @fastify/multipart is a Fastify plugin used for parsing the multipart content-type. The saveRequestFiles function fails to delete uploaded...

CVE-2025-23960: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in basteln3rk Save & Import Image from URL save-import-image-from-url allows Reflected XSS.This issue affects Save & Import Image from URL: from n/a through = 0.7...

WordPress plugin AI Power 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2025-2133

Name of the Vulnerable Software and Affected Versions AI Power: Complete AI Pack plugin for WordPress versions up to, and including, 1.8.96 Description The issue is related to a missing capability check on the wpaicg save image media function. This allows authenticated attackers with...