PT-2025-22197

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to the version containing the fix for the issue described, as the specific fixed version is not mentioned. Description The issue arises when generating the MSR IA32 PEBS ENABLE value for a KVM guest, where the host...

CVE-2025-4083

A process isolation vulnerability in Thunderbird stemmed from improper handling of javascript: URIs, which could allow content to execute in the top-level document's process instead of the intended frame, potentially enabling a sandbox escape. This vulnerability affects Firefox 138, Firefox ESR...

CVE-2025-22774

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CRUDLab CRUDLab Scroll to Top crudlab-scroll-to-top allows Reflected XSS.This issue affects CRUDLab Scroll to Top: from n/a through = 1.0.1...

Unintended Scope Exposure

SES is vulnerable to unintended scope exposure. The vulnerability is due to improper isolation due to top-level let, const, or class bindings in...

WordPress Mini twitter feed plugin <= 3.0 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by johska in WordPress Plugin Mini twitter feed versions = 3.0...

WordPress Peadig’s Google +1 Button plugin <= 0.1.2 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by johska in WordPress Plugin Peadig’s Google +1 Button versions = 0.1.2...

WordPress Related Posts via Taxonomies plugin <= 1.0.1 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability

Cross Site Request Forgery CSRF to Stored XSS vulnerability discovered by johska in WordPress Plugin Related Posts via Taxonomies versions = 1.0.1...

WordPress PayPal Express Checkout plugin <= 2.1.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by johska in WordPress Plugin PayPal Express Checkout versions = 2.1.2...

WordPress Lottie Player plugin <= 1.1.8 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via File Upload vulnerability discovered by Avraham Shemesh in WordPress Plugin Lottie Player block - Implement Lottie animations. versions = 1.1.8...

WordPress Hospital Management System plugin <= 47.0(20-11-2023) - SQL Injection vulnerability

SQL Injection vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Hospital Management System versions = 47.020-11-2023...

WordPress User Registration plugin < 4.2.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Psai in WordPress Plugin User Registration versions 4.2.0...

WordPress Sky Addons for Elementor plugin <= 3.0.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara Kinorth in WordPress Plugin Sky Addons for Elementor versions = 3.0.1...

WordPress Smart Maintenance Mode plugin <= 1.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting vulnerability

Authenticated Admin+ Stored Cross-Site Scripting vulnerability discovered by Dogus Demirkiran in WordPress Plugin Smart Maintenance Mode versions = 1.5.1...

WordPress ACF: Google Font Selector plugin <= 3.0.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Dimas Maulana Patchstack Alliance in WordPress Plugin ACF: Google Font Selector versions = 3.0.1...

WordPress Anything Popup plugin <= 7.3 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Dimas Maulana Patchstack Alliance in WordPress Plugin Anything Popup versions = 7.3...

WordPress Grand Restaurant WordPress Theme <= 7.0 is vulnerable to PHP Object Injection

Software Grand Restaurant WordPress Type Theme Vulnerable versions = 7.0 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-39348 Patch priority High CVSS severity High 9.8 Developer EPC PSID c0bb2279949a Credits Ananda Dhakal Patchstack Required privilege...

WordPress Xews Lite Theme <= 1.0.9 is vulnerable to Local File Inclusion

Software Xews Lite Type Theme Vulnerable versions = 1.0.9 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-39383 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID c141546901cd Credits Dimas Maulana Required privilege Unauthenticated...

SUSE CVE-2017-9333

OpenWebif 1.2.5 allows remote code execution via a URL to the CallOPKG function in the IpkgController class in plugin/controllers/ipkg.py, when the URL refers to an attacker-controlled web site with a Trojan horse package. This has security implications in cases where untrusted users can trigger...

CVE-2025-32792 ses's global contour bindings leak into Compartment lexical scope

SES safely executes third-party JavaScript 'strict' mode programs in compartments that have no excess authority in their global scope. Prior to version 1.12.0, web pages and web extensions using ses and the Compartment API to evaluate third-party code in an isolated execution environment that hav...

CVE-2025-32792 ses's global contour bindings leak into Compartment lexical scope

SES safely executes third-party JavaScript 'strict' mode programs in compartments that have no excess authority in their global scope. Prior to version 1.12.0, web pages and web extensions using ses and the Compartment API to evaluate third-party code in an isolated execution environment that hav...