PT-2025-10965

Name of the Vulnerable Software and Affected Versions: Lava Ajax Search versions 1.1.9 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored XSS attacks. This means that an attacker can inject malicious scripts into t...

WordPress plugin Lava Ajax Search has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A cross-site scripting...

CVE-2025-28937: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in lavacode Lava Ajax Search lava-ajax-search allows Stored XSS.This issue affects Lava Ajax Search: from n/a through = 1.1.9...

CVE-2025-25908

A stored cross-site scripting XSS vulnerability in tianti v2.3 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the coverImageURL parameter at /article/ajax/save...

Tianti Cross-Site Request Forgery Vulnerability

tianti tianti is a JAVA lightweight CMS solution by jeffry personal developer. A security vulnerability exists in tianti v2.3, which stems from a cross-site request forgery vulnerability in the /user/ajax/save component that could lead to the execution of arbitrary operations...

CVE-2025-25907

tianti v2.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /user/ajax/save. This vulnerability allows attackers to execute arbitrary operations via a crafted GET or POST request...

PT-2025-10639

Name of the Vulnerable Software and Affected Versions tianti version 2.3 Description The issue allows attackers to execute arbitrary operations via a crafted GET or POST request to the /user/ajax/save API endpoint. This is due to a Cross-Site Request Forgery CSRF vulnerability. Recommendations Fo...

CVE-2025-25907: Cross-Site Request Forgery (CSRF)

tianti v2.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /user/ajax/save. This vulnerability allows attackers to execute arbitrary operations via a crafted GET or POST request...

PT-2025-10641

Name of the Vulnerable Software and Affected Versions tianti version 2.3 Description A Cross-Site Request Forgery CSRF issue was discovered in the /user/ajax/upd/status component, allowing attackers to execute arbitrary operations via a crafted GET or POST request. Recommendations For version 2.3...

CVE-2025-27910

tianti v2.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /user/ajax/upd/status. This vulnerability allows attackers to execute arbitrary operations via a crafted GET or POST request...

CVE-2025-25908: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in tianti v2.3 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the coverImageURL parameter at /article/ajax/save...

CVE-2025-27910: Cross-Site Request Forgery (CSRF)

tianti v2.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /user/ajax/upd/status. This vulnerability allows attackers to execute arbitrary operations via a crafted GET or POST request...

CVE-2024-12610

The School Management System for Wordpress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'mjsmgtremovefeetype' and 'mjsmgtremovecategorynew' AJAX actions in all versions up to, and including, 93.0.0. This makes it possible for...

CVE-2025-1383

The Podlove Podcast Publisher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.2. This is due to missing or incorrect nonce validation on the ajaxtranscriptdelete function. This makes it possible for unauthenticated attackers to delete...

CVE-2025-1325

The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to arbitrary shortcode execution due to a missing capability check on the 'rclpreviewpost' AJAX endpoint in all versions up to, and including, 16.26.10. This makes it possible for authenticated attackers, wi...

CVE-2025-1325

CVE-2025-1325 affects the WordPress plugin WP-Recall – Registration, Profile, Commerce & More . The vulnerability arises from a missing capability check on the AJAX endpoint rcl_preview_post , enabling an authenticated attacker with at least Subscriber-level access to execute arbitrary shortcodes...

WordPress Javo Core plugin <= 3.0.0.080 - Unauthenticated Privilege Escalation in ajax_signup vulnerability

Unauthenticated Privilege Escalation in ajaxsignup vulnerability discovered by Tonn in WordPress Plugin Javo Core versions = 3.0.0.080...

PT-2025-10437

Name of the Vulnerable Software and Affected Versions Post Lockdown plugin for WordPress versions prior to 4.1 Description The issue allows authenticated attackers with Subscriber-level access and above to extract data from password-protected, private, or draft posts they should not have access t...

CVE-2024-13810

The Zass - WooCommerce Theme for Handmade Artists and Artisans theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'zassimportzass' AJAX actions in all versions up to, and including, 3.9.9.10. This makes it possible for authenticated attackers, with...

CVE-2024-12610

The School Management System for Wordpress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'mjsmgtremovefeetype' and 'mjsmgtremovecategorynew' AJAX actions in all versions up to, and including, 93.0.0. This makes it possible for...