PT-2025-21396 · WordPress · Applyonline

Name of the Vulnerable Software and Affected Versions: ApplyOnline WordPress plugin versions prior to 2.6.3 Description: The issue concerns the ApplyOnline WordPress plugin, which fails to protect files uploaded during the application process. This allows unauthenticated users to access these fil...

PT-2025-21375 · WordPress · Payment Gateway For Telcell

Name of the Vulnerable Software and Affected Versions: The Payment Gateway for Telcell WordPress plugin versions 2.0.1 and earlier Description: The issue is related to an Open Redirect problem. It occurs because the api url parameter is not validated before the user is redirected to its value. Th...

PT-2025-21336 · Ni · Ni Circuit Design Suite

Name of the Vulnerable Software and Affected Versions: NI Circuit Design Suite versions 14.3.0 and prior versions Description: The issue is due to a memory corruption vulnerability caused by an out of bounds read in the GetSymbolBorderRectSize function when using the SymbolEditor. This may result...

PT-2025-21557 · WordPress · Spiritual Gifts Survey

Name of the Vulnerable Software and Affected Versions: Spiritual Gifts Survey WordPress plugin versions 0.9.10 and earlier Description: The issue concerns a Reflected Cross-Site Scripting problem. It arises because a parameter is not properly sanitized and escaped before being output back in the...

PT-2025-21504 · WordPress · Clicksold Idx Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: ClickSold IDX WordPress plugin versions 1.90 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because the plugin does not properly sanitise and...

PT-2025-21472 · WordPress · Smart Post Show

Name of the Vulnerable Software and Affected Versions: The Smart Post Show WordPress plugin versions prior to 2.4.28 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is...

PT-2025-21353 · Automattic · Jetpack Debug Tools

Name of the Vulnerable Software and Affected Versions: Automattic Jetpack Debug Tools version prior to 2.0.1 Description: A Missing Authorization issue affects the Jetpack Debug Tools, allowing potential unauthorized access. Recommendations: For versions prior to 2.0.1, update to version 2.0.1 or...

PT-2025-21427 · WordPress · Jsp Store Locator

Name of the Vulnerable Software and Affected Versions: JSP Store Locator WordPress plugin versions 1.0 and earlier Description: The issue is related to the lack of CSRF checks in some areas of the plugin, which could allow attackers to make logged-in users perform unwanted actions via CSRF attack...

PT-2025-21394 · WordPress · Jetpack

Name of the Vulnerable Software and Affected Versions: Jetpack WordPress plugin versions prior to 13.8 Description: The issue concerns the Jetpack WordPress plugin, where posts created by the Contact Form are not properly restricted to authorized users. This could allow unauthenticated users to...

PT-2025-21383 · WordPress · The Illi Link Party!

Name of the Vulnerable Software and Affected Versions: The illi Link Party! WordPress plugin version 1.0 Description: The issue allows unauthenticated visitors to perform Cross-Site Scripting attacks due to the plugin's failure to sanitise and escape some parameters. Recommendations: For The illi...

PT-2025-21550

Name of the Vulnerable Software and Affected Versions: EKC Tournament Manager versions prior to 2.2.2 Description: The issue allows a logged-in admin to download system files outside of the WordPress directory. This is a significant concern as it could potentially expose sensitive system...

PT-2025-21399 · WordPress · Rbs Image Gallery

Name of the Vulnerable Software and Affected Versions: Rbs Image Gallery WordPress plugin versions prior to 3.2.22 Description: The issue concerns the Rbs Image Gallery WordPress plugin, where some settings are not properly sanitized and escaped, potentially allowing high-privilege users, such as...

PT-2025-21325

Name of the Vulnerable Software and Affected Versions: Mattermost versions 10.5.x through 10.5.2 Mattermost versions 9.11.x through 9.11.11 Description: The issue is related to improper verification of a user's permissions when accessing groups. This allows an attacker to view group information v...

PT-2025-21358 · Dell · Dell Powerscale Onefs

Name of the Vulnerable Software and Affected Versions: Dell PowerScale OneFS versions 9.4.0.0 through 9.9.0.0 Description: The issue is related to an uncontrolled resource consumption vulnerability. A remote unprivileged attacker could potentially exploit this, leading to denial of service...

PT-2025-21419 · WordPress · Ahathat Plugin

Name of the Vulnerable Software and Affected Versions: AHAthat Plugin WordPress plugin versions 1.6 and earlier Description: The issue allows Admin to perform SQL injection attacks due to the lack of sanitization and escaping of a parameter before using it in a SQL statement. Recommendations: For...

PT-2025-21422 · WordPress · Planning Center Online Giving

Name of the Vulnerable Software and Affected Versions: The Planning Center Online Giving WordPress plugin versions 1.0.0 and earlier Description: The issue concerns a lack of validation and escaping of certain shortcode attributes, which could allow users with the contributor role and above to...

PT-2025-21464 · WordPress · Podlove Podcast Publisher

Name of the Vulnerable Software and Affected Versions: Podlove Podcast Publisher WordPress plugin versions prior to 4.2.1 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is...

PT-2025-21552 · WordPress · Auto Affiliate Links

Name of the Vulnerable Software and Affected Versions: Auto Affiliate Links WordPress plugin versions prior to 6.4.7 Description: The issue allows administrators to perform SQL injection attacks due to the lack of sanitization and escaping of a parameter before it is used in a SQL statement...

PT-2025-21385 · WordPress · The Illi Link Party!

Name of the Vulnerable Software and Affected Versions: The illi Link Party! WordPress plugin versions 1.0 and earlier Description: The issue allows users with a role as low as admin to perform Cross-Site Scripting attacks due to the plugin not sanitizing and escaping some parameters...

PT-2025-21433 · WordPress · Clasify Classified Listing Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Clasify Classified Listing WordPress plugin versions 1.0.0 through 1.0.7 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted...