CVE-2025-50029 WordPress AI Tools <= 4.0.7 - Arbitrary Content Deletion Vulnerability

Missing Authorization vulnerability in Ashish AI Tools artificial-intelligence-auto-content-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Tools: from n/a through = 4.0.7...

CVE-2025-50040 WordPress CF7 Spreadsheets Plugin <= 2.3.2 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in moshensky CF7 Spreadsheets cf7-spreadsheets allows Stored XSS.This issue affects CF7 Spreadsheets: from n/a through = 2.3.2...

CVE-2025-50040 WordPress CF7 Spreadsheets Plugin <= 2.3.2 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in moshensky CF7 Spreadsheets cf7-spreadsheets allows Stored XSS.This issue affects CF7 Spreadsheets: from n/a through = 2.3.2...

CVE-2025-52720 WordPress Super Store Finder Plugin <= 7.5 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in highwarden Super Store Finder superstorefinder-wp allows SQL Injection.This issue affects Super Store Finder: from n/a through = 7.5...

CVE-2024-49879

creationtimestamp| type| source ---|---|--- 2025-08-14 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07...

CVE-2023-52917

creationtimestamp| type| source ---|---|--- 2025-08-14 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07...

Security Bulletin: IBM Engineering Lifecycle Optimization - Publishing - Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file

Summary Scala could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization in LazyList. By sending specially-crafted request using gadget chain, an attacker could exploit this vulnerability to execute arbitrary code, erase contents of...

SUSE CVE-2025-54576

OAuth2-Proxy is an open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load balancer setups. In versions 7.10.0 and below, oauth2-proxy deployments are vulnerable when using the skipauthroutes configuration option...

WordPress plugin Integration for Contact Form 7 and Constant Contact 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

WordPress plugin Super Store Finder SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...

PT-2025-33207 · Unknown · Highwarden Super Store Finder

Name of the Vulnerable Software and Affected Versions: Highwarden Super Store Finder versions n/a through 7.5 Description: Highwarden Super Store Finder is susceptible to a SQL injection issue due to improper neutralization of special elements used in an SQL command. This allows for SQL injection...

PT-2025-33266

Name of the Vulnerable Software and Affected Versions: LibTIFF version 4.7.0 Description: A memory corruption issue was identified in the tiffcrop.c component, specifically within the May function. The issue can be triggered locally. The exploit has been publicly disclosed. Recommendations: At th...

PT-2025-33236 · WordPress · Crm Perks Integration For Contact Form 7/Constant Contact

Name of the Vulnerable Software and Affected Versions: CRM Perks Integration for Contact Form 7 and Constant Contact versions through 1.1.7 Description: The CRM Perks Integration for Contact Form 7 and Constant Contact is susceptible to a stored cross-site scripting XSS issue due to improper...

PT-2025-33170 · Unknown · Content Egg

Name of the Vulnerable Software and Affected Versions: Content Egg versions n/a through 7.0.0 Description: Deserialization of untrusted data in keywordrush Content Egg allows object injection. Recommendations: At the moment, there is no information about a newer version that contains a fix for th...

PT-2025-33164 · WordPress · Alvind Billplz Addon For Contact Form 7

Name of the Vulnerable Software and Affected Versions: Alvind Billplz Addon for Contact Form 7 versions through 1.2.0 Description: The software contains an Improper Neutralization of Input During Web Page Generation issue, leading to Reflected Cross-site Scripting XSS. This allows for the executi...

WordPress plugin Billplz Addon for Contact Form 7 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. The WordPress Billplz Addon for Contact Form 7 plugin suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escapin...

PT-2025-33402 · Crocoblock +1 · Jetelements For Elementor +1

Name of the Vulnerable Software and Affected Versions: Crocoblock JetElements For Elementor versions through 2.7.9 Description: Improper neutralization of input during web page generation allows for Stored Cross-site Scripting XSS. Recommendations: Update Crocoblock JetElements For Elementor to a...

WordPress Blocksy Theme <= 2.1.6 is vulnerable to Cross Site Scripting (XSS)

Software Blocksy Type Theme Vulnerable versions = 2.1.6 Fixed in 2.1.7 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2025-55713 Patch priority Low CVSS severity Low 5.9 Developer Creative Themes PSID 05f50ffb9258 Credits savphill Required privilege Shop manager...

Oracle Linux 7 : libxml2 (ELSA-2025-12240)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-12240 advisory. - Fix CVE-2025-6021, CVE-2025-32414, CVE-2025-49794, CVE-2025-49796 Tenable has extracted the preceding description block directly from the Oracle Lin...

PT-2025-33125 · WordPress · Structured Content (Json-Ld) #Wpsc

Name of the Vulnerable Software and Affected Versions: Structured Content JSON-LD wpsc WordPress plugin versions prior to 1.7.0 Description: The Structured Content JSON-LD wpsc WordPress plugin does not validate and escape certain block options before displaying them within a page or post,...