WordPress WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets (Google Reviews, YouTube Feed, Photo Feeds, and More) plugin <= 3.20.3 - Unauthenticated Stored Cross-Site Scripting via External Content Import vulnerability

Unauthenticated Stored Cross-Site Scripting via External Content Import vulnerability discovered by Kishan Vyas in WordPress Plugin WP Social Ninja versions = 3.20.3...

CVE-2025-13007 WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets (Google Reviews, YouTube Feed, Photo Feeds, and More) <= 3.20.3 - Unauthenticated Stored Cross-Site Scripting via External Content Import

The WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.20.3 due to insufficient input sanitization and output escaping on externally-sourced content. This makes it possible...

CVE-2025-13007

CVE-2025-13007 is a stored XSS vulnerability in the WordPress plugin WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets (versions ≤ 3.20.3). It arises from insufficient input sanitization and output escaping of externally sourced content, allowing unauthenticated attackers to in...

CVE-2025-13007 WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets (Google Reviews, YouTube Feed, Photo Feeds, and More) <= 3.20.3 - Unauthenticated Stored Cross-Site Scripting via External Content Import

The WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.20.3 due to insufficient input sanitization and output escaping on externally-sourced content. This makes it possible...

EUVD-2024-53982

Malicious code in bioql PyPI...

EUVD-2023-43888

Malicious code in bioql PyPI...

WordPress plugin Industrial 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-13810

CVE-2024-13810 affects Zass - WooCommerce Theme for WordPress (Zass theme) up to version 3.9.9.10. Networks: missing capability check on the zass_import_zass AJAX actions allows authenticated attackers with Subscriber-level access or higher to import demo content and overwrite the site. Connected...

WordPress plugin Zass 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

BIT-GITLAB-2025-1072 Allocation of Resources Without Limits or Throttling in GitLab

A Denial of Service DoS issue has been discovered in GitLab CE/EE affecting all versions starting from 7.14.1 prior to 17.3.7, 17.4 prior to 17.4.4, and 17.5 prior to 17.5.2. A denial of service could occur upon importing maliciously crafted content using the Fogbugz importer...

UBUNTU-CVE-2025-1072

A Denial of Service DoS issue has been discovered in GitLab CE/EE affecting all versions starting from 7.14.1 prior to 17.3.7, 17.4 prior to 17.4.4, and 17.5 prior to 17.5.2. A denial of service could occur upon importing maliciously crafted content using the Fogbugz importer...

CVE-2025-1072

Removed by vendor...

CVE-2024-12781 Aurum - WordPress & WooCommerce Shopping Theme <= 4.0.2 - Missing Authorization to Authenticated (Subscriber+) Demo Content Import

The Aurum - WordPress & WooCommerce Shopping Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'lab1cldemoinstallpackagecontent' function in all versions up to, and including, 4.0.2. This makes it possible for authenticated...

WordPress Aurum theme <= 4.0.2 - Missing Authorization to Authenticated (Subscriber+) Demo Content Import vulnerability

Missing Authorization to Authenticated Subscriber+ Demo Content Import vulnerability discovered by Lucio Sá in WordPress Theme Aurum versions = 4.0.2...

WordPress Spice Starter Sites plugin <= 1.2.5 - Missing Authorization to Unauthenticated Demo Content Import vulnerability

Missing Authorization to Unauthenticated Demo Content Import vulnerability discovered by Lucio Sá in WordPress Plugin Spice Starter Sites versions = 1.2.5...

CVE-2024-8430 Spice Starter Sites <= 1.2.5 - Missing Authorization to Unauthenticated Demo Content Import

The Spice Starter Sites plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the spicestartersitesimportercreater function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to import demo conte...

GHSA-9C9V-W225-V5RG Ghost vulnerable to arbitrary file read via symlinks in content import

Impact A vulnerability in Ghost allows authenticated users to upload files which are symlinks. This can be exploited to perform an arbitrary file read of any file on the operating system. Site administrators can check for exploitation of this issue by looking for unknown symlinks within Ghost's...

Ghost vulnerable to arbitrary file read via symlinks in content import

Impact A vulnerability in Ghost allows authenticated users to upload files which are symlinks. This can be exploited to perform an arbitrary file read of any file on the operating system. Site administrators can check for exploitation of this issue by looking for unknown symlinks within Ghost's...

Tiki Wiki CMS Groupware < 18.10, 21.x < 21.8, 24.x < 24.3, 25.0 Multiple CSRF Vulnerabilities

Tiki Wiki CMS Groupware is prone to multiple cross-site request forgery CSRF vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only C...

RHEL 7 : Satellite 6.10.5 Async Bug Fix Update (Important) (RHSA-2022:1708)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1708 advisory. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to...