WordPress Organic Beauty Theme <= 1.4.6 - PHP Object Injection Vulnerability

PHP Object Injection Vulnerability discovered by Bonds in WordPress Theme Organic Beauty versions = 1.4.6...

WordPress Golo Theme <= 1.7.0 - Broken Authentication Vulnerability

Broken Authentication Vulnerability discovered by Rau má đậu xanh in WordPress Theme Golo versions = 1.7.0...

WordPress Jobmonster Theme <= 4.7.9 - Broken Authentication Vulnerability

Broken Authentication Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Jobmonster versions = 4.7.9...

CVE-2025-52352

Aikaan IoT management platform v3.25.0325-5-g2e9c59796 provides a configuration to disable user sign-up in distributed deployments by hiding the sign-up option on the login page UI. However, the sign-up API endpoint remains publicly accessible and functional, allowing unauthenticated users to...

PT-2025-34227 · WordPress · An-Themes Pin Wp

Name of the Vulnerable Software and Affected Versions: An-Themes Pin WP versions prior to 7.2 An-Themes Pin WP versions through 6.9 Description: An unrestricted file upload vulnerability exists in An-Themes Pin WP, allowing for the upload of web shells to a web server. This could lead to full...

WordPress Golo Theme <= 1.7.0 is vulnerable to Broken Authentication

Software Golo Type Theme Vulnerable versions = 1.7.0 Fixed in 1.7.1 OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2025-54725 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID a2ab39e8e113 Credits Aiden Required...

CVE-2025-52352

CVE-2025-52352 affects Aikaan IoT management platform version 3.25.0325-5-g2e9c59796. The UI can hide the sign-up option, but the signup API remains publicly accessible, allowing unauthenticated account creation and leading to authentication bypass and unauthorized admin portal access. Connected ...

WordPress Listeo-Core Plugin < 2.0.7 - SQL Injection Vulnerability

SQL Injection Vulnerability discovered by Lê Quốc Bảo in WordPress Plugin Listeo Core versions 2.0.7...

WordPress ads.txt Guru Connect Plugin <= 1.1.1 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin ads.txt Guru Connect versions = 1.1.1...

WordPress Sign-up Sheets Plugin <= 2.3.3 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nabil Irawan in WordPress Plugin Sign-up Sheets versions = 2.3.3...

WordPress Houzez Theme <= 4.1.1 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Rafie Muhammad Patchstack in WordPress Theme Houzez versions = 4.1.1...

CVE-2025-53319

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Raptive Raptive Ads adthrive-ads allows Reflected XSS.This issue affects Raptive Ads: from n/a through = 3.8.0...

CVE-2025-49434

Deserialization of Untrusted Data vulnerability in axiomthemes Cars4Rent cars4rent allows Object Injection.This issue affects Cars4Rent: from n/a through = 1.4.2...

CVE-2025-49392

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in themifyme Themify Audio Dock themify-audio-dock allows Stored XSS.This issue affects Themify Audio Dock: from n/a through = 2.0.5...

CVE-2025-48142

Incorrect Privilege Assignment vulnerability in Saad Iqbal Bookify bookify allows Privilege Escalation.This issue affects Bookify: from n/a through = 1.0.9...

CVE-2025-30975

Improper Control of Generation of Code 'Code Injection' vulnerability in SaifuMak Add Custom Codes add-custom-codes allows Code Injection.This issue affects Add Custom Codes: from n/a through = 4.80...

CVE-2025-49391 WordPress Sign-up Sheets Plugin <= 2.3.3 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in Fetch Designs Sign-up Sheets sign-up-sheets allows Cross Site Request Forgery.This issue affects Sign-up Sheets: from n/a through = 2.3.3...

CVE-2025-49391 WordPress Sign-up Sheets Plugin <= 2.3.3 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in Fetch Designs Sign-up Sheets sign-up-sheets allows Cross Site Request Forgery.This issue affects Sign-up Sheets: from n/a through = 2.3.3...

CVE-2025-49397

CVE-2025-49397 is a stored XSS in the WordPress plugin Colorbox Lightbox (also referred to as WP Colorbox) up to version 1.1.5. The vulnerability stems from improper input neutralization during web page generation, enabling cross-site scripting payloads to be stored and served in pages. Public so...

CVE-2025-49411 WordPress iFrame Block plugin <= 0.1.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Vikas Sharma iFrame Block allows Stored XSS. This issue affects iFrame Block: from n/a through 0.1.1...