CVE-2025-25071

CVE-2025-25071 : CSRF to Stored XSS in the WordPress plugin Vignette Ads (versions n/a through 0.2). The vulnerability is triggered via Cross-Site Request Forgery in the plugin, with the impact being stored XSS as reported in multiple sources (WordPress/NVD, Patchstack entries). Affected product/...

WordPress plugin Vignette Ads 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site request forge...

WordPress plugin Optimate Ads 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-5910 · Unknown · Vignette Ads

Name of the Vulnerable Software and Affected Versions: Vignette Ads versions n/a through 0.2 Description: A Cross-Site Request Forgery CSRF issue in Vignette Ads allows Stored XSS. This means an attacker can trick a user into performing unintended actions on the web application, potentially leadi...

CVE-2024-52428

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Peter Ads Booster by Ads Pro free-wp-booster-by-ads-pro allows PHP Local File Inclusion.This issue affects Ads Booster by Ads Pro: from n/a through = 1.12...

CVE-2024-6431

The Media.net Ads Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and missing capability check in the 'sendMail' function in all versions up to, and including, 2.10.13. This makes it possible for authenticated attackers, with subscriber-lev...

CVE-2024-42374

BEx Web Java Runtime Export Web Service does not sufficiently validate an XML document accepted from an untrusted source. An attacker can retrieve information from the SAP ADS system and exhaust the number of XMLForm service which makes the SAP ADS rendering PDF creation unavailable. This affects...

WordPress Optimate Ads plugin <= 1.0.3 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability discovered by Abdi Pranata in WordPress Plugin Optimate Ads versions = 1.0.3...

WordPress Vignette Ads plugin <= 0.2 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin Vignette Ads versions = 0.2...

Malvertising Scam Uses Fake Google Ads to Hijack Microsoft Advertising Accounts

Cybersecurity researchers have discovered a malvertising campaign that's targeting Microsoft advertisers with bogus Google ads that aim to take them to phishing pages that are capable of harvesting their credentials. "These malicious ads, appearing on Google Search, are designed to steal the logi...

ClickFix vs. traditional download in new DarkGate campaign

During the past several months there have been numerous malware campaigns that use a technique something referred to as "ClickFix". It often consists of a fake CAPTCHA or similar traffic validation page where visitors are instructed to paste and execute code in order to proceed. We have started t...

Microsoft advertisers phished via malicious Google ads

Just days after we uncovered a campaign targeting Google Ads accounts, a similar attack has surfaced, this time aimed at Microsoft advertisers. These malicious ads, appearing on Google Search, are designed to steal the login information of users trying to access Microsoft's advertising platform...

CVE-2025-23914

Deserialization of Untrusted Data vulnerability in muzaara Muzaara Google Ads Report muzaara-adwords-optimize-dashboard allows Object Injection.This issue affects Muzaara Google Ads Report: from n/a through = 3.1...

CVE-2025-23914 WordPress Muzaara Google Ads Report Plugin <= 3.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in muzaara Muzaara Google Ads Report muzaara-adwords-optimize-dashboard allows Object Injection.This issue affects Muzaara Google Ads Report: from n/a through = 3.1...

CVE-2025-23914 WordPress Muzaara Google Ads Report Plugin <= 3.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in muzaara Muzaara Google Ads Report muzaara-adwords-optimize-dashboard allows Object Injection.This issue affects Muzaara Google Ads Report: from n/a through = 3.1...

CVE-2025-23914

CVE-2025-23914 is an unauthenticated PHP object injection (deserialization of untrusted data) affecting the WordPress plugin: Optimize Your Campaigns – Google Shopping – Google Ads – Google Adwords (Muzaara) up to version 3.1. The vulnerability has a CVSS v3.1 base score of 9.8 (CRITICAL) with ne...

WordPress plugin Muzaara Google Ads Report 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability exists i...

PT-2025-5193 · Unknown · Muzaara Google Ads Report

Name of the Vulnerable Software and Affected Versions: Muzaara Google Ads Report versions n/a through 3.1 Description: The issue is related to the deserialization of untrusted data, which allows object injection. This problem affects Muzaara Google Ads Report, enabling potential attacks through t...

A week in security (January 13 &#8211; January 19)

Last week on Malwarebytes Labs: iMessage text gets recipient to disable phishing protection so they can be phished The new rules for AI and encrypted messaging, with Mallory Knodel Lock and Code S06E01 Insurance company accused of using secret software to illegally collect and sell location data ...

WordPress Muzaara Google Ads Report Plugin <= 3.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Le Ngoc Anh in WordPress Plugin Muzaara Google Ads Report versions = 3.1...