CVE-2025-54053 WordPress Groundhogg <= 4.2.2 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in Adrian Tobey Groundhogg allows Object Injection. This issue affects Groundhogg: from n/a through 4.2.2...

CVE-2025-54056 WordPress Responsive HTML5 Audio Player PRO With Playlist <= 3.5.8 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LambertGroup Responsive HTML5 Audio Player PRO With Playlist allows Reflected XSS. This issue affects Responsive HTML5 Audio Player PRO With Playlist: from n/a through 3.5.8...

CVE-2025-9096

A vulnerability has been found in ExpressGateway express-gateway up to 1.16.10. Affected is an unknown function in the library lib/rest/routes/apps.js of the component REST Endpoint. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been...

PT-2025-34162

Name of the Vulnerable Software and Affected Versions: cipher-base versions through 1.0.4 Description: An improper input validation issue exists in cipher-base, allowing input data manipulation. This is due to missing input type checks, which can lead to invalid value calculations, hash state...

WordPress plugin WPC Smart Quick View for WooCommerce has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress Plugin Sign-Up Sheets: Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A security vulnerability exists in...

WordPress plugin CubeWP Framework has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2025-33956 · Unknown · Simple-Login-Log

Name of the Vulnerable Software and Affected Versions: Simple Login Log versions through 1.1.3 Description: Deserialization of untrusted data in Simple Login Log allows object injection. Recommendations: Update Simple Login Log to a version later than 1.1.3...

PT-2025-33958

Name of the Vulnerable Software and Affected Versions: AWStats Script versions n/a through 0.3 Description: An improper neutralization of input during web page generation issue, specifically a Stored Cross-site Scripting XSS flaw, exists in Jorge Garcia de Bustos AWStats Script. This allows for t...

CVE-2025-49391: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Fetch Designs Sign-up Sheets sign-up-sheets allows Cross Site Request Forgery.This issue affects Sign-up Sheets: from n/a through = 2.3.3...

PT-2025-33935 · Fetch Designs · Fetch Designs Sign-Up Sheets

Name of the Vulnerable Software and Affected Versions: Fetch Designs Sign-up Sheets versions through 2.3.3 Description: The vulnerability allows for Cross-Site Request Forgery CSRF. This issue affects the Sign-up Sheets functionality. Recommendations: At the moment, there is no information about ...

CVE-2025-38554

In the Linux kernel, the following vulnerability has been resolved: mm: fix a UAF when vma-mm is freed after vma-vmrefcnt got dropped By inducing delays in the right places, Jann Horn created a reproducer for a hard to hit UAF issue that became possible after VMAs were allowed to be recycled by...

CVE-2025-9135

A vulnerability was detected in Verkehrsauskunft Österreich SmartRide, cleVVVer, BusBahnBim and Salzburg Verkehr up to 12.1.1258 on Android. The impacted element is an unknown function of the file AndroidManifest.xml. The manipulation results in improper export of android application components...

CVE-2025-8783

The Contact Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title’ parameter in all versions up to, and including, 8.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2025-8622 Flexible Maps <= 1.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flexible Maps Shortcode

The Flexible Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Flexible Maps shortcode in all versions up to, and including, 1.18.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

WordPress Panda theme <= 1.21 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Bonds in WordPress Theme Panda versions = 1.21...

WordPress MaxCube theme <= 1.3.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Bonds in WordPress Theme MaxCube versions = 1.3.1...

PT-2025-33720

Name of the Vulnerable Software and Affected Versions: Verkehrsauskunft Österreich SmartRide versions up to 12.1.1258 cleVVVer versions up to 12.1.1258 BusBahnBim versions up to 12.1.1258 Description: A vulnerability exists related to the improper export of Android application components due to...

CVE-2025-8089

The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'additional' parameter in version less than, or equal to, 2025.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2025-6221

The Embed Bokun plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ parameter in all versions up to, and including, 0.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...