CVE-2012-10050 CuteFlow <= 2.11.2 Arbitrary File Upload RCE

CuteFlow version 2.11.2 and earlier contains an arbitrary file upload vulnerability in the restartcirculationvalueswrite.php script. The application fails to validate or restrict uploaded file types, allowing unauthenticated attackers to upload arbitrary PHP files to the upload/1/ directory. Thes...

WordPress Post Connector Plugin <= 1.0.11 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Post Connector versions = 1.0.11...

CVE-2025-52787 WordPress Tennis Court Bookings plugin <= 1.2.7 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in EZiHosting Tennis Court Bookings allows Reflected XSS. This issue affects Tennis Court Bookings: from n/a through 1.2.7...

WordPress Invico - WordPress Consulting Business Theme <= 1.9 - Cross Site Scripting (XSS) Vulnerability

WordPress Invico - WordPress Consulting Business Theme = 1.9 - Cross Site Scripting XSS Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Invico - WordPress Consulting Business Theme versions = 1.9...

WordPress Constructor theme <= 1.6.5 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Sulabh Jain in WordPress Theme Constructor versions = 1.6.5...

UBUNTU-CVE-2025-6547

Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation.This issue affects pbkdf2: =3.1.2...

CVE-2025-52789

Cross-Site Request Forgery CSRF vulnerability in George Lewe Lewe ChordPress chordpress allows Stored XSS.This issue affects Lewe ChordPress: from n/a through = 4.0.1...

CVE-2025-49973

CVE-2025-49973 is a Missing Authorization vulnerability in GrandPlugins Image Sizes Controller, Create Custom Image Sizes, and Disable Image Sizes for WordPress. Affected versions range from 1.0.0 through 1.0.9 (and affected components include Image Sizes Controller, Create Custom Image Sizes, Di...

CVE-2025-49972 WordPress TM Replace Howdy plugin <= 1.4.2 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in David Wood TM Replace Howdy tm-replace-howdy allows Cross Site Request Forgery.This issue affects TM Replace Howdy: from n/a through = 1.4.2...

CVE-2025-49977

Cross-Site Request Forgery CSRF vulnerability in WP Inventory WP Inventory Manager wp-inventory-manager allows Cross Site Request Forgery.This issue affects WP Inventory Manager: from n/a through = 2.3.4...

CVE-2025-52792

CVE-2025-52792 relates to a CSRF-induced Stored XSS in the WordPress plugin WP User Stylesheet Switcher. Affected versions are up to v2.2.0 (inclusive); the vulnerability is unpatched in the provided sources. Exploitation is not confirmed in the documents; CVSS details show a base score of 7.1 (H...

CVE-2025-48111 WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.49.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in YITHEMES YITH PayPal Express Checkout for WooCommerce allows Cross Site Request Forgery. This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.49.0...

CVE-2025-49861 WordPress Kama Click Counter plugin <= 4.0.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Timur Kamaev Kama Click Counter kama-clic-counter allows Stored XSS.This issue affects Kama Click Counter: from n/a through = 4.0.3...

CVE-2025-49447

Unrestricted Upload of File with Dangerous Type vulnerability in Fastw3b LLC FW Food Menu allows Using Malicious Files. This issue affects FW Food Menu : from n/a through 6.0.0...

CVE-2025-6003

The WordPress Single Sign-On SSO plugin for WordPress is vulnerable to unauthorized access due to a misconfigured capability check on a function in all versions up to, and including, the .5.3 versions of the plugin. This makes it possible for unauthenticated attackers to extract sensitive data...

CVE-2025-48279

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Richard Perdaan WC MyParcel Belgium allows Reflected XSS. This issue affects WC MyParcel Belgium: from 4.5.5 through beta...

CVE-2025-48141 WordPress Multi CryptoCurrency Payments plugin <= 2.0.7 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Alex Zaytseff Multi CryptoCurrency Payments multi-crypto-currency-payment allows SQL Injection.This issue affects Multi CryptoCurrency Payments: from n/a through = 2.0.7...

CVE-2025-48141 WordPress Multi CryptoCurrency Payments <= 2.0.3 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Alex Zaytseff Multi CryptoCurrency Payments allows SQL Injection. This issue affects Multi CryptoCurrency Payments: from n/a through 2.0.3...

PT-2025-24441 · Code Projects · Code-Projects Chat System

Name of the Vulnerable Software and Affected Versions: code-projects Chat System versions up to 1.0 Description: A critical issue affects the processing of the file /user/confirm password.php. The manipulation of the cid argument leads to SQL injection. The attack can be initiated remotely...

WordPress User Registration Aide Plugin <= 1.5.3.8 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin User Registration Aide versions = 1.5.3.8...