CVE-2024-13053 Form Maker by 10Web < 1.15.33 - Admin+ Stored XSS via Theme Title

The Form Maker by 10Web WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-11269 AHAthat Plugin <= 1.6 - Admin+ SQL Injection

The AHAthat Plugin WordPress plugin through 1.6 does not sanitize and escape a parameter before using it in a SQL statement, allowing Admin to perform SQL injection attacks...

CVE-2024-11269 AHAthat Plugin <= 1.6 - Admin+ SQL Injection

The AHAthat Plugin WordPress plugin through 1.6 does not sanitize and escape a parameter before using it in a SQL statement, allowing Admin to perform SQL injection attacks...

CVE-2024-11221 Full Screen (Page) Background Image Slideshow <= 1.1 - Admin+ Stored XSS

The Full Screen Page Background Image Slideshow WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...

CVE-2024-11190

CVE-2024-11190 covers the jwp-a11y WordPress plugin (versions

CVE-2024-10475

The CVE-2024-10475 entry concerns the WordPress plugin Lead Form Builder / Responsive Contact Form Builder & Lead Generation Plugin, affected in versions prior to 1.9.8. The root cause is inadequate sanitisation/escaping of certain plugin settings, enabling Stored Cross-Site Scripting by high-pri...

CVE-2024-10475 Lead Form Builder < 1.9.8 - Admin+ Stored XSS

The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin before 1.9.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed f...

CVE-2024-10009 Website File Changes < 2.1.0 - Admin+ Authenticated SQL Injection

The Melapress File Monitor WordPress plugin before 2.1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks...

CVE-2025-47785

CVE-2025-47785 affects Emlog up to version 2.5.9. The issue is a SQL injection in the $origContent parameter of admin/article_save.php, which is accessible to ordinary registered users. This can induce SQL injection when the registered site is enabled, potentially allowing the injection of the ad...

CVE-2025-2570

Mattermost CVE-2025-2570 affects Mattermost Server versions 10.5.x ≤ 10.5.3 and 9.11.x ≤ 9.11.11. Root cause: the system fails to enforce RestrictSystemAdmin when a user lacks access to ExperimentalSettings, allowing a System Manager to access ExperimentSettings via the System Console. Impact: ex...

CVE-2025-2570 System Admin Cannot Access Environment settings in System Console While System Manager Can

Mattermost versions 10.5.x = 10.5.3, 9.11.x = 9.11.11 fail to check RestrictSystemAdmin setting if user doesn't have access to ExperimentalSettings which allows a System Manager to access ExperimentSettings when RestrictSystemAdmin is true via System Console...

CVE-2024-13914

The File Manager Advanced Shortcode plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.4 file-manager-advanced-shortcode and 2.5.6 advanced-file-manager-pro-premium, via the 'filemanageradvanced' shortcode. This makes it possible for authenticated...

PT-2025-21507 · WordPress · Secure Downloads

Name of the Vulnerable Software and Affected Versions: Secure Downloads WordPress plugin versions prior to 1.2.3 Description: The issue allows authenticated attackers with admin-level access and above to download arbitrary files, potentially containing sensitive information, such as the...

PT-2025-21429 · WordPress · Prisna Gwt Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Prisna GWT WordPress plugin versions prior to 1.4.14 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed, fo...

WordPress plugin Jetpack Boost 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2025-21550

Name of the Vulnerable Software and Affected Versions: EKC Tournament Manager versions prior to 2.2.2 Description: The issue allows a logged-in admin to download system files outside of the WordPress directory. This is a significant concern as it could potentially expose sensitive system...

CVE-2024-13940

CVE-2024-13940: Ninja Forms Webhooks for WordPress

CVE-2024-13940 Ninja Forms Webhooks <= 3.0.7 - Authenticated (Admin+) Server-Side Request Forgery via Form Webhook

The Ninja Forms Webhooks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.0.7 via the form webhook functionality. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitra...

PT-2025-16: Disclosure of sensitive data in Booco

The vulnerability was identified in Booco, versions 2.38, 2.39 The discovered vulnerability allows an unauthorized attacker to obtain administrator rights to the system, including access to all its data and functionality. Vulnerability status: Confirmed by vendor Date of vulnerability remediation...

Fortinet Fortigate TACACS+ authentication bypass (FG-IR-24-472)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-24-472 advisory. - A missing authentication for critical function in Fortinet FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager...