CVE-2025-47598

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in click5 History Log by click5 history-log-by-click5 allows Stored XSS.This issue affects History Log by click5: from n/a through = 1.0.13...

CVE-2025-31920

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in AmentoTech WP Guppy wp-guppy allows SQL Injection.This issue affects WP Guppy: from n/a through = 4.3.3...

CVE-2025-27362

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in BZOTheme Petito bw-petito allows PHP Local File Inclusion.This issue affects Petito: from n/a through 1.6.6...

CVE-2025-24767 WordPress TicketBAI Facturas para WooCommerce plugin <= 3.19 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in facturaone TicketBAI Facturas para WooCommerce wp-ticketbai allows Blind SQL Injection.This issue affects TicketBAI Facturas para WooCommerce: from n/a through = 3.19...

CVE-2025-32305

CVE-2025-32305 describes a Reflected XSS in the WordPress theme FlatNews (affected up to version 5.8). The root cause is ImpropER Neutralization of Input During Web Page Generation , allowing an attacker to inject arbitrary HTML/JavaScript via a crafted URL that is reflected in the page. The CVSS...

CVE-2025-39539

CVE-2025-39539 describes a Cross-site Scripting (XSS) issue in the Soho Hotel (WordPress) plugin/theme. The vulnerability is a Reflected XSS caused by improper neutralization of input during web page generation. Affected software is the Soho Hotel Booking Calendar for WordPress (listed as Soho Ho...

CVE-2025-47487 WordPress MC Woocommerce Wishlist plugin <= 1.9.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Moreconvert Team MC Woocommerce Wishlist smart-wishlist-for-more-convert allows Reflected XSS.This issue affects MC Woocommerce Wishlist: from n/a through = 1.9.1...

CVE-2025-48141 WordPress Multi CryptoCurrency Payments plugin <= 2.0.7 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Alex Zaytseff Multi CryptoCurrency Payments multi-crypto-currency-payment allows SQL Injection.This issue affects Multi CryptoCurrency Payments: from n/a through = 2.0.7...

CVE-2025-48141 WordPress Multi CryptoCurrency Payments <= 2.0.3 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Alex Zaytseff Multi CryptoCurrency Payments allows SQL Injection. This issue affects Multi CryptoCurrency Payments: from n/a through 2.0.3...

CVE-2025-49279 WordPress Blogvy <= 1.0.7 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Unfoldwp Blogvy allows PHP Local File Inclusion. This issue affects Blogvy: from n/a through 1.0.7...

WordPress GiftXtore theme <= 1.7.5 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by Phat RiO - BlueRock in WordPress Theme GiftXtore versions = 1.7.5...

WordPress Grill and Chow theme <= 1.6 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by Bonds in WordPress Theme Grill and Chow versions = 1.6...

WordPress GrandPrix theme <= 1.6 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by Bonds in WordPress Theme GrandPrix versions = 1.6...

WordPress Inset theme <= 1.18.0 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by Tran Nguyen Bao KhanhVCI - VNPT in WordPress Theme Inset versions = 1.18.0...

The vulnerability of the CDUP command in the Freefloat FTP Server allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the CDUP command in the Freefloat FTP server is related to the execution of an operation beyond the buffer boundaries in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code or cause service interruptions...

WordPress plugin Multi CryptoCurrency Payments SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A SQL injection vulnerability exists in...

PT-2025-24441 · Code Projects · Code-Projects Chat System

Name of the Vulnerable Software and Affected Versions: code-projects Chat System versions up to 1.0 Description: A critical issue affects the processing of the file /user/confirm password.php. The manipulation of the cid argument leads to SQL injection. The attack can be initiated remotely...

WordPress User Registration Aide Plugin <= 1.5.3.8 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin User Registration Aide versions = 1.5.3.8...

CVE-2025-30997

Server-Side Request Forgery SSRF vulnerability in SmartDataSoft Car Repair Services car-repair-services allows Server Side Request Forgery.This issue affects Car Repair Services: from n/a through = 5.0...

CVE-2025-30939

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Debashish IFrame Widget iframe-widget allows Stored XSS.This issue affects IFrame Widget: from n/a through = 4.1...