CVE-2025-60129

CVE-2025-60129: Missing Authorization in the Yext WordPress plugin (affected versions: n/a–1.1.3) allows accessing functionality not properly constrained by ACLs. The entry lists a basic impact (low) with no documented exploit details in the provided data, and no connected documents specify root ...

CVE-2025-60128 WordPress Delisho Plugin <= 1.1.3 - Broken Access Control Vulnerability

Missing Authorization vulnerability in WP Delicious Delisho dr-widgets-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Delisho: from n/a through = 1.1.3...

CVE-2025-60128

CVE-2025-60128 affects the Delisho WordPress plugin (Delisho – Recipe Widgets and Blocks) up to version 1.1.3. The issue is Missing Authorization allowing unauthorized updates to Options via wcmlim_settings_ajax_handler, as documented in the CVE entry and corroborated by the Wordfence vulnerabili...

CVE-2025-60117 WordPress Vehica Core Plugin <= 1.0.100 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in TangibleWP Vehica Core vehica-core allows Cross Site Request Forgery.This issue affects Vehica Core: from n/a through = 1.0.100...

CVE-2025-60113 WordPress Groovy Menu Plugin <= 1.4.3 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in grooni Groovy Menu groovy-menu-free allows Cross Site Request Forgery.This issue affects Groovy Menu: from n/a through = 1.4.3...

CVE-2025-4957

The CVE-2025-4957 entry concerns the WordPress ProfileGrid plugin (versions up to and including 5.9.5.7). The issue is a Reflected Cross-Site Scripting (XSS) vulnerability caused by improper input neutralization during web page generation. Exploitation could allow injected scripts to run in a use...

CVE-2025-10747

The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the download-add.php file in all versions up to, and including, 1.68.11. This makes it possible for authenticated attackers, with Administrator-level access and above, to...

CVE-2025-11000

Open Babel up to 3.1.1 is affected by a vulnerability in PQSFormat::ReadMolecule (/src/formats/PQSformat.cpp) that can trigger a NULL pointer dereference. The attack is local, with exploitation information publicly disclosed. Affected products are Open Babel versions up to 3.1.1; remediation deta...

CVE-2025-9044

CVE-2025-9044 : Mapster WP Maps (WordPress plugin) is affected by a Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. Exploitation requires authentication (contributor level or higher) and can allow injection of web scripts on pages viewed by users. Affected ...

CVE-2025-9044 Mapster WP Maps <= 1.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple fields in versions up to, and including, 1.20.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level permissions and...

CVE-2025-10998 Open Babel chemkinformat.cpp ReadReactionQualifierLines null pointer dereference

A vulnerability has been found in Open Babel up to 3.1.1. The affected element is the function ChemKinFormat::ReadReactionQualifierLines of the file /src/formats/chemkinformat.cpp. The manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The...

WordPress Backuply plugin <= 1.4.8 - Authenticated (Admin+) Arbitrary File Deletion vulnerability

Authenticated Admin+ Arbitrary File Deletion vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Backuply – Backup, Restore, Migrate and Clone versions = 1.4.8...

PT-2025-39717

Name of the Vulnerable Software and Affected Versions Trust Reviews plugin for WordPress versions prior to 1.0 Description The software is susceptible to Cross-Site Request Forgery CSRF. This is due to missing or incorrect nonce validation in the feed save function. An unauthenticated attacker ca...

PT-2025-39615

Name of the Vulnerable Software and Affected Versions rozx Recaptcha – wp versions through 0.2.6 Description The software contains a flaw related to improper input handling during web page generation, which allows for Stored Cross-Site Scripting XSS. This means that malicious scripts can be...

WordPress Mapster WP Maps plugin <= 1.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zer0gh0st in WordPress Plugin Mapster WP Maps versions = 1.20.0...

WordPress Mega Elements plugin <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Countdown Timer Widget vulnerability discovered by zer0gh0st in WordPress Plugin Mega Elements versions = 1.3.2...

WordPress CM Business Directory plugin <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin CM Business Directory versions = 1.5.2...

CVE-2025-10977 JeecgBoot deleteBatch improper authorization

A vulnerability was identified in JeecgBoot up to 3.8.2. Impacted is an unknown function of the file /sys/tenant/deleteBatch. The manipulation of the argument ids leads to improper authorization. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The...

CVE-2025-10953

A security vulnerability has been detected in UTT 1200GW and 1250GW up to 3.0.0-170831/3.2.2-200710. This vulnerability affects unknown code of the file /goform/formApMail. The manipulation of the argument senderEmail leads to buffer overflow. The attack may be initiated remotely. The exploit has...

WordPress Email marketing for WordPress by GetResponse Official plugin <= 1.5.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Bao - BlueRock in WordPress Plugin Email marketing for WordPress by GetResponse Official versions = 1.5.3...