WordPress plugin WPC Smart Quick View for WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...

PT-2025-42672

Name of the Vulnerable Software and Affected Versions Async JavaScript plugin for WordPress versions prior to 2.19.07.14 Description The software is susceptible to Stored Cross-Site Scripting due to missing authorization checks on the aj steps AJAX action and insufficient sanitization of settings...

The vulnerability of the /custom-fields/ajax module of the Custom Fields component in the FreeScout support service management system allows a intruder to gain unauthorized access to protected information.

The vulnerability of the /custom-fields/ajax module of the Custom Fields component in the FreeScout support service management system is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to...

The vulnerability of the /kanban/ajax component in the Kanban module of the Support Service Management system of FreeScout allows a intruder to gain unauthorized access to protected information.

The vulnerability of the /kanban/ajax component in the Kanban module of the Support Service Management system of FreeScout is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected...

The vulnerability in the /conversation/ajax scenario of the FreeScout support service allows a hacker to execute arbitrary code.

The vulnerability of the /conversation/ajax scenario in the FreeScout support service management system is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...

The vulnerability in the /chat/ajax scenario of the FreeScout support service management system allows a hacker to execute arbitrary code.

The vulnerability of the /chat/ajax endpoint in the FreeScout support service management system is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...

CVE-2025-10849

The Felan Framework plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'processpluginactions' function called via an AJAX action in versions up to, and including, 1.1.4. This makes it possible for unauthenticated attackers to activate ...

CVE-2025-11176

The Quick Featured Images plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 13.7.2 via the qfisetthumbnail and qfideletethumbnail AJAX actions due to missing validation on a user controlled key. This makes it possible for authenticated...

PT-2025-42428

Name of the Vulnerable Software and Affected Versions Felan Framework versions up to and including 1.1.4 Description The Felan Framework plugin for WordPress has an authentication issue due to hardcoded passwords in the fb ajax login or register and google ajax login or register functions. This...

PT-2025-42427

Name of the Vulnerable Software and Affected Versions Felan Framework plugin for WordPress versions up to and including 1.1.4 Description The Felan Framework plugin for WordPress is susceptible to unauthorized data modification. This is due to a missing capability check within the process plugin...

PT-2025-42520

Name of the Vulnerable Software and Affected Versions LibreNMS versions 25.8.0 through 25.10.0 Description LibreNMS contains a flaw in the Alerts Alert Rules page where the alert rule name is not properly sanitized. This allows for the injection of HTML code, potentially leading to Cross-Site...

CVE-2025-10849: Missing Authorization

The Felan Framework plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'processpluginactions' function called via an AJAX action in versions up to, and including, 1.1.4. This makes it possible for unauthenticated attackers to activate ...

CVE-2025-10313

The Find And Replace content for WordPress plugin for WordPress is vulnerable to unauthorized Stored Cross-Site Scripting and Arbitrary Content Replacement due to a missing capability check on the faradminajaxfun function in all versions up to, and including, 1.1. This makes it possible for...

CVE-2025-10299

The WPBifröst – Instant Passwordless Temporary Login Links plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the ctlcreatelink AJAX action in all versions up to, and including, 1.0.7. This makes it possible for authenticated attackers, with...

CVE-2025-10313 Find And Replace content for WordPress <= 1.1 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting

The Find And Replace content for WordPress plugin for WordPress is vulnerable to unauthorized Stored Cross-Site Scripting and Arbitrary Content Replacement due to a missing capability check on the faradminajaxfun function in all versions up to, and including, 1.1. This makes it possible for...

CVE-2025-10303

CVE-2025-10303 affects the WordPress Library Management System plugin. The root cause is a missing capability check in owt7_library_management_ajax_handler(), affecting all versions up to 3.1, enabling authenticated users with Subscriber-level access and above to modify various plugin settings. W...

CVE-2025-11176 Quick Featured Images <= 13.7.2 - Insecure Direct Object Reference to Image Manipulation

The Quick Featured Images plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 13.7.2 via the qfisetthumbnail and qfideletethumbnail AJAX actions due to missing validation on a user controlled key. This makes it possible for authenticated...

CVE-2025-11176

CVE-2025-11176 affects the WordPress plugin “Quick Featured Images” (versions up to 13.7.2). The vulnerability is an Insecure Direct Object Reference (IDOR) in the qfi_set_thumbnail and qfi_delete_thumbnail AJAX actions caused by missing validation of a user-controlled key. This allows authentica...

EUVD-2025-34513

The Quick Featured Images plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 13.7.2 via the qfisetthumbnail and qfideletethumbnail AJAX actions due to missing validation on a user controlled key. This makes it possible for authenticated...

PT-2025-42295

Name of the Vulnerable Software and Affected Versions Library Management System plugin for WordPress versions prior to 3.2 Description The Library Management System plugin for WordPress is susceptible to unauthorized data modification. This is due to a missing capability check within the owt7...