CVE-2025-47464 WordPress Solace Extra <= 1.3.1 - Server Side Request Forgery (SSRF) Vulnerability

Server-Side Request Forgery SSRF vulnerability in solacewp Solace Extra allows Server Side Request Forgery. This issue affects Solace Extra: from n/a through 1.3.1...

CVE-2025-47464

CVE-2025-47464: Solace Extra (WordPress) is affected by a Server-Side Request Forgery (SSRF) vulnerability in versions up to 1.3.1. The issue is authenticated (Subscriber+) and has a CVSS v3.1 base score of 4.9 (Medium). Connected sources indicate the vulnerability exists in Solace Extra

PT-2025-20075 · Flatpress · Flatpress

Name of the Vulnerable Software and Affected Versions: flatpress version 1.3.1 Description: The issue is related to Cross Site Scripting XSS in the Administration area, specifically via the Manage categories section. This allows for potential malicious script execution. Recommendations: For...

FlatPress 安全漏洞

FlatPress is a lightweight, easy-to-setup flat file blogging engine from the FlatPress open source. A security vulnerability exists in FlatPress version 1.3.1, which stems from the presence of cross-site scripting in the administration area, which could lead to cross-site scripting attacks...

PT-2025-18934 · WordPress · Alink Tap

Name of the Vulnerable Software and Affected Versions: Alink Tap plugin for WordPress versions up to, and including, 1.3.1 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the 'alink-tap' page. This allows unauthenticated attackers to...

WordPress plugin Alink Tap 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

CVE-2025-46514

Cross-Site Request Forgery CSRF vulnerability in milat Milat jQuery Automatic Popup milat-jquery-automatic-popup allows Stored XSS.This issue affects Milat jQuery Automatic Popup: from n/a through = 1.3.1...

CVE-2025-39359

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in codeworkweb CWW Portfolio cww-portfolio allows PHP Local File Inclusion.This issue affects CWW Portfolio: from n/a through = 1.3.1...

CVE-2025-39600

Cross-Site Request Forgery CSRF vulnerability in CRM Perks Integration for WooCommerce and QuickBooks wp-woocommerce-quickbooks allows Cross Site Request Forgery.This issue affects Integration for WooCommerce and QuickBooks: from n/a through = 1.3.1...

CVE-2025-3857

When reading binary Ion data through Amazon.IonDotnet using the RawBinaryReader class, Amazon.IonDotnet does not check the number of bytes read from the underlying stream while deserializing the binary format. If the Ion data is malformed or truncated, this triggers an infinite loop condition tha...

CVE-2025-46514

Cross-Site Request Forgery CSRF vulnerability in milat Milat jQuery Automatic Popup milat-jquery-automatic-popup allows Stored XSS.This issue affects Milat jQuery Automatic Popup: from n/a through = 1.3.1...

WordPress plugin Milat jQuery Automatic Popup 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop via the RawBinaryReader class. This is due to a missing check of the number of bytes read from the underlying stream while deserializing the binary format when reading binary Ion data. Remediation Upgrade Amazon.IonDotnet ...

WordPress CWW Portfolio theme <= 1.3.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Dimas Maulana Patchstack Alliance in WordPress Theme CWW Portfolio versions = 1.3.1...

ion-dotnet 安全漏洞

ion-dotnet is an A.NET implementation of Amazon Ion by amazon-ion open source. A security vulnerability exists in ion-dotnet versions prior to 1.3.1 that stems from the RawBinaryReader class not checking the number of bytes read, which could lead to an infinite loop and denial of service...

CVE-2025-32652 WordPress Solace Extra plugin <= 1.3.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in solacewp Solace Extra allows Using Malicious Files. This issue affects Solace Extra: from n/a through 1.3.1...

CVE-2025-39600 WordPress Integration for WooCommerce and QuickBooks plugin <= 1.3.1 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in CRM Perks Integration for WooCommerce and QuickBooks wp-woocommerce-quickbooks allows Cross Site Request Forgery.This issue affects Integration for WooCommerce and QuickBooks: from n/a through = 1.3.1...

CVE-2025-39600

CVE-2025-39600 is a CSRF vulnerability in the CRM Perks Integration for WooCommerce and QuickBooks. Affected: CRM Perks Integration plugin (WordPress) from versions up to and including 1.3.1. Root cause: Cross-Site Request Forgery without sufficient CSRF protection. Impact (per provided data): no...

WordPress plugin WP Remote Thumbnail 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

PT-2025-15411 · WordPress · Advanced Advertising System

Name of the Vulnerable Software and Affected Versions: Advanced Advertising System plugin for WordPress versions up to and including 1.3.1 Description: The issue arises from insufficient validation of the redirect URL provided through the redir parameter. This allows unauthenticated attackers to...