WordPress Woffice Theme <= 5.4.21 is vulnerable to Privilege Escalation

Software Woffice Type Theme Vulnerable versions = 5.4.21 Fixed in 5.4.22 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2025-2798 Patch priority High CVSS severity High 9.8 Developer EPC PSID bdeb5594d059 Credits Foxyyy Required privilege...

WordPress Support Helpdesk Ticket System Lite plugin <= 4.5.2 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by thiennv in WordPress Plugin Support Helpdesk Ticket System Lite versions = 4.5.2...

WordPress wpForo Forum plugin <= 2.4.2 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Revan Arifio Patchstack Alliance in WordPress Plugin wpForo Forum versions = 2.4.2...

WordPress Material Dashboard plugin <= 1.4.5 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by LVT-tholv2k in WordPress Plugin Material Dashboard versions = 1.4.5...

WordPress WP RealEstate plugin <= 1.6.26 - Authentication Bypass via 'process_register' vulnerability

Authentication Bypass via 'processregister' vulnerability discovered by Tonn in WordPress Plugin WP RealEstate versions = 1.6.26...

WordPress Countdown & Clock plugin <=2.8.8 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by astra.r3verii in WordPress Plugin Countdown & Clock versions = 2.8.8...

WordPress Watu Quiz plugin <= 3.4.2 - Reflected Cross Site Scripting (XSS) Vulnerability

Reflected Cross Site Scripting XSS Vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Watu Quiz versions = 3.4.2...

WordPress Black Widgets For Elementor plugin <= 1.3.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Michael in WordPress Plugin Black Widgets For Elementor versions = 1.3.9...

WordPress Bulk Product Sync plugin <= 8.6 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Mika in WordPress Plugin Bulk Product Sync versions = 8.6...

WordPress PDF Generator Addon for Elementor Page Builder plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin PDF Generator Addon for Elementor Page Builder versions = 2.1.0...

WordPress Viral Loops WP Integration Plugin <= 3.4.0 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Abdi Pranata in WordPress Plugin Viral Loops WP Integration versions = 3.4.0...

WordPress WP Plugin Info Card plugin <= 5.3.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by muhammad yudha in WordPress Plugin WP Plugin Info Card versions = 5.3.0...

WordPress Uptime Robot Plugin <= 2.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Uptime Robot Plugin for WordPress versions = 2.3...

WordPress Boo Recipes plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by SOPROBRO in WordPress Plugin Boo Recipes versions = 2.4.1...

WordPress Lightweight and Responsive Youtube Embed plugin <= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerability

Stored Cross Site Scripting XSS vulnerability discovered by SOPROBRO in WordPress Plugin Lightweight and Responsive Youtube Embed versions = 1.0.0...

WordPress News, Magazine and Blog Elements Plugin <= 1.3 - Stored Cross Site Scripting (XSS) vulnerability

Stored Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 in WordPress Plugin News, Magazine and Blog Elements versions = 1.3...

CVE-2025-31864

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Out the Box Beam me up Scotty beam-me-up-scotty allows Stored XSS.This issue affects Beam me up Scotty: from n/a through = 1.0.23...

WordPress plugin Beam me up Scotty – Back to Top Button 跨站脚本漏洞

WordPress and the WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in...

WordPress Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One plugin <= 2.2.6 - SQL Injection vulnerability

SQL Injection vulnerability discovered by NAWardRox in WordPress Plugin Ai Auto Tool Content Writing Assistant Gemini Writer, ChatGPT All in One versions = 2.2.6...

Beers with Talos: Year in Review episode

Joe, Hazel, Bill and Dave break down Talos' Year in Review 2024 and discuss how and why cybercriminals have been leaning so heavily on attacks that are routed in stealth in simplicity. The team also provide insights into some of the topics of the report, including the top-targeted vulnerabilities...