WordPress Edema Theme <= 1.2.1 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Edema versions = 1.2.1...

WordPress Adrena Theme <= 1.2.13 is vulnerable to Local File Inclusion

Software Adrena Type Theme Vulnerable versions = 1.2.13 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-26592 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID fee2bf7593ad Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity...

PT-2025-36456

Name of the Vulnerable Software and Affected Versions: Jinher OA versions up to 1.2 Description: A vulnerability exists in Jinher OA that allows for XML external entity reference. The issue impacts an unknown function of the file /c6/Jhsoft.Web.projectmanage/TaskManage/AddTask.aspx/?Type=add with...

WordPress Accalia Theme <= 1.5.3 is vulnerable to Local File Inclusion

Software Accalia Type Theme Vulnerable versions = 1.5.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-26592 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID c9c28aa34cba Credits Bonds Required privilege Unauthenticated Published ...

WordPress Callie Britt Theme <= 1.2.3 is vulnerable to Local File Inclusion

Software Callie Britt Type Theme Vulnerable versions = 1.2.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-26592 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 14891aeee80a Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunit...

WordPress Vagabonds Theme <= 1.3.10 is vulnerable to Local File Inclusion

Software Vagabonds Type Theme Vulnerable versions = 1.3.10 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-26592 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID e376cc0ee025 Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity...

Google Android elevation of privilege vulnerability (CNVD-2025-26883)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability due to incorrect input validation in the getCallingAppName function in Shared.java, which results in a user granting file access via deceptive text in the...

CVE-2025-48317

Path Traversal: '.../...//' vulnerability in Stefan Keller WooCommerce Payment Gateway for Saferpay woocommerce-payment-gateway-for-saferpay allows Path Traversal.This issue affects WooCommerce Payment Gateway for Saferpay: from n/a through = 0.4.9...

WordPress Scape theme <= 1.5.13 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Aiden in WordPress Theme Scape versions = 1.5.13...

CVE-2025-58876

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ali Aghdam Aparat Video Shortcode aparat-shortcode allows Stored XSS.This issue affects Aparat Video Shortcode: from n/a through = 0.2.4...

CVE-2025-58841

Incorrect Privilege Assignment vulnerability in John Luetke Media Author media-author allows Privilege Escalation.This issue affects Media Author: from n/a through = 1.0.4...

CVE-2025-58793

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPBean WPB Elementor Addons wpb-elementor-addons allows Stored XSS.This issue affects WPB Elementor Addons: from n/a through = 1.7...

CVE-2025-58884

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ivan Drago vipdrv vipdrv-vip-test-drive allows Stored XSS.This issue affects vipdrv: from n/a through = 1.0.3...

CVE-2025-58842

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in givecloud Donation Forms WP by Givecloud donation-forms-by-givecloud allows Stored XSS.This issue affects Donation Forms WP by Givecloud: from n/a through = 1.0.9...

CVE-2025-58787

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in themifyme Themify Popup themify-popup allows Stored XSS.This issue affects Themify Popup: from n/a through = 1.4.2...

PT-2025-36419

Name of the Vulnerable Software and Affected Versions Portabilis i-Educar versions up to 2.10 Description A vulnerability exists in Portabilis i-Educar versions up to 2.10 related to improper access controls resulting from manipulation of file processing. The affected file is /matricula/ID...

CVE-2025-9442

The StreamWeasels Kick Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘vodsChannel’ parameter in all versions up to, and including, 1.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-7040 Cloud SAML SSO <= 1.0.19 - Missing Authorization to Unauthenticated Settings Modification via set_organization_settings Action

The Cloud SAML SSO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'setorganizationsettings' action of the cssohandleactions function in all versions up to, and including, 1.0.19. The handler reads client-supplied POST parameters fo...

CVE-2025-9493 Admin Menu Editor <= 1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via placeholder Parameter

The Admin Menu Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘placeholder’ parameter in all versions up to, and including, 1.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level acce...

CVE-2025-7040 Cloud SAML SSO <= 1.0.19 - Missing Authorization to Unauthenticated Settings Modification via set_organization_settings Action

The Cloud SAML SSO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'setorganizationsettings' action of the cssohandleactions function in all versions up to, and including, 1.0.19. The handler reads client-supplied POST parameters fo...