WordPress Alt Text Generator AI plugin <= 1.8.3 - Missing Authorization to Authenticated (Subscriber+) API Key Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ API Key Deletion vulnerability discovered by Legion Hunter in WordPress Plugin Alt Text Generator AI versions = 1.8.3...

WordPress GeoDirectory plugin <= 2.8.139 - Missing Authorization to Authenticated (Author+) Arbitrary Image Attachment vulnerability

Missing Authorization to Authenticated Author+ Arbitrary Image Attachment vulnerability discovered by DityaRA in WordPress Plugin GeoDirectory versions = 2.8.139...

CVE-2025-12637

The Elastic Theme Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a dynamic code generation feature in the processtheme function in all versions up to, and including, 0.0.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

WordPress Angel Theme <= 3.2.3 is vulnerable to Cross Site Scripting (XSS)

Software Angel Type Theme Vulnerable versions = 3.2.3 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2025-10295 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 731931b06fd6 Credits WordFence Required privilege...

CVE-2025-61843

CVE-2025-61843 concerns Adobe Format Plugins. The issue is an Out-of-bounds Read affecting versions 1.1.1 and earlier, leading to memory exposure. Exploitation requires user interaction (victim opens a malicious file). The vulnerability is documented across multiple sources in the Connected docum...

kernel: sched/rt: Fix race in push_rt_task

In the Linux kernel, the following vulnerability has been resolved: sched/rt: Fix race in pushrttask Overview ======== When a CPU chooses to call pushrttask and picks a task to push to another CPU's runqueue then it will call findlocklowestrq method which would take a double lock on both CPUs'...

kernel: afs: Fix lock recursion

A flaw was found in the Linux kernel's AFS Andrew File System implementation. A local user could exploit this vulnerability to cause a Denial of Service DoS by triggering a system crash. The issue occurs during the handling of asynchronous requests when attempting to release a queued network call...

CVE-2025-12668

The WP Count Down Timer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters of the 'wpcountdowntimer' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2025-12667

CVE-2025-12667 concerns the GitHub Gist Shortcode Plugin for WordPress. Affected: all versions up to and including 0.2. The vulnerability is Stored Cross-Site Scripting via the id parameter of the gist shortcode. Exploitation requires authentication at Contributor level or higher, enabling an att...

CVE-2025-11999 Add Multiple Marker <= 1.2 - Missing Authorization to Unauthenticated Settings Update

The Add Multiple Marker plugin for WordPress is vulnerable to unauthorized modification of data to due to a missing capability check on the addmultiplemarkerresetmap and ammsavemapapi functions in all versions up to, and including, 1.2. This makes it possible for unauthenticated attackers to upda...

CVE-2025-11521 Astra Security Suite – Firewall & Malware Scan <= 0.2 - Unauthenticated Arbitrary File Upload

The Astra Security Suite – Firewall & Malware Scan plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient validation of remote URLs for zip downloads and an easily guessable key in all versions up to, and including, 0.2. This makes it possible for unauthenticated attacke...

CVE-2025-12526 Private Google Calendars <= 20250811 - Missing Authorization to Authenticated (Subscriber+) Settings Reset

The Private Google Calendars plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pgcremove' action in all versions up to, and including, 20250811. This makes it possible for authenticated attackers, with Subscriber-level access and...

CVE-2025-12754 Geopost <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Geopost plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'height' parameter of the 'geopost' shortcode in all versions up to, and including, 1.2. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-11822 WP Bootstrap Tabs <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The WP Bootstrap Tabs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bootstraptab' shortcode in all versions up to, and including, 1.0.4. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WordPress Progress Bar Blocks for Gutenberg plugin <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG vulnerability discovered by Peerapat Samatathanyakorn in WordPress Plugin Progress Bar Blocks for Gutenberg versions = 1.0.0...

WordPress Shelf Planner plugin <= 2.7.0 - Unauthenticated Information Exposure via Log Files vulnerability

Unauthenticated Information Exposure via Log Files vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Shelf Planner versions = 2.7.0...

WordPress plugin Include Fussball.de Widgets 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-46243

Name of the Vulnerable Software and Affected Versions Include Fussball.de Widgets plugin for WordPress versions up to and including 4.0.0 Description The software contains a Stored Cross-Site Scripting issue due to insufficient input sanitization and output escaping. Authenticated attackers with...

WordPress Magazine Companion plugin <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zaim in WordPress Plugin Magazine Companion versions = 1.2.3...

WordPress Groups plugin <= 3.7.0 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by shark3y in WordPress Plugin Groups versions = 3.7.0...