WordPress plugin CozyStay 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2025-11657

Name of the Vulnerable Software and Affected Versions BoomBox Theme Extensions plugin for WordPress versions up to, and including, 1.8.0 Description The BoomBox Theme Extensions plugin for WordPress is vulnerable to privilege escalation via account takeover. This is due to the plugin not properly...

CVE-2025-2290: Missing Authorization

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Unauthenticated Post Trashing due to a missing capability check on the deleteaccessplan function and the related AJAX calls in all versions up to, and including, 8.0.1. This makes it possible for...

WordPress CozyStay theme <= 1.7.0 - Missing Authorization to Arbitrary Action Execution in ajax_handler vulnerability

Missing Authorization to Arbitrary Action Execution in ajaxhandler vulnerability discovered by Lucio Sá in WordPress Theme CozyStay versions = 1.7.0...

Xinhu RockOA 安全漏洞

Xinhu RockOA is an office OA system of China Xinhu Xinhu Company. A security vulnerability exists in Xinhu RockOA 2.6.5 and earlier versions, which originates from the inputAction.php file and the saveAjax function that allows SQL injection, which may result in the execution of arbitrary code...

CVE-2025-2199

CVE-2025-2199 describes an SQL injection vulnerability in the Innovación y Cualificación local administration plugin ajax.php. The flaw allows an attacker to inject SQL via multiple parameters (searchActionsToUpdate, searchSpecialitiesPending, searchSpecialitiesLinked, searchUsersToUpdateProfile,...

CVE-2025-2289

The Zegen - Church WordPress Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX endpoints in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to impor...

CVE-2025-0952

The Eco Nature - Environment & Ecology WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'cmsmastershideadminnotice' AJAX action in all versions up to, and including, 2.0.4. This mak...

CVE-2025-1653 Directory Listings WordPress plugin – uListing <= 2.2.0 - Authenticated (Subscriber+) Privilege Escalation

The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.2.0. This is due to the stmlistingprofileedit AJAX action not having enough restriction on the user meta that can be updated. This makes it possibl...

CVE-2025-28937

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in lavacode Lava Ajax Search lava-ajax-search allows Stored XSS.This issue affects Lava Ajax Search: from n/a through = 1.1.9...

CVE-2025-2289

The Zegen - Church WordPress Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX endpoints in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to impor...

CVE-2025-2289

The Zegen - Church WordPress Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX endpoints in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to impor...

CVE-2025-0952

CVE-2025-0952 affects the Eco Nature - Environment & Ecology WordPress Theme. A missing capability check on the cmsmasters_hide_admin_notice AJAX action in all versions up to 2.0.4 allows authenticated users with Subscriber+ access to modify options (e.g., setting hide) and potentially cause a de...

CVE-2025-2289

CVE-2025-2289 (Zegen - Church WordPress Theme) affects the WordPress theme Zegen up to version 1.1.9. The vulnerability is caused by a missing capability check on several AJAX endpoints, allowing authenticated attackers with Subscriber-level access and above to import, export, and update theme op...

CVE-2025-2289 Zegen - Church WordPress Theme <= 1.1.9 - Missing Authorization to Authenticated (Subscriber+) Theme Options Updates

The Zegen - Church WordPress Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX endpoints in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to impor...

CVE-2025-1285

The Resido - Real Estate WordPress Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the deleteapikey and saveapikey AJAX actions in all versions up to, and including, 3.6. This makes it possible for unauthenticated attackers to issue requests to...

PT-2025-11241

Name of the Vulnerable Software and Affected Versions Industrial theme for WordPress versions up to, and including, 1.7.8 Description The Industrial theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on th...

PT-2025-11236

Name of the Vulnerable Software and Affected Versions: VidoRev Extensions plugin for WordPress versions up to, and including, 2.9.9.9.9.9.5 Description: The issue is related to unauthorized access due to a missing capability check on the 'vidorev import single video' AJAX action. This allows...

PT-2025-11246

Name of the Vulnerable Software and Affected Versions: The Zegen - Church WordPress Theme versions prior to 1.1.9 Description: The issue is related to unauthorized access due to a missing capability check on several AJAX endpoints. This allows authenticated attackers with Subscriber-level access...

PT-2025-11243

Name of the Vulnerable Software and Affected Versions: The Eco Nature - Environment & Ecology WordPress Theme versions up to, and including, 2.0.4 Description: The issue allows authenticated attackers with Subscriber-level access and above to modify data, potentially leading to a denial of servic...