PT-2025-48282

Name of the Vulnerable Software and Affected Versions ThingsBoard versions prior to 4.2.1 Description An authenticated user can upload malicious SVG images through the "Image Gallery". This leads to a Stored Cross-Site Scripting XSS issue. The exploit is triggered when any user accesses the publi...

Cross-site Scripting (XSS)

Liferay is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper sanitization of user-supplied input in multiple fields within the Notifications widget, which allows an attacker to inject malicious scripts via crafted payloads and execute them in a victim’s browser...

CVE-2025-13386

The Social Images Widget plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'optionsupdate' function in all versions up to, and including, 2.1. This makes it possible for unauthenticated attackers to delete the plugin's settings via a...

CVE-2025-13386 Social Images Widget <= 2.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Deletion

The Social Images Widget plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'optionsupdate' function in all versions up to, and including, 2.1. This makes it possible for unauthenticated attackers to delete the plugin's settings via a...

EUVD-2025-199574

The Social Images Widget plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'optionsupdate' function in all versions up to, and including, 2.1. This makes it possible for unauthenticated attackers to delete the plugin's settings via a...

CVE-2025-13386

CVE-2025-13386 affects the WordPress plugin Social Images Widget (WordPress) up to version 2.1. The issue is a missing capability check in the options_update function, enabling unauthenticated attackers to delete or modify the plugin’s settings via a forged request and social engineering (trickin...

CVE-2025-13386 Social Images Widget <= 2.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Deletion

The Social Images Widget plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'optionsupdate' function in all versions up to, and including, 2.1. This makes it possible for unauthenticated attackers to delete the plugin's settings via a...

EUVD-2025-199375

Malicious code in @voiceflow/widget npm...

MAL-2025-191387 Malicious code in @voiceflow/widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac19bf504aadbfdca19efac5f7d258c14c541a1f9747324e00da8220b0b1d785 The package @voiceflow/widget was found to contain malicious code. Source: google-open-source-security...

WordPress Social Images Widget plugin <= 2.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Deletion vulnerability

Missing Authorization to Unauthenticated Arbitrary Plugin Settings Deletion vulnerability discovered by Legion Hunter in WordPress Plugin Social Images Widget versions = 2.1...

PT-2025-48010

The Social Images Widget plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'options update' function in all versions up to, and including, 2.1. This makes it possible for unauthenticated attackers to delete the plugin's settings via a...

WordPress plugin Social Images Widget 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

@voiceflow/alexa-types (>=2.14.43 <=2.15.62), @voiceflow/google-dfes-types (>=2.0.0 <=2.17.14) +3 more potentially affected by unknown CVE via @voiceflow/voiceflow-types (>=3.20.20 <=3.32.44)

@voiceflow/voiceflow-types NPM version =3.20.20, =2.14.43, =2.0.0, =2.20.44, =1.27.1, =1.0.5, =1.7.13 Source cves: unknown CVE Source advisory: SNYK:JS-VOICEFLOWVOICEFLOWTYPES-14103448...

@voiceflow/react-chat (>=1.0.3 <=2.62.4), @voiceflow/widget (>=1.0.3 <=1.7.13) potentially affected by unknown CVE via @voiceflow/slate-serializer (>=1.1.6 <=1.5.5)

@voiceflow/slate-serializer NPM version =1.1.6, =1.0.3, =1.0.3, =1.7.13 Source cves: unknown CVE Source advisory: SNYK:JS-VOICEFLOWSLATESERIALIZER-14103436...

@voiceflow/widget (>=1.0.3 <=1.7.13) potentially affected by unknown CVE via @voiceflow/react-chat (>=1.0.3 <=1.47.4)

@voiceflow/react-chat NPM version =1.0.3, =1.0.3, =1.7.13 Source cves: unknown CVE Source advisory: SNYK:JS-VOICEFLOWREACTCHAT-14103429...

Malicious code in @ensdomains/renewal-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 727920a0b3da80ce1061cf9557e1d3ef72a90618523b692406438b7150061dad The package @ensdomains/renewal-widget was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190735 Malicious code in @ensdomains/renewal-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 727920a0b3da80ce1061cf9557e1d3ef72a90618523b692406438b7150061dad The package @ensdomains/renewal-widget was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-198743

Malicious code in @ensdomains/renewal-widget npm...

WordPress ArtPlacer Widget plugin <= 2.22.9.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Jarno Vos jrn5151 in WordPress Plugin ArtPlacer Widget versions = 2.22.9.2...

CVE-2025-12964

The Magical Products Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mpdprtitletag' and 'mpdprsubtitletag' parameters in the MPD Pricing Table widget in all versions up to, and including, 1.1.29 due to insufficient input sanitization and output escaping on...