PT-2025-29777 · Nootheme · Nootheme Yogi

Name of the Vulnerable Software and Affected Versions: NooTheme Yogi versions through 2.9.0 Description: The software contains a deserialization of untrusted data flaw that allows for object injection. Recommendations: Update NooTheme Yogi to a version later than 2.9.0...

PT-2025-29804 · Unknown · Smu Manual Dofollow

Name of the Vulnerable Software and Affected Versions: SMu Manual DoFollow versions through 1.8.1 Description: The software contains a Reflected Cross-site Scripting XSS issue due to improper neutralization of input during web page generation. This allows for the injection of malicious scripts in...

PT-2025-29762 · WordPress · Wp Swings Wallet System For Woocommerce

Name of the Vulnerable Software and Affected Versions: WP Swings Wallet System for WooCommerce versions n/a through 2.6.7 Description: The software contains a Cross-Site Request Forgery CSRF flaw. This issue allows attackers to perform actions on behalf of authenticated users without their...

PT-2025-29801 · Unknown · Groundhogg

Name of the Vulnerable Software and Affected Versions: Groundhogg versions through 4.2.1 Description: Groundhogg is susceptible to an unrestricted file upload issue that allows for the upload of a web shell to a web server. Recommendations: Update Groundhogg to a version later than 4.2.1...

PT-2025-29778 · WordPress +1 · Easy Video Player +1

Name of the Vulnerable Software and Affected Versions: FWDesign Easy Video Player Wordpress & WooCommerce versions through 10.0 Description: The software contains a Path Traversal issue due to improper limitation of a pathname to a restricted directory. Recommendations: Update to a version later...

PT-2025-29782 · WordPress · Thimpress Wp Pipes

Name of the Vulnerable Software and Affected Versions: ThimPress WP Pipes versions through 1.4.3 Description: ThimPress WP Pipes is susceptible to a SQL injection issue due to improper neutralization of special elements used in SQL commands. Recommendations: Update ThimPress WP Pipes to a version...

PT-2025-29798 · WordPress · Elex Woocommerce Advanced Bulk Edit Products

Name of the Vulnerable Software and Affected Versions: ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes versions through 1.4.9 Description: The software contains a SQL injection flaw due to improper neutralization of special elements used in an SQL command. This allows for...

PT-2025-29734 · Themeisle · Hestia

Name of the Vulnerable Software and Affected Versions: Hestia versions through 3.2.10 Description: A missing authorization issue exists in ThemeIsle Hestia, allowing access to functionality not properly constrained by Access Control Lists ACLs. Recommendations: Update Hestia to a version later th...

PT-2025-29743 · Crocoblock · Jetsmartfilters

Name of the Vulnerable Software and Affected Versions: Crocoblock JetSmartFilters versions through 3.6.8 Description: The software contains a cross-site scripting XSS issue due to improper neutralization of input during web page generation. The vulnerability allows for stored XSS attacks...

PT-2025-29746 · Nanbu · Nanbu Welcart E-Commerce

Name of the Vulnerable Software and Affected Versions: nanbu Welcart e-Commerce versions through 2.11.16 Description: The software contains an Improper Neutralization of Input During Web Page Generation issue, which allows for Stored Cross-site Scripting XSS. This can potentially lead to the...

PT-2025-29814 · Unknown · Kingdom Creation Media Folder

Name of the Vulnerable Software and Affected Versions: Kingdom Creation Media Folder versions through 1.0.0 Description: The software contains a cross-site scripting issue due to improper neutralization of input during web page generation. This allows for reflected cross-site scripting XSS...

PT-2025-29781 · Unknown · Md Yeasin Ul Haider Url Shortener

Name of the Vulnerable Software and Affected Versions: Md Yeasin Ul Haider URL Shortener versions through 3.0.7 Description: The software contains a missing authorization flaw that allows access to functionality not properly constrained by Access Control Lists ACLs. Recommendations: Update Md...

PT-2025-29728 · Unknown · Kerfred Fg Drupal To Wordpress

Name of the Vulnerable Software and Affected Versions: Kerfred FG Drupal to WordPress versions n/a through 3.90.0 Description: A Server-Side Request Forgery SSRF vulnerability exists in Kerfred FG Drupal to WordPress, allowing Server Side Request Forgery. Recommendations: Update Kerfred FG Drupal...

PT-2025-29789 · Unknown · Coschool Lms

Name of the Vulnerable Software and Affected Versions: CoSchool LMS versions n/a through 1.4.3 Description: A deserialization of untrusted data issue exists in CoSchool LMS, allowing for object injection. Recommendations: Update CoSchool LMS to a version later than 1.4.3...

PT-2025-29878 · Tp Link · Archer C1200

Name of the Vulnerable Software and Affected Versions: TP-Link Archer C1200 versions prior to 1.1.6 Description: A clickjacking issue exists in the web management page of the TP-Link Archer C1200. This allows an attacker to deceive users into performing actions they did not intend through the...

PT-2025-29803 · Arisoft · Arisoft Contact Form 7 Editor Button

Name of the Vulnerable Software and Affected Versions: arisoft Contact Form 7 Editor Button versions through 1.0.0 Description: The software contains a Reflected Cross-site Scripting XSS issue due to improper neutralization of input during web page generation. This allows for potential malicious...

PT-2025-29815 · Unknown · Ezihosting Tennis Court Bookings

Name of the Vulnerable Software and Affected Versions: EZiHosting Tennis Court Bookings versions through 1.2.7 Description: The software contains a Reflected Cross-site Scripting XSS issue due to improper neutralization of input during web page generation. This allows an attacker to inject...

CVE-2025-53905 Vim has path traversial issue with tar.vim and special crafted tar files

Vim is an open source, command line text editor. Prior to version 9.1.1552, a path traversal issue in Vim’s tar.vim plugin can allow overwriting of arbitrary files when opening specially crafted tar archives. Impact is low because this exploit requires direct user interaction. However, successful...

Measured is vulnerable to Path Traversal attacks during class initialization

Impact A path traversal vulnerability exists where an attacker with access to manipulate inputs when initializing the Measured::Cache::Json class would be able to instruct the library to read arbitrary files. Patches Users should update to the latest version...

GHSA-29G5-M8V7-V564 Measured is vulnerable to Path Traversal attacks during class initialization

Impact A path traversal vulnerability exists where an attacker with access to manipulate inputs when initializing the Measured::Cache::Json class would be able to instruct the library to read arbitrary files. Patches Users should update to the latest version...