PT-2025-27125 · Unknown · Xili-Dictionary

Name of the Vulnerable Software and Affected Versions: xili-dictionary versions through 2.12.5.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS in the xili-dictionary...

PT-2025-27085 · Unknown · Thhake Photo Express For Google

Name of the Vulnerable Software and Affected Versions: thhake Photo Express for Google versions 0.3.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential...

PT-2025-27167 · WordPress · File Manager Plugin For Wordpress

Name of the Vulnerable Software and Affected Versions: File Manager Plugin For Wordpress versions prior to 7.5 Description: The issue allows attackers to upload dangerous files, including web shells, to a web server, compromising its security. This is due to an Unrestricted Upload of File with...

PT-2025-27141 · Unknown · Favethemes Homey

Name of the Vulnerable Software and Affected Versions: favethemes Homey versions n/a through 2.4.5 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations:...

PT-2025-27214 · Acmeedesign · Wpshapere Lite

Name of the Vulnerable Software and Affected Versions: AcmeeDesign WPShapere Lite versions 1.4 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. Recommendations: For AcmeeDesign WPShapere Lite versions 1.4 and earlier, update to a versio...

PT-2025-27113 · Unknown · Zikzag Core

Name of the Vulnerable Software and Affected Versions: Zikzag Core versions 1.4.5 and earlier Description: The issue is related to an improper control of filename for include/require statement in a PHP program, also known as PHP Remote File Inclusion, which allows PHP Local File Inclusion...

PT-2025-27188 · WordPress · Category Slider For Woocommerce

Name of the Vulnerable Software and Affected Versions: WPB Category Slider for WooCommerce versions 1.71 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local...

PT-2025-27108 · Unknown · Fw Gallery

Name of the Vulnerable Software and Affected Versions: FW Gallery versions n/a through 8.0.0 Description: The issue is related to improper control of filename for include/require statement in PHP programs, also known as 'PHP Remote File Inclusion'. This allows PHP Local File Inclusion...

PT-2025-27035 · Flock Safety · Flock Safety Gunshot Detection

Name of the Vulnerable Software and Affected Versions: Flock Safety Gunshot Detection devices versions prior to 1.3 Description: The issue concerns an on-chip debug interface with improper access control in Flock Safety Gunshot Detection devices. Recommendations: For versions prior to 1.3, update...

PT-2025-27132 · Unknown · Ovatheme Brw

Name of the Vulnerable Software and Affected Versions: ovatheme BRW versions 1.7.9 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability. This allows PHP Local File...

PT-2025-27140 · Unknown · Directiq Email Marketing

Name of the Vulnerable Software and Affected Versions: DirectIQ Email Marketing versions n/a through 2.0 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2025-27098 · Buddhathemes · Buddhathemes Hydro

Name of the Vulnerable Software and Affected Versions: BuddhaThemes HYDRO versions n/a through 2.8 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an attacker can inje...

PT-2025-27192 · Unknown · Quick Favicon

Name of the Vulnerable Software and Affected Versions: Quick Favicon versions through 0.22.8 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This enables an attacker to inject malicious...

PT-2025-27114 · Unknown · Flexo Counter

Name of the Vulnerable Software and Affected Versions: Flexo Counter versions 1.0001 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to inject...

PT-2025-27172 · Virusdie · Virusdie

Name of the Vulnerable Software and Affected Versions: Virusdie versions 1.1.3 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. Recommendations: For Virusdie versions 1.1.3 and...

PT-2025-27212 · WordPress · Sh1Zen Wp Optimizer

Name of the Vulnerable Software and Affected Versions: sh1zen WP Optimizer versions 2.3.6 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows SQL Injection. Recommendations: For sh1zen WP Optimizer versions 2.3.6 and earlier, update to a version later...

PT-2025-27191 · Unknown · Add &Amp; Replace Affiliate Links For Amazon

Name of the Vulnerable Software and Affected Versions: Add & Replace Affiliate Links for Amazon versions 1.0.0 through 1.0.6 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks...

PT-2025-27223 · Unknown · Samcharrington Rss Digest

Name of the Vulnerable Software and Affected Versions: samcharrington RSS Digest versions n/a through 1.5 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on the web...

PT-2025-27170 · Gravity Forms · Address Autocomplete Via Google For Gravity Forms

Name of the Vulnerable Software and Affected Versions: Address Autocomplete via Google for Gravity Forms versions 1.3.4 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that affects the Address Autocomplete via Google for Gravity Forms plugin. This vulnerabili...

PT-2025-27174 · Unknown · Hide Admin Bar From Front End

Name of the Vulnerable Software and Affected Versions: Hide Admin Bar From Front End versions 1.0.0 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This is a type of attack where a...