Up2Date Component Code Execution

The vulnerability of the Up2Date component of the Sophos Firewall formerly known as Sophos XG Firewall is related to errors in processing input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

WordPress replyMail plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin replyMail versions = 1.2.0...

PT-2025-42202

Name of the Vulnerable Software and Affected Versions Adobe Commerce versions 2.4.4-p15 and earlier Adobe Commerce version 2.4.5-p14 Adobe Commerce version 2.4.6-p12 Adobe Commerce version 2.4.7-p7 Adobe Commerce version 2.4.8-p2 Adobe Commerce version 2.4.9-alpha2 Description An Incorrect...

PT-2025-42197

Name of the Vulnerable Software and Affected Versions Adobe Commerce versions 2.4.4 through 2.4.9-alpha2 Description A low-privileged attacker could bypass security measures and maintain unauthorized access. Exploitation of this issue does not require user interaction. The issue is related to...

WordPress Colibri Page Builder plugin <= 1.0.334 - Authenticated (Contributor+) Stored Cross-Site Scripting via colibri_newsletter Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via colibrinewsletter Shortcode vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Colibri Page Builder versions = 1.0.334...

HPESBHF04954 rev.2 - HPE Compute Scale-up Server 3200 Platform, HPE Superdome Flex and HPE Superdome Flex 280 servers, Security Bypass Vulnerability

Potential Security Impact: Local: Arbitrary Code Execution SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Compute Scale-up Server 3200 - Prior to v1.65.60 HPE Superdome Flex 280 Server - Prior to v2.05.12 HPE Superdome Flex Server - Prior to v4.15.08 CVSS Scores: | CVE | CVSS...

CVE-2025-11635 Tomofun Furbo 360 File Upload resource consumption

A weakness has been identified in Tomofun Furbo 360 up to FB0035FW036. This vulnerability affects unknown code of the component File Upload. This manipulation causes resource consumption. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did n...

WordPress YOP Poll plugin <= 6.5.37 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by ? in WordPress Plugin YOP Poll versions = 6.5.37...

EUVD-2025-33841

The Custom 404 Pro plugin for WordPress is vulnerable to time-based SQL Injection via the ‘path’ parameter in all versions up to, and including, 3.12.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

EUVD-2025-33815

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in the action nfloadformentries in all versions up to, and including, 9.1.6 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2025-9947 Custom 404 Pro <= 3.12.0 - Authenticated (Administrator+) SQL Injection via `path` Parameter

The Custom 404 Pro plugin for WordPress is vulnerable to time-based SQL Injection via the ‘path’ parameter in all versions up to, and including, 3.12.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVE-2025-9950 Error Log Viewer by BestWebSoft <= 1.1.6 - Authenticated (Administrator+) Arbitrary File Read

The Error Log Viewer by BestWebSoft plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.6 via the rrrlgvwrgetfile function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of...

CVE-2025-9626 Page Blocks <= 1.1.0 - Cross-Site Request Forgery

The Page Blocks plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing or incorrect nonce validation on the adminprocesswidgetpagechange function. This makes it possible for unauthenticated attackers to modify widget pa...

CVE-2025-9196

Summary of CVE-2025-9196 (Trinity Audio WordPress plugin) : The Trinity Audio Text to Speech AI plugin (WordPress) versions up to 5.21.0 allows unauthenticated information exposure via the file path ~/admin/inc/phpinfo.php created on install. The vulnerability enables retrieval of sensitive data,...

WordPress Easy Plugin Stats plugin <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Easy Plugin Stats versions = 2.0.1...

WordPress MSTW CSV EXPORTER plugin <= 1.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Jin Yub in WordPress Plugin MSTW CSV EXPORTER versions = 1.4...

WordPress Open Currency Converter plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Open Currency Converter versions = 1.5.0...

WordPress tagDiv Composer plugin <= 5.4.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by ? in WordPress Plugin tagDiv Composer versions = 5.4.1...

CVE-2025-10862

CVE-2025-10862 affects the WordPress plugin “Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers” up to and including version 2.1.3. The root cause is insufficient escaping of the id parameter and lack of proper query preparation, allowing unauthenti...

CVE-2025-11435

A security vulnerability has been detected in JhumanJ OpnForm up to 1.9.3. Affected by this vulnerability is an unknown functionality of the file /show/submissions. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and ma...