CVE-2025-11010 vstakhov libucl ucl_util.c ucl_include_common heap-based overflow

A vulnerability has been found in vstakhov libucl up to 0.9.2. Affected by this vulnerability is the function uclincludecommon of the file /src/uclutil.c. Such manipulation leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the...

CVE-2025-60111

Cross-Site Request Forgery CSRF vulnerability in javothemes Javo Core javo-core allows Authentication Bypass.This issue affects Javo Core: from n/a through = 3.0.0.266...

CVE-2025-60186 WordPress Google+ Comments Plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Alex Moss Google+ Comments google-plus-comments allows Stored XSS.This issue affects Google+ Comments: from n/a through = 1.0...

CVE-2025-59585

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PenciDesign Penci Recipe penci-recipe allows DOM-Based XSS.This issue affects Penci Recipe: from n/a through = 4.0...

CVE-2025-57942

Cross-Site Request Forgery CSRF vulnerability in andymoyle Emergency Password Reset emergency-password-reset allows Cross Site Request Forgery.This issue affects Emergency Password Reset: from n/a through = 9.3...

CVE-2025-58268

Cross-Site Request Forgery CSRF vulnerability in WPMK WPMK PDF Generator wpmk-pdf-generator allows Stored XSS.This issue affects WPMK PDF Generator: from n/a through = 1.0.1...

CVE-2025-58973

CVE-2025-58973 is a PHP Remote File Inclusion/Local File Inclusion vulnerability in Easy Elementor Addons (WordPress plugin). The issue arises from improper control of the filename used in include/require, enabling Local File Inclusion. Affected versions are Easy Elementor Addons up to 2.2.8 (no ...

CVE-2025-57985 WordPress Ultimate Watermark Plugin <= 1.1 - Broken Access Control Vulnerability

Missing Authorization vulnerability in MantraBrain Ultimate Watermark ultimate-watermark allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Watermark: from n/a through = 1.1...

CVE-2025-58703

CVE-2025-58703: Stored XSS in Skyword API Plugin (WordPress) affecting Skyword API Plugin versions up to 2.5.3. Impact per CVSS: NETWORK attack, Low to Low confidentiality/integrity/availability, UI interaction required. Connected sources indicate the issue is currently Unpatched (no public fix d...

CVE-2025-9887

CVE-2025-9887 concerns the WordPress plugin Custom Login And Signup Widget . The vulnerability is a Cross-Site Request Forgery in all versions up to 1.0 caused by missing or incorrect nonce validation in the file /frndzk_adminclsw.php. This allows unauthenticated attackers to change email and use...

CVE-2025-10319 JeecgBoot Tenant Log Export exportLog improper authorization

A security flaw has been discovered in JeecgBoot up to 3.8.2. Affected by this issue is some unknown functionality of the file /sys/tenant/exportLog of the component Tenant Log Export. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been...

WordPress Themia Lite Theme <= 1.5.0 - Sensitive Data Exposure Vulnerability

Sensitive Data Exposure Vulnerability discovered by Legion Hunter in WordPress Theme Themia Lite versions = 1.5.0...

CVE-2025-10251 FoxCMS Images.php batchCope sql injection

A vulnerability was detected in FoxCMS up to 1.24. Affected by this issue is the function batchCope of the file /app/admin/controller/Images.php. The manipulation of the argument ids results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used...

CVE-2025-9627

CVE-2025-9627 describes a CSRF vulnerability in the WordPress Run Log plugin (versions up to and including 1.7.10). The issue stems from missing/incorrect nonce validation in the oirl_plugin_options function, allowing unauthenticated attackers to modify plugin settings (e.g., distance units, pace...

CVE-2025-9860

The WordPress Mixtape plugin is vulnerable to Stored Cross-Site Scripting (XSS) via the mixtape shortcode in all versions up to 1.1. The root cause is insufficient input sanitization and output escaping on user-supplied attributes, enabling authenticated attackers with contributor-level access or...

CVE-2025-5801

CVE-2025-5801 refers to a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin “Digital Events Calendar” up to version 1.0.8. The issue stems from insufficient input sanitization and output escaping of the column parameter, allowing an authenticated attacker (Contributor level ...

CVE-2025-8316 Certifica WP <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via evento Parameter

The Certifica WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘evento’ parameter in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

PT-2025-37087

Name of the Vulnerable Software and Affected Versions: Papermerge DMS versions through 3.5.3 Description: A security flaw exists in Papermerge DMS related to the Authorization Token Handler component. Manipulation of this component can lead to improper authorization. This issue can be exploited...

CVE-2025-10097

A vulnerability was identified in SimStudioAI sim up to 1.0.0. This impacts an unknown function of the file apps/sim/app/api/function/execute/route.ts. The manipulation of the argument code leads to code injection. The attack is possible to be carried out remotely...

WordPress Callie Britt Theme <= 1.2.3 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Callie Britt versions = 1.2.3...