PT-2026-25158

The GetGenie plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.2. This is due to missing validation on the id parameter in the create method of the GetGenieChat REST API endpoint. The method accepts a user-controlled post ID and, when...

WordPress Folders plugin <= 3.1.5 - Missing Authorization to Authenticated (Author+) Media Replacement vulnerability

Missing Authorization to Authenticated Author+ Media Replacement vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan - Knight Squad in WordPress Plugin Folders versions = 3.1.5...

WordPress Responsive Pricing Table plugin <= 5.1.12 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Itthidej Aramsri Boeing777 in WordPress Plugin Responsive Pricing Table versions = 5.1.12...

WordPress Crowdsignal Forms plugin <= 1.7.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Doan Dinh Van in WordPress Plugin Crowdsignal Forms versions = 1.7.2...

WordPress WP3D Model Import Viewer plugin <= 1.0.7 - Authenticated (Contributor+) Arbitrary File Upload vulnerability

Authenticated Contributor+ Arbitrary File Upload vulnerability discovered by kr0d in WordPress Plugin WP3D Model Import Viewer versions = 1.0.7...

WordPress List Attachments Shortcode plugin <= 0.4.1a - Authenticated (Author+) Stored Cross-Site Scripting via list-attachments Shortcode vulnerability

Authenticated Author+ Stored Cross-Site Scripting via list-attachments Shortcode vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin List Attachments Shortcode versions = 0.4.1a...

CVE-2025-11176

CVE-2025-11176 affects the WordPress plugin “Quick Featured Images” (versions up to 13.7.2). The vulnerability is an Insecure Direct Object Reference (IDOR) in the qfi_set_thumbnail and qfi_delete_thumbnail AJAX actions caused by missing validation of a user-controlled key. This allows authentica...

EUVD-2013-2917

Malware in sbrugna...

EUVD-2013-2927

Malware in sbrugna...

EUVD-2022-51513

Malicious code in bioql PyPI...

EUVD-2022-51514

Malicious code in bioql PyPI...

EUVD-2022-51524

Malicious code in bioql PyPI...

EUVD-2022-51523

Malicious code in bioql PyPI...

EUVD-2023-47908

Malicious code in bioql PyPI...

EUVD-2022-6604

Malicious code in bioql PyPI...

EUVD-2022-51517

Malicious code in bioql PyPI...

EUVD-2022-51511

Malicious code in bioql PyPI...

WordPress Core <= 6.8.2 is vulnerable to Cross Site Scripting (XSS)

Software WordPress Type WordPress Core Vulnerable versions = 6.8.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2025-58674 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 5699e05fdc3a Credits savphill Required privilege Author...

WordPress Templately Plugin <= 3.2.7 - Sensitive Data Exposure Vulnerability

Sensitive Data Exposure Vulnerability discovered by ch4r0n Patchstack Alliance in WordPress Plugin Templately versions = 3.2.7...

WordPress Pixabay Images plugin <= 3.4 - Authenticated (Author+) Arbitrary File Upload vulnerability

Authenticated Author+ Arbitrary File Upload vulnerability discovered by siavashvafshar in WordPress Plugin Pixabay Images versions = 3.4...