CVE-2025-32567 WordPress Easy Post Duplicator Plugin <= 1.0.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in dev02ali Easy Post Duplicator allows SQL Injection. This issue affects Easy Post Duplicator: from n/a through 1.0.1...

CVE-2025-32565 WordPress Neon Product Designer Plugin <= 2.2.0 - Unauthenticated SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in vertim Neon Product Designer neon-product-designer-for-woocommerce allows SQL Injection.This issue affects Neon Product Designer: from n/a through = 2.2.0...

CVE-2025-31565 WordPress WPSmartContracts plugin <= 2.0.12 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Lisandro Martinez WPSmartContracts wp-smart-contracts allows Blind SQL Injection.This issue affects WPSmartContracts: from n/a through = 2.0.12...

WordPress Industrial Lite theme <= 1.0.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mika Patchstack Alliance in WordPress Theme Industrial Lite versions = 1.0.8...

CVE-2025-32199

CVE-2025-32199 describes an XSS vulnerability in the WordPress plugin Contact Form Builder by vcita (eyale-vc Contact Form Builder) affecting versions from n/a up to 4.10.2. The described issue is due to improper input neutralization during web page generation, enabling cross-site scripting. Publ...

CVE-2025-31036

Cross-Site Request Forgery CSRF vulnerability in WPSOLR WPSolr wpsolr-free allows Privilege Escalation.This issue affects WPSolr: from n/a through = 24.0...

CVE-2025-31035

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Benjamin Chris WP Editor.md – The Perfect WordPress Markdown Editor wp-editormd allows Stored XSS.This issue affects WP Editor.md – The Perfect WordPress Markdown Editor: from n/a through = 10.2.1...

CVE-2025-32378

Shopware is an open source e-commerce software platform. Prior to 6.6.10.3 or 6.5.8.17, the default settings for double-opt-in allow for mass unsolicited newsletter sign-ups without confirmation. Default settings are Newsletter: Double Opt-in set to active, Newsletter: Double opt-in for registere...

CVE-2025-32661 WordPress Interactive US Map plugin <= 2.7 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in WP Map Plugins Interactive US Map allows Stored XSS. This issue affects Interactive US Map: from n/a through 2.7...

CVE-2025-32378 Shopware's default newsletter opt-in settings allow for mass sign-up abuse

Shopware is an open source e-commerce software platform. Prior to 6.6.10.3 or 6.5.8.17, the default settings for double-opt-in allow for mass unsolicited newsletter sign-ups without confirmation. Default settings are Newsletter: Double Opt-in set to active, Newsletter: Double opt-in for registere...

CVE-2025-32378 Shopware's default newsletter opt-in settings allow for mass sign-up abuse

Shopware is an open source e-commerce software platform. Prior to 6.6.10.3 or 6.5.8.17, the default settings for double-opt-in allow for mass unsolicited newsletter sign-ups without confirmation. Default settings are Newsletter: Double Opt-in set to active, Newsletter: Double opt-in for registere...

CVE-2025-32378

Shopware CVE-2025-32378 affects Shopware open source platforms prior to 6.6.10.3 and 6.5.8.17, where default double-opt-in newsletter settings allow mass sign-ups without confirmation. With Newsletter: Double Opt-in active and related disabled options, anyone can register using any email and opt ...

GHSA-4H9W-7VFP-PX8M Shopware default newsletter opt-in settings allow for mass sign-up abuse

Impact Currently the default settings for double-opt-in allow for mass unsolicited newsletter sign-ups without confirmation. Default settings are: Newsletter: Double Opt-in - active Newsletter: Double opt-in for registered customers - disabled Log-in & sign-up: Double opt-in on sign-up - disabled...

Shopware default newsletter opt-in settings allow for mass sign-up abuse

Impact Currently the default settings for double-opt-in allow for mass unsolicited newsletter sign-ups without confirmation. Default settings are: Newsletter: Double Opt-in - active Newsletter: Double opt-in for registered customers - disabled Log-in & sign-up: Double opt-in on sign-up - disabled...

ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up

...

SUSE CVE-2025-3408

A vulnerability was found in Nothings stb up to f056911. It has been rated as critical. Affected by this issue is the function stbdupreplace. The manipulation leads to integer overflow. The attack may be launched remotely. Continious delivery with rolling releases is used by this product...

PT-2025-15728 · Unknown · Webliberty Simple Spoiler

Name of the Vulnerable Software and Affected Versions: Webliberty Simple Spoiler versions n/a through 1.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Stored XSS. This means that an attacker ca...

WordPress Streamit plugin <= 4.0.1 - Authenticated (Subscriber+) Arbitrary File Download vulnerability

Authenticated Subscriber+ Arbitrary File Download vulnerability discovered by István Márton in WordPress Theme Streamit versions = 4.0.1...

A week in security (March 31 &#8211; April 6)

Last week on Malwarebytes Labs: Why we’re no longer doing April Fools’ Day Intimate images from kink and LGBTQ+ dating apps left exposed online "Urgent reminder" tax scam wants to phish your Microsoft credentials "Nudify" deepfakes stored unprotected online Location, name, and photos of random ki...

CVE-2025-32132

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in FunnelCockpit FunnelCockpit funnelcockpit allows Stored XSS.This issue affects FunnelCockpit: from n/a through = 1.4.3...