MINI-X3VX-WCVW-M23W

Bulletin has no description...

EUVD-2025-198386

The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the "saveFutureActionData" function in all versions up to, and including,...

CVE-2025-13149 Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.1 - Authenticated (Author+) Missing Authorization to Post/Page Status Modification

The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the "saveFutureActionData" function in all versions up to, and including,...

CVE-2025-13149 Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.1 - Authenticated (Author+) Missing Authorization to Post/Page Status Modification

The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the "saveFutureActionData" function in all versions up to, and including,...

CVE-2025-13149 Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.1 - Authenticated (Author+) Missing Authorization to Post/Page Status Modification

The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the "saveFutureActionData" function in all versions up to, and including,...

PT-2025-47710

The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the "saveFutureActionData" function in all versions up to, and including,...

WordPress Post Expirator plugin <= 4.9.1 - Authenticated (Author+) Missing Authorization to Post/Page Status Modification vulnerability

Authenticated Author+ Missing Authorization to Post/Page Status Modification vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin Post Expirator versions = 4.9.1...

CVE-2025-36159

creationtimestamp| type| source ---|---|--- 2025-11-20 23:30:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m63wdrlill26...

CVE-2025-64655

creationtimestamp| type| source ---|---|--- 2025-11-20 22:44:19+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115584444564008370 2025-11-20 23:50:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m63xhodmdr2b 2025-11-21 10:34:04+00:00| seen|...

CVE-2025-64660

creationtimestamp| type| source ---|---|--- 2025-11-20 22:44:19+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115584444564008370 2025-11-26 02:38:02+00:00| seen| https://bsky.app/profile/secqube.com/post/3m6it6keobo23...

CVE-2025-49752

creationtimestamp| type| source ---|---|--- 2025-11-20 22:41:55+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115584435147386291 2025-11-20 23:40:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m63wvrieng2u 2025-11-20 23:45:08+00:00| seen|...

CVE-2025-62724

creationtimestamp| type| source ---|---|--- 2025-11-20 19:24:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m63ingrwrd2s...

EUVD-2025-198306

SOPlanning is vulnerable to Stored XSS in /status endpoint. Malicious attacker with an account can inject arbitrary HTML and JS into website, which will be rendered/executed when opening multiple pages. This issue was fixed in version 1.55...

GHSA-88PH-3236-2M2H

creationtimestamp| type| source ---|---|--- 2025-11-20 18:06:38+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115583352611017978...

CVE-2025-41076

creationtimestamp| type| source ---|---|--- 2025-11-20 17:24:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m63bvw5f542k...

CVE-2025-62729

SOPlanning is vulnerable to Stored XSS in /status endpoint. Malicious attacker with an account can inject arbitrary HTML and JS into website, which will be rendered/executed when opening multiple pages. This issue was fixed in version 1.55...

CVE-2025-62293

SOPlanning is vulnerable to Broken Access Control in /status endpoint. Due to lack of permission checks in Project Status functionality an authenticated attacker is able to add, edit and delete any status. This issue was fixed in version 1.55...

CVE-2025-62729

SOPlanning is vulnerable to Stored XSS in /status endpoint. Malicious attacker with an account can inject arbitrary HTML and JS into website, which will be rendered/executed when opening multiple pages. This issue was fixed in version 1.55...

CVE-2025-62293

SOPlanning is vulnerable to Broken Access Control in /status endpoint. Due to lack of permission checks in Project Status functionality an authenticated attacker is able to add, edit and delete any status. This issue was fixed in version 1.55...

CVE-2025-62729

CVE-2025-62729 affects SOPlanning with a Stored XSS in the /status endpoint. An authenticated attacker can inject arbitrary HTML/JS that is rendered for multiple pages. Root cause described in connected Red Hat/ENISA/NVD entries; fixed in version 1.55. CVSS metrics indicate MEDIUM severity (3.1: ...