WordPress Pixabay Images plugin <= 3.4 - Authenticated (Author+) Arbitrary File Upload vulnerability

Authenticated Author+ Arbitrary File Upload vulnerability discovered by siavashvafshar in WordPress Plugin Pixabay Images versions = 3.4...

WordPress ZotPress plugin <= 7.3.15 - Authenticated (Author+) Stored Cross-Site Scripting via 'nickname' vulnerability

Authenticated Author+ Stored Cross-Site Scripting via 'nickname' vulnerability discovered by mohamed hamadou ZoeniX in WordPress Plugin Zotpress versions = 7.3.15...

CVE-2025-4666

The Zotpress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘nickname’ parameter in all versions up to, and including, 7.3.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and...

CVE-2025-4666

CVE-2025-4666 (Zotpress for WordPress) : Stored Cross-Site Scripting via the nickname parameter affects Zotpress versions up to 7.3.15. Reported as exploitable by authenticated attackers with Author-level access and above. Root cause: insufficient input sanitization/output escaping. Impact: scrip...

CVE-2025-28950

Cross-Site Request Forgery CSRF vulnerability in David Shabtai Post Author post-author allows Stored XSS.This issue affects Post Author: from n/a through = 1.1.1...

CVE-2025-28950

Cross-Site Request Forgery CSRF vulnerability in David Shabtai Post Author post-author allows Stored XSS.This issue affects Post Author: from n/a through = 1.1.1...

CVE-2025-28950 WordPress Post Author plugin <= 1.1.1 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in David Shabtai Post Author post-author allows Stored XSS.This issue affects Post Author: from n/a through = 1.1.1...

CVE-2025-28950

CVE-2025-28950: The WordPress plugin Post Author (David Shabtai) is affected by a CSRF vulnerability that can lead to Stored XSS. The vulnerability is reported for Post Author versions up to 1.1.1 (no details on patch status are provided in the connected documents). Public sources in the Connecte...

CVE-2025-28950 WordPress Post Author plugin <= 1.1.1 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in David Shabtai Post Author post-author allows Stored XSS.This issue affects Post Author: from n/a through = 1.1.1...

WordPress plugin Post Author 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. Cross-site request forgery...

PT-2025-24123 · Unknown · Post Author

Name of the Vulnerable Software and Affected Versions: Post Author versions n/a through 1.1.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application, and also...

WordPress Post Author plugin <= 1.1.1 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Thi Huyen Trang - Skalucy in WordPress Plugin Post Author versions = 1.1.1...

WordPress Category Icon plugin <= 1.0.3 - XML External Entity (XXE) vulnerability

XML External Entity XXE vulnerability discovered by mcdruid in WordPress Plugin Category Icon versions = 1.0.3...

CVE-2025-4963

The WP Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.0.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, t...

A new author has appeared

Welcome to this week's edition of the Threat Source newsletter. In the words of Game Changer host Sam Reich, "And your host, me! I've been here the whole time!" Okay, maybe it's not the whole time, but for the past three months, I've been settling into my role here at Cisco Talos. Editing blogs,...

Campcodes Online Hospital Management System 1.0 - SQL Injection

Exploit Title: Campcodes Online Hospital Management System 1.0 - SQL Injection Google Dork: N/A Exploit Author: Carine Constantino Vendor Homepage: https://www.campcodes.com Software Link: https://www.campcodes.com/projects/online-hospital-management-system-using-php-and-mysql/ Version: 1.0 Teste...

CVE-2025-5117

CVE-2025-5117 describes a privilege-escalation in the WordPress plugin “Property” (Real Estate Directory Listing). The root cause is a missing capability check on the property_package_user_role metadata used when creating a package post, enabling an authenticated user with Author+ privileges to e...

CVE-2025-22804

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Paul Bearne Author Avatars List/Block author-avatars allows Stored XSS.This issue affects Author Avatars List/Block: from n/a through = 2.1.23...

CVE-2024-9373

The Elemenda plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to...

CVE-2024-9366

The Easy Menu Manager | WPZest plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level acces...