CVE-2025-9626 Page Blocks <= 1.1.0 - Cross-Site Request Forgery

The Page Blocks plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing or incorrect nonce validation on the adminprocesswidgetpagechange function. This makes it possible for unauthenticated attackers to modify widget pa...

CVE-2025-10862

CVE-2025-10862 affects the WordPress plugin “Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers” up to and including version 2.1.3. The root cause is insufficient escaping of the id parameter and lack of proper query preparation, allowing unauthenti...

CVE-2025-10496

CVE-2025-10496 affects the WordPress plugin Cookie Notice & Consent (versions up to 1.6.5). Root cause: stored cross-site scripting via the uuid parameter due to insufficient input sanitization/output escaping. Impact: unauthenticated attackers can inject arbitrary scripts that execute when users...

CVE-2025-11442 JhumanJ OpnForm API Endpoint cross-site request forgery

A security flaw has been discovered in JhumanJ OpnForm up to 1.9.3. The impacted element is an unknown function of the component API Endpoint. The manipulation results in cross-site request forgery. The attack may be performed from remote. The exploit has been released to the public and may be...

EUVD-2021-25674

Malware in sbrugna...

EUVD-2020-24168

Malware in sbrugna...

EUVD-2025-27956

Malicious code in bioql PyPI...

EUVD-2025-28557

Malicious code in bioql PyPI...

EUVD-2025-26900

Malicious code in bioql PyPI...

EUVD-2025-27123

Malicious code in bioql PyPI...

EUVD-2023-58956

Malicious code in bioql PyPI...

EUVD-2025-26298

Malicious code in bioql PyPI...

EUVD-2025-32286

Malicious code in bioql PyPI...

EUVD-2024-51681

Malicious code in bioql PyPI...

EUVD-2022-33780

Malicious code in bioql PyPI...

CVE-2025-7721 JoomSport <= 5.7.3 - Unauthenticated Directory Traversal to Local File Inclusion

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.7.3 via the task parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the...

CVE-2025-10735

The Block For Mailchimp – Easy Mailchimp Form Integration plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.1.12 via the mcbSubmitFormData. This makes it possible for unauthenticated attackers to make web requests to arbitrary location...

CVE-2025-8877 AffiliateWP <= 2.28.2 - Unauthenticated SQL Injection

The AffiliateWP plugin for WordPress is vulnerable to SQL Injection via the ajaxgetaffiliateidfromlogin function in all versions up to, and including, 2.28.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2025-10182 dbview <= 0.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

The dbview plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dbview' shortcode in all versions up to, and including, 0.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...

CVE-2025-9993 Bei Fen – WordPress Backup Plugin <= 1.4.2 - Authenticated (Subscriber+) Local File Inclusion

The Bei Fen – WordPress Backup Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.2 via the 'task'. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .php files on t...