WordPress WP User Profile Avatar plugin <= 1.0.6 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by s1lentmt in WordPress Plugin WP User Profile Avatar versions = 1.0.6...

WordPress WP Customer Area plugin <= 8.3.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nguyen Tran Tuan Dung domiee13 in WordPress Plugin WP Customer Area versions = 8.3.4...

WordPress CSV Importer Improved plugin <= 0.6.1 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Chu The Anh Blue Rock in WordPress Plugin CSV Importer Improved versions = 0.6.1...

WordPress WP Voting Contest plugin <= 5.8 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by greenhats in WordPress Plugin WP Voting Contest versions = 5.8...

WordPress Simple Sticky Footer plugin <= 1.3.5 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Nabil Irawan in WordPress Plugin Simple Sticky Footer versions = 1.3.5...

WordPress RDFa Breadcrumb plugin <= 2.3 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Nabil Irawan in WordPress Plugin RDFa Breadcrumb versions = 2.3...

WordPress Lewe ChordPress plugin <= 4.0.1 - Cross Site Request Forgery (CSRF) to Stored XSS Vulnerability

Cross Site Request Forgery CSRF to Stored XSS Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Lewe ChordPress versions = 4.0.1...

WordPress ElementsKit Lite plugin <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Image Comparison Widget vulnerability discovered by Asaf Mozes in WordPress Plugin ElementsKit Elementor addons Lite versions = 3.5.2...

WordPress Fitness Park Theme <= 1.1.1 is vulnerable to Cross Site Scripting (XSS)

Software Fitness Park Type Theme Vulnerable versions = 1.1.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2025-50033 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID f81317695731 Credits Peter Thaleikis Required privilege Contribut...

CVE-2025-6109

A vulnerability was found in javahongxi whatsmars 2021.4.0. It has been rated as problematic. Affected by this issue is the function initialize of the file /whatsmars-archetypes/whatsmars-initializr/src/main/java/org/hongxi/whatsmars/initializr/controller/InitializrController.java. The manipulati...

WordPress Blog2Social plugin <= 8.4.4 - Authenticated (Subscriber+) SQL Injection via `prgSortPostType` Parameter vulnerability

Authenticated Subscriber+ SQL Injection via prgSortPostType Parameter vulnerability discovered by mikemyers in WordPress Plugin Blog2Social versions = 8.4.4...

WordPress YITH WooCommerce Wishlist plugin <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via id Parameter vulnerability discovered by Asaf Mozes in WordPress Plugin YITH WooCommerce Wishlist versions = 4.5.0...

WordPress Yougler Blogger Profile Page plugin <= v1.01 - Cross-Site Request Forgery to Settings Update vulnerability

Cross-Site Request Forgery to Settings Update vulnerability discovered by johska in WordPress Plugin Yougler Blogger Profile Page versions v1.01...

WordPress XiSearch bar plugin <= 2.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability

Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability discovered by johska in WordPress Plugin XiSearch bar versions = 2.6...

WordPress WP URL Shortener plugin <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability

Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability discovered by johska in WordPress Plugin WP URL Shortener versions = 1.2...

WordPress Responsive Plus plugin <= 3.2.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability

Cross Site Request Forgery CSRF to Settings Change vulnerability discovered by Chazz Wolcott Patchstack in WordPress Plugin Responsive Plus versions = 3.2.2...

WordPress WPCRM - CRM for Contact form CF7 & WooCommerce plugin <= 3.2.0 - SQL Injection Vulnerability

WordPress WPCRM - CRM for Contact form CF7 & WooCommerce plugin = 3.2.0 - SQL Injection Vulnerability discovered by Phúc ton luoi in WordPress Plugin WPCRM - CRM for Contact form CF7 & WooCommerce versions = 3.2.0...

Windows App Client < 2.0.505.0 Multiple Vulnerabilities (Jun 2025) - Windows

Windows App Client is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:microsoft:windowsapp";...

WordPress FW Gallery plugin <= 8.0.0 - Arbitrary File Deletion Vulnerability

Arbitrary File Deletion Vulnerability discovered by LVT-tholv2k in WordPress Plugin FW Gallery versions = 8.0.0...

WordPress Photography Theme <= 7.5.2 is vulnerable to PHP Object Injection

Software Photography Type Theme Vulnerable versions = 7.5.2 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-47579 Patch priority High CVSS severity High 9 Developer EPC PSID f3488f35689e Credits Rafie Muhammad Patchstack Required privilege Unauthenticated...