CVE-2025-48257

CVE-2025-48257 (WordPress Projectopia

CVE-2025-32999

Cross-site scripting vulnerability exists in a-blog cms versions prior to Ver. 3.1.43 and prior to Ver. 3.0.47. This issue exists in a specific field in the entry editing screen, and exploitation requires contributor or higher level privileges. If this vulnerability is exploited, an arbitrary...

CVE-2025-32999

Cross-site scripting vulnerability exists in a-blog cms versions prior to Ver. 3.1.43 and prior to Ver. 3.0.47. This issue exists in a specific field in the entry editing screen, and exploitation requires contributor or higher level privileges. If this vulnerability is exploited, an arbitrary...

CVE-2025-32999

CVE-2025-32999 : The vulnerability affects a-blog cms prior to version 3.1.43 and prior to 3.0.47. It is a cross-site scripting issue in a specific field of the entry editing screen that requires contributor or higher privileges to exploit. If exploited, an arbitrary script may execute in the web...

CVE-2025-32999

Cross-site scripting vulnerability exists in a-blog cms versions prior to Ver. 3.1.43 and prior to Ver. 3.0.47. This issue exists in a specific field in the entry editing screen, and exploitation requires contributor or higher level privileges. If this vulnerability is exploited, an arbitrary...

CVE-2025-2561 Ninja Forms < 3.10.1 - Admin+ Stored XSS

The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

WordPress My Sticky Bar plugin < 2.6.8 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin My Sticky Bar versions 2.6.8...

CVE-2024-12812

The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 is affected by an IDOR issue where employees can manipulate parameters to access the data of terminated employees...

WordPress Robo Gallery plugin < 3.2.22 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Robo Gallery versions 3.2.22...

Mozilla Firefox ESR < 115.23.1

The version of Firefox ESR installed on the remote Windows host is prior to 115.23.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-38 advisory. - An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index...

WordPress Jetpack plugin < 13.8 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Marc Montpas in WordPress Plugin Jetpack versions 13.8...

CVE-2025-40907 FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library

FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 aka fcgi library. The included FastCGI library is affected by CVE-2025-23016, causing an integer overflow and resultant heap-based buffer overflow via crafted nameLen or valueLen values in data to the IPC...

CVE-2024-54779

Netgate pfSense CE prior to 2.8.0 beta release and corresponding Plus builds is vulnerable to Cross Site Scripting XSS in widgets/log.widget.php...

Adobe Substance 3D Painter 11.0.1 (APSB25-38)

The version of Adobe Substance 3D Painter installed on the remote host is prior to 11.0.1. It is, therefore, affected by a vulnerability as referenced in the APSB25-38 advisory. - Substance3D - Painter versions 11.0 and earlier are affected by an out-of-bounds write vulnerability that could resul...

CVE-2022-25858 affecting package uglify-js for versions less than 3.19.3-11

CVE-2022-25858 affecting package uglify-js for versions less than 3.19.3-11. An upgraded version of the package is available that resolves this issue...

CVE-2023-25567 affecting package gssntlmssp for versions less than 1.3.1-1

CVE-2023-25567 affecting package gssntlmssp for versions less than 1.3.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-8009

The Sensei LMS WordPress plugin before 4.20.0 disclose all users of the blog including their email address to teachers on the students page...

CVE-2024-2869 Easy Property Listings <= 3.5.3 - Admin+ Stored XSS

The Easy Property Listings WordPress plugin before 3.5.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-5440 If-So Dynamic Content Personalization < 1.8.0.3 - Contributor+ Shortcode Stored XSS

The If-So Dynamic Content Personalization WordPress plugin before 1.8.0.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site...

CVE-2025-4591

CVE-2025-4591 refers to a Stored Cross-Site Scripting vulnerability in the WordPress plugin Weluka Lite (versions up to and including 1.0.3) via the weluka-map shortcode. An authenticated attacker with contributor-level access can inject script that executes on pages viewed by users. Technical de...