CVE-2025-62126

CVE-2025-62126 affects Varnish/Nginx Proxy Caching (versions from n/a up to 1.8.3). Root cause: Insertion of Sensitive Information Into Sent Data, enabling exposure of embedded sensitive data via the proxy. Impact: sensitive information exposure via cached responses. Exploit details are not provi...

CVE-2025-49338 WordPress Flowbox plugin <= 1.1.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in Flowbox allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flowbox: from n/a through 1.1.5...

WordPress AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One plugin <= 1.1.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by NumeX in WordPress Plugin AI Content Writing Assistant Content Writer, ChatGPT, Image Generator All in One versions = 1.1.7...

WordPress AI Copilot plugin <= 1.5.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin AI Copilot versions = 1.5.0...

CVE-2025-49334

Authorization Bypass Through User-Controlled Key vulnerability in Eduardo Villão MyD Delivery myd-delivery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MyD Delivery: from n/a through = 1.7.1...

CVE-2025-62092

Wiremo – Product Reviews for WooCommerce has a missing authorization vulnerability (CVE-2025-62092) affecting WordPress installations with the Wiremo plugin up to version 1.4.99 (inclusive). The NVD entry lists a CVSS v3.1 base score of 5.3 (Network, Privileges Required: NONE, User Interaction: N...

CVE-2025-62755

CVE-2025-62755 pertains to GS Portfolio for Envato, affecting the plugin up to version 1.4.2. Based on the provided initial document, this is an unauthenticated broken access control vulnerability (unauthorized access to restricted resources/actions) that does not require user credentials. The co...

CVE-2025-62755 WordPress GS Portfolio for Envato plugin <= 1.4.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in GS Plugins GS Portfolio for Envato gs-envato-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GS Portfolio for Envato: from n/a through = 1.4.2...

CVE-2025-63053

Authorization Bypass Through User-Controlled Key vulnerability in Liton Arefin Master Addons for Elementor master-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Master Addons for Elementor: from n/a through = 2.0.9.9.4...

CVE-2025-62141

CVE-2025-62141: In the Wawp plugin for WooCommerce, there is a missing authorization flaw affecting Wawp versions up to 4.4 (the advisory notes Wawp &lt;= 4.4). Patch status in the Wordfence report shows the issue has been fixed, and remediation is to upgrade to the patched release (≥ 4.4). The i...

CVE-2025-62117 WordPress EasyIndex plugin <= 1.1.1704 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Jayce53 EasyIndex easyindex allows Cross Site Request Forgery.This issue affects EasyIndex: from n/a through = 1.1.1704...

WordPress EasyIndex plugin <= 1.1.1704 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nabil Irawan in WordPress Plugin EasyIndex versions = 1.1.1704...

EUVD-2025-205955

Cross-Site Request Forgery CSRF vulnerability in A WP Life Contact Form Widget allows Cross Site Request Forgery.This issue affects Contact Form Widget: from n/a through 1.5.1...

WordPress Black Rider theme <= 1.2.3 - Sensitive Data Exposure vulnerability

Software : Black Rider Type : Theme Vulnerable versions : = 1.2.3 OWASP Top 10 : A3: Sensitive Data Exposure Classification : Sensitive Data Exposure CVE ID : CVE-2025-59003 Patchstack priority : Medium CVSS severity : 5.8 Required privilege : Unauthenticated Developer : Claim ownership PSID :...

CVE-2025-62149 WordPress Add Custom Codes plugin <= 4.80 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in SaifuMak Add Custom Codes add-custom-codes allows Stored XSS.This issue affects Add Custom Codes: from n/a through = 4.80...

CVE-2025-63020

CVE-2025-63020 is a stored cross-site scripting (XSS) vulnerability in the WordPress plugin Postie. The connected Wordfence report identifies an authenticated (Contributor+) path, affecting Postie up to version 1.9.73, with exploitation requiring a Contributor+ user. Technical details confirm the...

CVE-2023-54166

In the Linux kernel, the following vulnerability has been resolved: igc: Fix Kernel Panic during ndotxtimeout callback The Xeon validation group has been carrying out some loaded tests with various HW configurations, and they have seen some transmit queue time out happening during the test. This...

CVE-2025-62749 WordPress User Specific Content plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Bainternet User Specific Content user-specific-content allows DOM-Based XSS.This issue affects User Specific Content: from n/a through = 1.0.6...

CVE-2025-62757

CVE-2025-62757 : WordPress WebMan Amplifier vulnerability in which WebMan Amplifier

WordPress WebMan Amplifier plugin <= 1.5.12 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin WebMan Amplifier versions = 1.5.12...