CVE-2025-53583

Deserialization of Untrusted Data vulnerability in emarket-design Employee Spotlight employee-spotlight allows Object Injection.This issue affects Employee Spotlight: from n/a through = 5.1.1...

CVE-2025-48351

Cross-Site Request Forgery CSRF vulnerability in PluginsPoint Kento Splash Screen kento-splash-screen allows Stored XSS.This issue affects Kento Splash Screen: from n/a through = 1.4...

CVE-2025-54734 WordPress B Slider Plugin <= 1.1.30 - Broken Access Control Vulnerability

Missing Authorization vulnerability in bPlugins B Slider allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects B Slider: from n/a through 1.1.30...

CVE-2025-54724 WordPress Golo Theme <= 1.7.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in uxper Golo golo allows Reflected XSS.This issue affects Golo: from n/a through = 1.7.1...

CVE-2025-54714 WordPress Zephyr Project Manager Plugin <= 3.3.201 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Dylan James Zephyr Project Manager allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Zephyr Project Manager: from n/a through 3.3.201...

CVE-2025-53337

CVE-2025-53337 corresponds to a Missing Authorization/Broken Access Control vulnerability in LifePress WordPress plugin (versions up to 2.1.3). The issue arises from incorrectly configured access control security levels, enabling unauthorized access. Public details in Patchstack and Red Hat/other...

CVE-2025-49407 WordPress Houzez Theme <= 4.1.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in favethemes Houzez allows Reflected XSS. This issue affects Houzez: from n/a through 4.1.1...

CVE-2025-49387 WordPress Drag and Drop File Upload for Elementor Forms Plugin <= 1.5.3 - Arbitrary File Upload Vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in add-ons.org Drag and Drop File Upload for Elementor Forms allows Upload a Web Shell to a Web Server. This issue affects Drag and Drop File Upload for Elementor Forms: from n/a through 1.5.3...

CVE-2025-49383 WordPress Neresa Theme <= 1.3 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in CocoBasic Neresa allows PHP Local File Inclusion. This issue affects Neresa: from n/a through 1.3...

CVE-2025-48308 WordPress Newsletter subscription optin module plugin <= 1.2.9 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in nonletter Newsletter subscription optin module newsletter-subscription-widget-for-sendblaster allows Stored XSS.This issue affects Newsletter subscription optin module: from n/a through = 1.2.9...

CVE-2025-48110

CVE-2025-48110 : WordPress Link View plugin versions up to 0.8.0 are affected by a Stored XSS due to improper input neutralization during page generation. Impact is user-observable data tampering and session/content manipulation as described for Link View

CVE-2025-48100 WordPress bidorbuy Store Integrator plugin <= 2.12.0 - Remote Code Execution (RCE) vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in extremeidea bidorbuy Store Integrator bidorbuystoreintegrator allows Remote Code Inclusion.This issue affects bidorbuy Store Integrator: from n/a through = 2.12.0...

CVE-2025-48100 WordPress bidorbuy Store Integrator plugin <= 2.12.0 - Remote Code Execution (RCE) vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in extremeidea bidorbuy Store Integrator allows Remote Code Inclusion. This issue affects bidorbuy Store Integrator: from n/a through 2.12.0...

CVE-2025-54819

CVE-2025-54819 is a path-traversal vulnerability in SS1 (DOS Co.) SS1 versions 16.0.0.10 and earlier (Media 16.0.0a and earlier). An authenticated remote attacker could overwrite legitimate files due to improper pathname restriction. Public sources (Red Hat, NVD, JVN, CVE lists, PT-Security, CNNV...

MAL-2025-41554 Malicious code in emittery-up (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in emittery-up (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2024-9648 WP ULike Pro <= 1.9.3 - Unauthenticated Limited Arbitrary File Upload

The WP ULike Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the WPUlikeProFileUploader class in all versions up to, and including, 1.9.3. This makes it possible for unauthenticated attackers to upload limited arbitrary files like .php2...

PT-2025-35078

Name of the Vulnerable Software and Affected Versions: WpEvently versions through 4.4.8 Description: Deserialization of untrusted data in WpEvently allows for object injection. Recommendations: Update WpEvently to a version later than 4.4.8...

PT-2025-35023

Name of the Vulnerable Software and Affected Versions: WP Smart Widgets Better Post & Filter Widgets for Elementor versions through 1.6.0 Description: The software contains an Improper Neutralization of Input During Web Page Generation issue, which allows for Stored Cross-site Scripting XSS...

PT-2025-35041

Name of the Vulnerable Software and Affected Versions: WP Funnel Manager versions through 1.4.0 Description: Deserialization of untrusted data in WP Funnel Manager allows for object injection. Recommendations: At the moment, there is no information about a newer version that contains a fix for th...