CVE-2025-32136

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in activecampaign ActiveCampaign activecampaign-subscription-forms allows Stored XSS.This issue affects ActiveCampaign: from n/a through = 8.1.16...

CVE-2025-31903

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Xavi Ivars XV Random Quotes xv-random-quotes allows Reflected XSS.This issue affects XV Random Quotes: from n/a through = 2.0.0...

CVE-2025-32249

Cross-Site Request Forgery CSRF vulnerability in Designinvento DirectoryPress directorypress allows Cross Site Request Forgery.This issue affects DirectoryPress: from n/a through = 3.6.22...

CVE-2025-32133

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ays Pro Secure Copy Content Protection and Content Locking secure-copy-content-protection allows Stored XSS.This issue affects Secure Copy Content Protection and Content Locking: from n/a through =...

CVE-2025-32271 WordPress Woocommerce Role Pricing Plugin <= 3.5.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in ablancodev Woocommerce Role Pricing allows Cross Site Request Forgery. This issue affects Woocommerce Role Pricing: from n/a through 3.5.5...

CVE-2025-32249 WordPress DirectoryPress Plugin <= 3.6.22 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Designinvento DirectoryPress directorypress allows Cross Site Request Forgery.This issue affects DirectoryPress: from n/a through = 3.6.22...

CVE-2025-32149

CVE-2025-32149 affects the WordPress plugin teachPress (up to 9.0.11). The issue is an SQL injection caused by improper neutralization of input in the plugin, with exploitation requiring authentication (Contributor+). Current references indicate the patch status is Unpatched; no exploits or in-th...

CVE-2025-31389

The CVE-2025-31389 entry covers a Reflected XSS in the Sequel plugin (Sequel.io Sequel) for the Sequel: from n/a through 1.0.11. Connected sources confirm the issue is a cross-site scripting vulnerability in the web page generation path, caused by improper input neutralization. The Wordfence entr...

CVE-2025-3197

Versions of the package expand-object from 0.0.0 are vulnerable to Prototype Pollution in the expand function in index.js. This function expands the given string into an object and allows a nested property to be set without checking the provided keys for sensitive properties like proto...

WordPress plugin SurveyJS 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability...

CVE-2025-31855

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in softnwords SMM API smm-api allows Stored XSS.This issue affects SMM API: from n/a through = 6.0.31...

CVE-2025-31792

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in piotnetdotcom Piotnet Forms piotnetforms allows Stored XSS.This issue affects Piotnet Forms: from n/a through = 1.0.30...

CVE-2025-31864

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Out the Box Beam me up Scotty beam-me-up-scotty allows Stored XSS.This issue affects Beam me up Scotty: from n/a through = 1.0.23...

CVE-2025-31787

Missing Authorization vulnerability in AudioTheme Cue cue allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cue: from n/a through = 2.4.4...

CVE-2025-31763

Cross-Site Request Forgery CSRF vulnerability in Preliot Cache control by Cacholong cache-control-by-cacholong allows Cross Site Request Forgery.This issue affects Cache control by Cacholong: from n/a through = 5.4.1...

CVE-2025-31818

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ContentBot.ai ContentBot AI Writer content-bot allows Stored XSS.This issue affects ContentBot AI Writer: from n/a through = 1.2.4...

CVE-2025-31775

Cross-Site Request Forgery CSRF vulnerability in Smackcoders Inc., Google SEO Pressor Snippet google-seo-author-snippets allows Cross Site Request Forgery.This issue affects Google SEO Pressor Snippet: from n/a through = 2.0...

CVE-2025-31766

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PhotoShelter PhotoShelter for Photographers Blog Feed Plugin photoshelter-official-plugin allows Stored XSS.This issue affects PhotoShelter for Photographers Blog Feed Plugin: from n/a through =...

CVE-2025-3163 InternLM LMDeploy conf.py open code injection

A vulnerability was found in InternLM LMDeploy up to 0.7.1. It has been declared as critical. Affected by this vulnerability is the function Open of the file lmdeploy/docs/en/conf.py. The manipulation leads to code injection. It is possible to launch the attack on the local host. The exploit has...

Location, name, and photos of random kids shown to parents in child tracker mix up

Not one but several worried parents that tracked their children by using T-Mobile tracking devices suddenly found that they were looking at the location of random other children. And could not locate their own. T-Mobile sells a small GPS tracker called SyncUP, which can be used to track, among...