CVE-2025-58255

Cross-Site Request Forgery CSRF vulnerability in yonisink Custom Post Type Images custom-post-types-image allows Code Injection.This issue affects Custom Post Type Images: from n/a through = 0.5...

CVE-2025-57928

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Strategy11 Team AWP Classifieds another-wordpress-classifieds-plugin allows Code Injection.This issue affects AWP Classifieds: from n/a through = 4.4.3...

CVE-2025-57928 WordPress AWP Classifieds plugin <= 4.4.3 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Strategy11 Team AWP Classifieds another-wordpress-classifieds-plugin allows Code Injection.This issue affects AWP Classifieds: from n/a through = 4.4.3...

CVE-2025-57928

CVE-2025-57928 affects AWP Classifieds (WordPress) up to version 4.3.5, enabling unauthenticated arbitrary shortcode execution due to improper handling of script/HTML tags. The Wordfence entry lists this as an unauthenticated vulnerability in AWP Classifieds with a CVSS v3.1 base score of 5.3 (Me...

CVE-2025-58255

CVE-2025-58255 describes a Cross-Site Request Forgery (CSRF) in the WordPress plugin Custom Post Type Images that allegedly enables Code Injection . The entry states affected versions are from n/a through 0.5 . Public metrics show a high-severity impact (CVSS 3.1/3.1: base score 9.6, CRITICAL, wi...

CVE-2025-58255 WordPress Custom Post Type Images Plugin <= 0.5 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in yonisink Custom Post Type Images custom-post-types-image allows Code Injection.This issue affects Custom Post Type Images: from n/a through = 0.5...

CVE-2025-58255 WordPress Custom Post Type Images Plugin <= 0.5 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in yonisink Custom Post Type Images custom-post-types-image allows Code Injection.This issue affects Custom Post Type Images: from n/a through = 0.5...

CVE-2025-58673

CVE-2025-58673 corresponds to a vulnerability in WP User Frontend where an authenticated (Subscriber+) attacker can perform Arbitrary Shortcode Execution through the plugin’s shortcode handling. The Wordfence vulnerability listing confirms the affected software as WP User Frontend (

CVE-2025-58673 WordPress WP User Frontend Plugin <= 4.1.12 - Content Injection Vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in weDevs WP User Frontend wp-user-frontend allows Code Injection.This issue affects WP User Frontend: from n/a through = 4.1.12...

CVE-2025-57439

Creacast Creabox Manager 4.4.4 contains a critical Remote Code Execution vulnerability accessible via the edit.php endpoint. An authenticated attacker can inject arbitrary Lua code into the configuration, which is then executed on the server. This allows full system compromise, including reverse...

CVE-2025-57439

Creacast Creabox Manager 4.4.4 contains a critical Remote Code Execution vulnerability accessible via the edit.php endpoint. An authenticated attacker can inject arbitrary Lua code into the configuration, which is then executed on the server. This allows full system compromise, including reverse...

CVE-2025-10784 Campcodes Online Learning Management System edit_subject.php sql injection

A security vulnerability has been detected in Campcodes Online Learning Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/editsubject.php. The manipulation of the argument subjectcode leads to sql injection. It is possible to initiate the attack...

PT-2025-38779

Name of the Vulnerable Software and Affected Versions AWP Classifieds versions through 4.3.5 Description A flaw exists in Strategy11 Team AWP Classifieds that allows code injection due to improper neutralization of script-related HTML tags on a web page. This is a Basic Cross-Site Scripting XSS...

PT-2025-38962

Name of the Vulnerable Software and Affected Versions WP User Frontend versions through 4.1.11 Description An improper control of generation of code issue, specifically a code injection, exists in WP User Frontend. This allows for code injection. Recommendations Update WP User Frontend to a versi...

WordPress plugin Cozy Blocks 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

WordPress plugin AWP Classifieds 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

WordPress plugin WP User Frontend 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A code injectio...

WordPress plugin Custom Post Type Images 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site request...

PT-2025-38918

Name of the Vulnerable Software and Affected Versions yonisink Custom Post Type Images versions through 0.5 Description A Cross-Site Request Forgery CSRF issue exists in yonisink Custom Post Type Images that can lead to Code Injection. The issue allows for potential code execution through crafted...

HTMLy 代码注入漏洞

HTMLy is HTMLy open source set of PHP-based blogging platform. A code injection vulnerability exists in htmly 3.1.0 and earlier versions, which stems from incorrect manipulation of the parameter label in the file /htmly/admin/field/post, and could lead to a cross-site scripting attack...