PT-2025-21476 · WordPress · Eventprime

Name of the Vulnerable Software and Affected Versions: EventPrime WordPress plugin versions prior to 3.5.0 Description: The issue concerns a lack of proper permission validation when updating bookings, allowing users to change or cancel bookings for other users. Additionally, the feature lacks a...

PT-2025-21526 · WordPress · Ajax Search Lite

Name of the Vulnerable Software and Affected Versions: Ajax Search Lite versions prior to 4.12.3 Description: The issue concerns the Ajax Search Lite WordPress plugin, which does not properly sanitize and escape some of its settings. This could allow high-privilege users, such as administrators, ...

PT-2025-21275 · WordPress · Ticketbai Facturas Para Woocommerce

Name of the Vulnerable Software and Affected Versions: TicketBAI Facturas para WooCommerce plugin for WordPress versions up to, and including, 3.18 Description: The issue concerns arbitrary file deletion due to insufficient file path validation via the 'delpdf' action. This allows unauthenticated...

PT-2025-21428 · WordPress · Prisna Gwt Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Prisna GWT WordPress plugin versions prior to 1.4.14 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible even when the unfiltered html capability is disallowed,...

PT-2025-21430 · WordPress · Simple Basic Contact Form

Name of the Vulnerable Software and Affected Versions: The Simple Basic Contact Form WordPress plugin versions prior to 20250114 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html...

Eclipse Jetty DoS Vulnerability (GHSA-889j-63jv-qhr8) - Linux

Eclipse Jetty is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:eclipse:jetty";...

PT-2025-21262 · Unknown · Bluewave Checkmate

Name of the Vulnerable Software and Affected Versions: BlueWave Checkmate versions prior to 2.1 Description: The issue allows an authenticated regular user to access sensitive application secrets. This is achieved via the "/api/v1/settings" endpoint. Recommendations: For versions prior to 2.1,...

PT-2025-21549 · WordPress · Ekc Tournament Manager

Name of the Vulnerable Software and Affected Versions: EKC Tournament Manager versions prior to 2.2.2 Description: The issue concerns the lack of a CSRF check when updating settings in the EKC Tournament Manager WordPress plugin. This could allow attackers to make a logged-in admin change the...

PT-2025-21474 · WordPress · Advanced Cron Manager

Name of the Vulnerable Software and Affected Versions: The Advanced Cron Manager WordPress plugin versions prior to 2.5.7 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for...

PT-2025-21461 · WordPress · The Gdpr Framework By Data443

Name of the Vulnerable Software and Affected Versions: The GDPR Framework By Data443 WordPress plugin versions prior to 2.2.0 Description: The issue concerns the lack of sanitization and escaping of certain settings in the plugin, which could allow high-privilege users, such as admins, to perform...

PT-2025-21541 · WordPress · Team

Name of the Vulnerable Software and Affected Versions: Team WordPress plugin versions prior to 4.4.2 Description: The issue allows high privilege users, such as administrators, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed, f...

PT-2025-21534 · WordPress · Z-Downloads

Name of the Vulnerable Software and Affected Versions: Z-Downloads WordPress plugin versions prior to 1.11.6 Description: The issue arises from the plugin's failure to properly sanitise and escape certain parameters when they are displayed on the page. This oversight could allow unauthenticated...

PT-2025-21340 · Wamr +1 · Wamr +1

Name of the Vulnerable Software and Affected Versions: WAMR versions up to and including 2.2.0 WAMR built with libc-uvwasi on Windows Description: The issue is related to a symlink following vulnerability in the WebAssembly Micro Runtime WAMR. On WAMR running in Windows, creating a symlink pointi...

PT-2025-21373 · WordPress · Allow Svg

Name of the Vulnerable Software and Affected Versions: Allow SVG WordPress plugin versions prior to 1.2.0 Description: The issue concerns the failure to sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...

PT-2025-21460

Name of the Vulnerable Software and Affected Versions: LifterLMS WordPress plugin versions prior to 8.0.1 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page. Thi...

PT-2025-21265 · WordPress · Responsive Lightbox & Gallery

Name of the Vulnerable Software and Affected Versions: Responsive Lightbox & Gallery WordPress plugin versions prior to 2.5.1 Description: The issue concerns a Stored Cross-Site Scripting attack. Users with the contributor role and above can exploit this due to the plugin's failure to validate an...

PT-2025-21547 · WordPress · Cyan Backup

Name of the Vulnerable Software and Affected Versions: CYAN Backup WordPress plugin versions prior to 2.5.3 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed, fo...

PT-2025-21395 · WordPress · Jetpack +1

Name of the Vulnerable Software and Affected Versions: Jetpack WordPress plugin versions prior to 13.8 Jetpack Boost WordPress plugin versions prior to 3.4.8 Description: The issue concerns the use of regexes in the Site Accelerator features of the Jetpack and Jetpack Boost WordPress plugins when...

PT-2025-21543 · Unknown · Free Booking Plugin

Name of the Vulnerable Software and Affected Versions: Free Booking Plugin for Hotels, Restaurants and Car Rentals versions prior to 1.3.15 Description: The issue concerns the lack of CSRF check when updating settings, which could allow attackers to make a logged-in subscriber change them via a...

PT-2025-21398 · Unknown · Mb Custom Post Types & Custom Taxonomies

Name of the Vulnerable Software and Affected Versions: MB Custom Post Types & Custom Taxonomies versions prior to 2.7.7 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is...