CVE-2026-71243 backmeup (npm) - OS Command Injection via Backup Option Values

The backmeup npm package assembles shell command strings by directly concatenating its option values name, source, destination, filter - e.g. cmd = "mkdir -p " + path.joininfo.destination, info.name + "; " - and executes the resulting string through a shell via ssh2-exec locally via childprocess,...

CVE-2024-13653

The ZoxPress - The All-In-One WordPress News Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'backupoptions' function in all versions up to, and including, 2.12.0. This makes it possible fo...

PT-2025-6436 · Zoxpress +1 · Zoxpress +1

Name of the Vulnerable Software and Affected Versions: The ZoxPress - The All-In-One WordPress News Theme versions up to, and including, 2.12.0 Description: The issue allows unauthorized modification of data, leading to privilege escalation due to a missing capability check on the backup options...

WordPress plugin Zox News 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exist...

PT-2025-6170 · WordPress · Zox News - Professional Wordpress News & Magazine Theme

Name of the Vulnerable Software and Affected Versions: Zox News - Professional WordPress News & Magazine Theme plugin for WordPress versions up to and including 3.17.0 Description: The vulnerability can lead to privilege escalation and denial of service conditions due to missing capability checks...

CVE-2024-11936

The Zox News theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'backupoptions' and 'restoreoptions' function in all versions up to, and including, 3.16.0. This makes it possible for authenticated...