CVE-2025-7668

The Linux Promotional Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorrect nonce validation on the 'inux-promotional-plugin.php' page. This makes it possible for unauthenticated attackers to update...

Arbitrary Code Injection

Overview livewire/livewire is an A front-end framework for Laravel. Affected versions of this package are vulnerable to Arbitrary Code Injection via the hydration process of component property updates. An attacker can execute arbitrary commands on the server by sending specially crafted requests ...

CVE-2023-1660

The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in a function hooked to init, allowing unauthenticated users to update some settings, leading to Stored XSS due to the lack of escaping when outputting them in the admin dashboard...

WordPress plugin Altair 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress Gift Cards plugin <= 4.4.9 - Missing Authorization to Unauthenticated Price, Date, and Note Updates vulnerability

Missing Authorization to Unauthenticated Price, Date, and Note Updates vulnerability discovered by Tieu Pham Trong Nhan in WordPress Plugin Gift Vouchers versions = 4.4.9...

PT-2025-6559 · WordPress · Memorialday

Name of the Vulnerable Software and Affected Versions: MemorialDay plugin for WordPress versions up to, and including, 1.0.4 Description: The issue is due to missing or incorrect nonce validation on a function, making it possible for unauthenticated attackers to update settings and inject malicio...

PT-2025-2199 · WordPress · Wonder Fontawesome

Name of the Vulnerable Software and Affected Versions: Wonder FontAwesome plugin for WordPress versions up to, and including, 0.8 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation in one of the plugin's functions. This allows...

PT-2024-16975 · WordPress · Vernetzungsfunktion

Name of the Vulnerable Software and Affected Versions: Vernetzungsfunktion plugin for WordPress versions up to, and including, 1.97.5 Description: The issue is related to Cross-Site Request Forgery. It is caused by missing or incorrect nonce validation on the djo einstellungen menue function. Thi...

Multiple vulnerabilities in Rakuten Turbo 5G

Overview Rakuten Turbo 5G provided by Rakuten Mobile, Inc. contains multiple vulnerabilities listed below. Missing authentication for critical function CWE-306 - CVE-2024-47865 OS command injection CWE-78 - CVE-2024-48895 Exposure of sensitive system information to an unauthorized control sphere...

WordPress Popup Box plugin <= 4.9.7 - Missing Authorization to Unauthenticated Limited Options Update vulnerability

Missing Authorization to Unauthenticated Limited Options Update vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Popup box versions = 4.9.7...

PT-2024-16643 · WordPress · Featured Posts Scroll

Name of the Vulnerable Software and Affected Versions: Featured Posts Scroll plugin for WordPress versions up to, and including, 1.25 Description: The issue is due to missing or incorrect nonce validation on a function, making it possible for unauthenticated attackers to update settings and injec...

PT-2024-32426 · Gotenna · Gotenna Pro App +2

Name of the Vulnerable Software and Affected Versions: goTenna Pro App affected versions not specified goTenna Pro X affected versions not specified goTenna Pro X2 affected versions not specified Description: The goTenna Pro series allows unauthenticated attackers to remotely update the local...

CVE-2024-7423

The Stream plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.0.1. This is due to missing or incorrect nonce validation on the networkoptionsaction function. This makes it possible for unauthenticated attackers to update arbitrary options that...

WordPress WP-Recall plugin <= 16.26.8 - Insecure Direct Object Reference to Unauthenticated Arbitrary Password Update vulnerability

Insecure Direct Object Reference to Unauthenticated Arbitrary Password Update vulnerability discovered by wesley wcraft in WordPress Plugin WP-Recall versions = 16.26.8...

CVE-2023-4025

The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the updateplayer function in versions up to, and including, 2.0.73. This makes it possible for unauthenticated attackers to update player instances...

PT-2024-12869 · WordPress · Radio Player

Name of the Vulnerable Software and Affected Versions: Radio Player plugin for WordPress versions up to, and including, 2.0.73 Description: The issue is related to a missing capability check on the update player function, allowing unauthenticated attackers to update player instances. This enables...

CVE-2024-39554

A Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability the Routing Protocol Daemon rpd of Juniper Networks Junos OS and Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to inject incremental routing updates when...

VulnCheck KEV: CVE-2024-4898

The InstaWP Connect - 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary option updates due to a missing authorization checks on the REST API calls in all versions up to, and including, 0.1.0.38. This makes it possible for unauthenticated attackers to connect the site ...

PT-2024-28362 · WordPress · Swift Framework

Name of the Vulnerable Software and Affected Versions: Swift Framework plugin for WordPress versions prior to 2.7.32 Description: The issue allows unauthorized modification of data due to a missing capability check on the sf edit directory item function. This enables unauthenticated attackers to...

PT-2024-22944 · WordPress · Pocket News Generator

Name of the Vulnerable Software and Affected Versions: The Pocket News Generator plugin for WordPress versions up to, and including, 0.2.0 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the option page function. This allows...