WordPress HT Contact Form Widget 2.2.1 Shell Upload

The WordPress HT Contact Form Widget plugin is vulnerable to arbitrary file uploads due to missing file type validation in the tempfileupload function in all versions up to, and including, 2.2.1. This allows unauthenticated attackers to upload arbitrary files to the server, potentially leading to...

PT-2025-29537

Name of the Vulnerable Software and Affected Versions HT Contact Form Widget for Elementor Page Builder & Gutenberg Blocks & Form Builder versions up to and including 2.2.1 Description The HT Contact Form Widget plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient fil...

CVE-2025-7360: Improper Limitation of a Pathname to a Restricted Directory

The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file moving due to insufficient file path validation in the handlefilesupload function in all versions up to, and including, 2.2.1. This makes it possible for...

PT-2025-29532

Name of the Vulnerable Software and Affected Versions HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. versions up to and including 2.2.1 Description The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. plugin for WordPress i...

CVE-2025-7327

The Widget for Google Reviews plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.0.15 via the layout parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary files on the...

CVE-2025-7327 Widget for Google Reviews <= 1.0.15 - Authenticated (Subscriber+) Directory Traversal to Local File Inclusion

The Widget for Google Reviews plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.0.15 via the layout parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary files on the...

CVE-2025-6244

The Essential Addons for Elementor – Popular Elementor Templates and Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the via Calendar And Business Reviews Widgets attributes in all versions up to, and including, 6.1.19 due to insufficient input sanitization and outpu...

CVE-2025-7327: Improper Control of Filename for Include/Require Statement in PHP Program

The Widget for Google Reviews plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.0.15 via the layout parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary files on the...

CVE-2025-28969

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in cybio Gallery Widget gallery-widget allows SQL Injection.This issue affects Gallery Widget: from n/a through = 1.2.1...

CVE-2025-28969

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in cybio Gallery Widget gallery-widget allows SQL Injection.This issue affects Gallery Widget: from n/a through = 1.2.1...

CVE-2025-28969 WordPress Gallery Widget plugin <= 1.2.1 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in cybio Gallery Widget allows SQL Injection. This issue affects Gallery Widget: from n/a through 1.2.1...

CVE-2025-28969 WordPress Gallery Widget plugin <= 1.2.1 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in cybio Gallery Widget gallery-widget allows SQL Injection.This issue affects Gallery Widget: from n/a through = 1.2.1...

CVE-2025-28969

CVE-2025-28969 is a SQL Injection in the cybio/WP Gallery Widget prior to or up to version 1.2.1. The issue stems from improper neutralization of special elements in SQL commands for the Gallery Widget, enabling injection. Public details identify affected software as Gallery Widget versions ≤ 1.2...

PT-2025-27880 · Unknown · Cybio Gallery Widget

Name of the Vulnerable Software and Affected Versions: cybio Gallery Widget versions 1.2.1 and earlier Description: The issue is related to the improper neutralization of special elements used in an SQL command, also known as 'SQL Injection'. This allows for SQL Injection in the cybio Gallery...

WordPress plugin Gallery Widget SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...

CVE-2025-28969: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in cybio Gallery Widget gallery-widget allows SQL Injection.This issue affects Gallery Widget: from n/a through = 1.2.1...

CVE-2025-49029

Improper Control of Generation of Code 'Code Injection' vulnerability in bitto.kazi Custom Login And Signup Widget custom-login-and-signup-widget allows Code Injection.This issue affects Custom Login And Signup Widget: from n/a through = 1.0...

Malicious code in twilio-webchat-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5ab5419528c85b4b675bfd8bd45c7d107e151b10606f24a8ef7c9b9192dd6f14 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in twilio-webchat-widget

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2025-2330: Improper Neutralization of Input During Web Page Generation

The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button+modal' widget in all versions up to, and including, 2.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes i...