WordPress License Manager for WooCommerce Plugin <= 3.0.12 - SQL Injection Vulnerability

SQL Injection Vulnerability discovered by Que Thanh Tuan Blue Rock in WordPress Plugin License Manager for WooCommerce versions = 3.0.12...

CVE-2025-8088 WinRAR Exploit: From Zero-Day to Zero-Risk with TruRisk™ Eliminate

The Risk Behind the WinRAR Vulnerability A newly disclosed path traversal vulnerability CVE-2025-8088 in WinRAR leaves millions of Windows systems exposed to attack. This flaw enables adversaries to craft malicious archives that bypass the user’s chosen extraction path, forcing files into...

WordPress Jack Well theme <= 1.0.14 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Bonds in WordPress Theme Jack Well versions = 1.0.14...

WordPress Monyxi theme <= 1.1.8 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Bonds in WordPress Theme Monyxi versions = 1.1.8...

WordPress Lettuce theme <= 1.1.7 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Bonds in WordPress Theme Lettuce versions = 1.1.7...

WordPress Strux theme <= 1.9 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Bonds in WordPress Theme Strux versions = 1.9...

WordPress Quotes Shortcode and Widget plugin <= 1.14 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Quotes Shortcode and Widget versions = 1.14...

CVE-2025-58210

Missing Authorization vulnerability in ThemeMove Makeaholic makeaholic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Makeaholic: from n/a through = 1.8.5...

CVE-2025-8684 Flatsome <= 3.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Flatsome Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's shortcodes in all versions up to, and including, 3.20.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...

CVE-2025-9990 WordPress Helpdesk Integration <= 5.8.10 - Unauthenticated Local File Inclusion

The WordPress Helpdesk Integration plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.8.10 via the portaltype parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the...

PT-2025-36172

Name of the Vulnerable Software and Affected Versions: INVELITY Invelity MyGLS connect versions through 1.1.1 Description: This issue is a Cross-Site Request Forgery CSRF vulnerability that allows Object Injection. Recommendations: At the moment, there is no information about a newer version that...

PT-2025-36140

Name of the Vulnerable Software and Affected Versions: WP Email Template versions n/a through 2.8.3 Description: The software contains a Cross-Site Request Forgery CSRF flaw. This issue allows attackers to perform actions on behalf of authenticated users without their knowledge. Recommendations:...

PT-2025-36182

Name of the Vulnerable Software and Affected Versions: David Merinas Auto Last Youtube Video versions n/a through 1.0.7 Description: A Cross-Site Request Forgery CSRF vulnerability exists in David Merinas Auto Last Youtube Video, which also allows Stored Cross-Site Scripting XSS. Recommendations:...

PT-2025-36204

Name of the Vulnerable Software and Affected Versions: reimund Compact Admin versions n/a through 1.3.0 Description: A Cross-Site Request Forgery CSRF vulnerability exists in reimund Compact Admin, allowing attackers to perform actions on behalf of an unsuspecting user. This issue allows Cross Si...

PT-2025-36170

Name of the Vulnerable Software and Affected Versions: Parallax Scrolling Enllax.js versions through 0.0.6 Description: A Cross-Site Request Forgery CSRF issue exists in Parallax Scrolling Enllax.js, potentially allowing attackers to perform actions on behalf of authenticated users...

WordPress GlamChic theme <= 1.0.11 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme GlamChic versions = 1.0.11...

WordPress Zuut theme <= 1.4.2 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Zuut versions = 1.4.2...

WordPress The Hospital theme <= 1.8.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme The Hospital versions = 1.8.1...

CVE-2025-6085

CVE-2025-6085 affects the WordPress Make Connector plugin (versions

CVE-2025-6085 Make Connector <= 1.5.10 - Authenticated (Administrator+) Arbitrary File Upload

The Make Connector plugin for WordPress is vulnerable to arbitrary file uploads due to misconfigured file type validation in the 'uploadmedia' function in all versions up to, and including, 1.5.10. This makes it possible for authenticated attackers, with Administrator-level access and above, to...