PT-2025-21694 · Thememove · Thememove Quickcal

Name of the Vulnerable Software and Affected Versions: ThemeMove QuickCal versions 1.0.13 and earlier Description: A Cross-Site Request Forgery CSRF issue allows Privilege Escalation. This is a type of attack where an attacker tricks a user into performing unintended actions on a web application...

PT-2025-21728 · Sharespine · Sharespine Woocommerce Connector

Name of the Vulnerable Software and Affected Versions: Sharespine Woocommerce Connector versions through 4.7.55 Description: The issue is related to a Missing Authorization vulnerability, which allows the exploitation of incorrectly configured access control security levels. Recommendations: For...

PT-2025-21609 · Libavif +1 · Libavif +1

Name of the Vulnerable Software and Affected Versions: libavif versions prior to 1.3.0 Description: The issue is related to integer overflows in multiplications involving rgbRowBytes, yRowBytes, uRowBytes, and vRowBytes in the avifImageRGBToYUV function in reformat.c. Recommendations: For version...

PT-2025-21701 · Nasa Core · Nasa Core

Name of the Vulnerable Software and Affected Versions: Nasa Core versions through 6.3.2 Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion...

PT-2025-21650

Name of the Vulnerable Software and Affected Versions: Flask-AppBuilder versions prior to 4.6.2 Description: The issue allows a malicious unauthenticated actor to perform an open redirect by manipulating the Host header in HTTP requests. Flask-AppBuilder 4.6.2 introduced the FAB SAFE REDIRECT HOS...

PT-2025-21719 · Unknown · Broadstreet

Name of the Vulnerable Software and Affected Versions: Broadstreet versions through 1.51.8 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks. Recommendations: For versions throug...

CVE-2022-26592 affecting package libsass for versions less than 3.6.6-1

CVE-2022-26592 affecting package libsass for versions less than 3.6.6-1. An upgraded version of the package is available that resolves this issue...

CVE-2023-45802 affecting package mod_http2 for versions less than 2.0.29-3

CVE-2023-45802 affecting package modhttp2 for versions less than 2.0.29-3. An upgraded version of the package is available that resolves this issue...

PT-2025-21503 · WordPress · Simple Job Board

Name of the Vulnerable Software and Affected Versions: The Simple Job Board WordPress plugin versions prior to 2.12.6 Description: The issue allows unauthenticated users to access and download uploaded resumes because the plugin does not prevent uploaded files from being listed. Recommendations:...

PT-2025-21390

Name of the Vulnerable Software and Affected Versions: coreActivity: Activity Logging for WordPress plugin versions prior to 1.8.1 Description: The issue allows unauthenticated users to perform a Stored XSS attack against high-privilege users, such as administrators, due to the plugin's failure t...

PT-2025-21489 · WordPress · Wccp-Pro

Name of the Vulnerable Software and Affected Versions: wccp-pro WordPress plugin versions prior to 15.3 Description: The issue concerns the wccp-pro WordPress plugin, which does not properly sanitise and escape some of its settings. This could allow high-privilege users, such as administrators, t...

PT-2025-21519 · Unknown · Webtoffee-Gdpr-Cookie-Consent

Name of the Vulnerable Software and Affected Versions: webtoffee-gdpr-cookie-consent versions prior to 2.6.1 Description: The issue allows visitors to conduct Stored Cross-Site Scripting attacks due to improper sanitization and escaping of IP headers when logging them. The payload is triggered wh...

PT-2025-21488

Name of the Vulnerable Software and Affected Versions: wccp-pro WordPress plugin versions prior to 15.3 Description: The issue concerns an open-redirect flaw via the referrer parameter, allowing the redirection of users to external sites. Recommendations: For versions prior to 15.3, update to...

PT-2025-21401 · WordPress · Social Slider Feed

Name of the Vulnerable Software and Affected Versions: Social Slider Feed WordPress plugin version 2.2.8 and earlier Description: The issue concerns the Social Slider Feed WordPress plugin, which does not properly sanitize and escape some of its settings. This could allow high-privilege users, su...

PT-2025-21332 · Lila · Lila

Name of the Vulnerable Software and Affected Versions: Lila for Lichess version before ab0beaf Description: The issue is related to an innerHTML usage pattern in powertip.ts, where text is extracted from a DOM node and interpreted as HTML, allowing Cross-Site Scripting XSS in some applications...

PT-2025-21525 · WordPress · Pagelayer

Name of the Vulnerable Software and Affected Versions: Page Builder: Pagelayer versions prior to 1.9.0 Description: The issue concerns the Page Builder: Pagelayer WordPress plugin, where versions prior to 1.9.0 do not properly sanitise and escape some of its settings. This could allow...

PT-2025-21482 · WordPress · Ctt Expresso Para Woocommerce

Name of the Vulnerable Software and Affected Versions: CTT Expresso para WooCommerce WordPress plugin versions prior to 3.2.13 Description: The issue concerns the CTT Expresso para WooCommerce WordPress plugin, where certain settings are not properly sanitised and escaped. This could allow...

PT-2025-21485 · WordPress · The Kbucket: Your Curated Content

Name of the Vulnerable Software and Affected Versions: The KBucket: Your Curated Content in WordPress plugin versions prior to 4.1.6 Description: The issue concerns the lack of sanitization and escaping of certain settings in the plugin, which could allow high-privilege users, such as admins, to...

PT-2025-21426 · Unknown · Wordpress连接微博

Name of the Vulnerable Software and Affected Versions: WordPress连接微博 WordPress plugin versions 2.5.6 and earlier Description: The issue concerns a lack of CSRF check in some areas of the plugin, as well as missing sanitization and escaping. This could allow attackers to make logged-in admins add...

PT-2025-21478 · WordPress · If-So Dynamic Content Personalization

Name of the Vulnerable Software and Affected Versions: If-So Dynamic Content Personalization WordPress plugin versions prior to 1.8.0.3 Description: The issue concerns the If-So Dynamic Content Personalization WordPress plugin, where it fails to validate and escape certain shortcode attributes...