CVE-2024-2417

The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the formsaveaction function in all versions up to, and including, 3.1.5. This makes it possible for...

CVE-2025-15000 Page Keys <= 1.3.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'page_key' Parameter

The Page Keys plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pagekey’ parameter in all versions up to, and including, 1.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, ...

CVE-2025-15000 Page Keys <= 1.3.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'page_key' Parameter

The Page Keys plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pagekey’ parameter in all versions up to, and including, 1.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, ...

CVE-2025-14888 Simple User Meta Editor <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via User Meta Value Field

The Simple User Meta Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user meta value field in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-14888 Simple User Meta Editor <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via User Meta Value Field

The Simple User Meta Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user meta value field in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-14888

CVE-2025-14888 : Simple User Meta Editor (WordPress) is vulnerable to stored XSS via the User Meta Value field in all versions up to 1.0.0, due to insufficient input sanitization and output escaping. This affects multisite setups and installations where unfiltered_html is disabled, enabling an au...

CVE-2025-14887

CVE-2025-14887 affects the twinklesmtp – Email Service Provider For WordPress plugin for WordPress. It is a Stored XSS via the plugin's sender settings in all versions up to 1.03, exploitable by authenticated attackers with administrator-level permissions and above. The vulnerability affects mult...

CVE-2025-14887 twinklesmtp – Email Service Provider For WordPress <= 1.03 - Authenticated (Administrator+) Stored Cross-Site Scripting via Sender Settings

The twinklesmtp – Email Service Provider For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's sender settings in all versions up to, and including, 1.03 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

Columbia Weather Systems MicroServer 安全漏洞

Columbia Weather Systems MicroServer is a weather data server from Columbia Weather Systems, USA. A security vulnerability exists in Columbia Weather Systems MicroServer that originates when portions of the system firmware are copied to an unencrypted external SD card, potentially resulting in th...

phpMyFAQ XSS Vulnerability (GHSA-jv8r-hv7q-p6vc)

phpMyFAQ is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:phpmyfaq:phpmyfaq"...

PT-2026-1821

Name of the Vulnerable Software and Affected Versions Veeam affected versions not specified Description The software contains a flaw that enables a Backup Administrator to execute code remotely as the postgres user. This is achieved by submitting a crafted password parameter. The issue allows for...

PT-2026-1598

Name of the Vulnerable Software and Affected Versions Page Keys versions prior to 1.3.4 Description The Page Keys plugin for WordPress is susceptible to Stored Cross-Site Scripting through the page key parameter. Insufficient input sanitization and output escaping allow authenticated attackers wi...

PT-2026-1570

Name of the Vulnerable Software and Affected Versions twinklesmtp – Email Service Provider For WordPress plugin versions up to and including 1.03 Description The twinklesmtp – Email Service Provider For WordPress plugin for WordPress is susceptible to Stored Cross-Site Scripting through the...

Tarkov Data Manager 安全漏洞

Tarkov Data Manager is a database management tool from The Hideout open source. A security vulnerability exists in versions of Tarkov Data Manager prior to 02/01/2025, which stems from an authentication bypass at the login endpoint that could result in an unauthenticated user gaining administrato...

PT-2026-1612

Name of the Vulnerable Software and Affected Versions The Email Customizer for WooCommerce versions up to and including 2.6.7 Description The Email Customizer for WooCommerce plugin for WordPress is susceptible to Stored Cross-Site Scripting through email template content. Insufficient input...

WordPress Email Customizer for WooCommerce | Drag and Drop Email Templates Builder plugin <= 2.6.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Email Template Content vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting via Email Template Content vulnerability discovered by fallenofalbaz in WordPress Plugin Email Customizer for WooCommerce versions = 2.6.7...

WordPress Multi-column Tag Map plugin <= 17.0.39 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'mctm_css_conditional' Parameter vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting via 'mctmcssconditional' Parameter vulnerability discovered by Bhayanak Atma in WordPress Plugin Multi-column Tag Map versions = 17.0.39...

WordPress Page Keys plugin <= 1.3.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'page_key' Parameter vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting via 'pagekey' Parameter vulnerability discovered by Bhumividh Treloges in WordPress Plugin Page Keys versions = 1.3.3...

WordPress Simple User Meta Editor plugin <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via User Meta Value Field vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting via User Meta Value Field vulnerability discovered by Bhumividh Treloges in WordPress Plugin Simple User Meta Editor versions = 1.0.0...

WordPress twinklesmtp - Email Service Provider For WordPress plugin <= 1.03 - Authenticated (Administrator+) Stored Cross-Site Scripting via Sender Settings vulnerability

WordPress twinklesmtp - Email Service Provider For WordPress plugin = 1.03 - Authenticated Administrator+ Stored Cross-Site Scripting via Sender Settings vulnerability discovered by Bhumividh Treloges in WordPress Plugin twinklesmtp versions = 1.03...