WordPress PIMP - Creative MultiPurpose Theme <= 1.7 is vulnerable to Deserialization of untrusted data

Software PIMP - Creative MultiPurpose Type Theme Vulnerable versions = 1.7 Fixed in N/A OWASP Top 10 A3: Injection Classification Deserialization of untrusted data CVE CVE-2025-31398 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID edcf31b181b0 Credits Tran Nguyen Bao Kha...

WordPress WP Extended plugin <= 3.0.15 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by rajanhoyr in WordPress Plugin The Ultimate WordPress Toolkit – WP Extended versions = 3.0.15...

CVE-2024-3938

The "reset password" login page accepted an HTML injection via URL parameters. This has already been rectified via patch, and as such it cannot be demonstrated via Demo site link. Those interested to see the vulnerability may spin up a...

CVE-2024-3165

System-Maintenance- Log Files in dotCMS dashboard is providing the username/password for database connections in the log output. Nevertheless, this is a moderate issue as it requires a backend admin as well as that dbs are locked down by environment. OWASP Top 10 - A05 Insecure Design OWASP Top 1...

CVE-2020-36761

The Top 10 plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.10.4. This is due to missing or incorrect nonce validation on the tptnexporttables function. This makes it possible for unauthenticated attackers to generate an export of the top 10 tab...

WordPress ReDi Restaurant Reservation plugin <= 24.1209 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Ryan Novotny in WordPress Plugin ReDi Restaurant Reservation versions = 24.1209...

Mapping the Future of AI Security

AI security is one of the most pressing challenges facing the world today. Artificial intelligence is extraordinarily powerful, and, especially considering the advent of Agentic AI, growing more so by the day. But it is for this reason that securing it is so important. AI handles massive amounts ...

WordPress Samantha Theme <= 1.1.0 is vulnerable to Local File Inclusion

Software Samantha Type Theme Vulnerable versions = 1.1.0 Fixed in 1.2.0 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-48290 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 854b402907c3 Credits Bonds Required privilege Unauthenticated Publish...

WordPress Wilmër Theme < 3.4.2 is vulnerable to Local File Inclusion

Software Wilmër Type Theme Vulnerable versions 3.4.2 Fixed in 3.4.2 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-39494 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 1629a69ca1df Credits Bonds Required privilege Unauthenticated Published 2...

WordPress Ashley Theme <= 1.7.0 is vulnerable to Local File Inclusion

Software Ashley Type Theme Vulnerable versions = 1.7.0 Fixed in 1.8.0 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-48290 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID fa01b9d5a6af Credits Bonds Required privilege Unauthenticated Published...

WordPress NextGEN Gallery plugin <= 3.59.4 - Stored DOM-Based Cross-Site Scripting via SimpleLightbox JavaScript Library

Stored DOM-Based Cross-Site Scripting via SimpleLightbox JavaScript Library vulnerability discovered by Webbernaut in WordPress Plugin NextGEN Gallery versions = 3.59.4...

WordPress Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP plugin <= 6.2.4 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nabil Irawan in WordPress Plugin Broadcast Live Video versions = 6.2.4...

WordPress Additional Custom Emails & Recipients for WooCommerce plugin <= 3.5.1 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin Additional Custom Emails & Recipients for WooCommerce versions = 3.5.1...

WordPress Cost of Goods for WooCommerce plugin <= 3.7.0 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin Cost of Goods for WooCommerce versions = 3.7.0...

WordPress Product Notes Tab & Private Admin Notes for WooCommerce plugin <= 3.1.0 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin Product Notes Tab & Private Admin Notes for WooCommerce versions = 3.1.0...

WordPress ChatBot plugin < 6.2.4 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin ChatBot versions 6.2.4...

WordPress Polls CP plugin <= 1.0.75 - Admin+ Stored Cross-Site Scripting vulnerability

Admin+ Stored Cross-Site Scripting vulnerability discovered by Chinmay Vishwas Divekar in WordPress Plugin CP Polls versions = 1.0.75...

WordPress Nested Pages plugin <= 3.2.8 - Editor+ Stored XSS vulnerability

Editor+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin Nested Pages versions = 3.2.8...

WordPress CTT Expresso para WooCommerce plugin < 3.2.13 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin CTT Expresso para WooCommerce versions 3.2.13...

WordPress Motors Theme <= 5.6.67 is vulnerable to Privilege Escalation

Software Motors Type Theme Vulnerable versions = 5.6.67 Fixed in 5.6.68 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2025-4322 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID f2c68f043bd9 Credits Foxyyy Required...