CVE-2025-13139

The SurveyJS: Drag & Drop WordPress Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12.20. This is due to missing nonce validation on the SurveyJSAddSurvey AJAX action. This makes it possible for unauthenticated attackers to...

CVE-2025-13139 SurveyJS: Drag & Drop WordPress Form Builder <= 2.5.2 - Cross-Site Request Forgery to Survey Creation

The SurveyJS: Drag & Drop WordPress Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.2. This is due to missing nonce validation on the SurveyJSAddSurvey AJAX action. This makes it possible for unauthenticated attackers to crea...

CVE-2026-0687

Summary of CVE-2026-0687 (Meta-box GalleryMeta, WordPress) : The Meta-box GalleryMeta plugin is vulnerable to unauthorized data modification due to a missing capability check on the mb_gallery custom post type, affecting all versions up to and including 3.0.1. This allows authenticated attackers ...

CVE-2026-1103

CVE-2026-1103 affects the WordPress AIKTP plugin up to version 5.0.04. The vulnerability arises from missing authorization checks on the /aiktp/getToken REST endpoint, which uses verify_user_logged_in (only confirming login) and does not verify administrative capabilities. As a result, authentica...

CVE-2026-24642

creationtimestamp| type| source ---|---|--- 2026-01-24 07:19:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3md5ofgw4b72t...

CVE-2026-24649

creationtimestamp| type| source ---|---|--- 2026-01-24 07:04:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3md5nlrexbv2i...

CVE-2025-13952

creationtimestamp| type| source ---|---|--- 2026-01-24 03:49:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3md5cnwvpai2m 2026-01-26 17:08:42+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mddqbjzcsc2g 2026-01-26 17:09:03+00:00| seen|...

CVE-2026-24402

creationtimestamp| type| source ---|---|--- 2026-01-24 03:05:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3md5aatfim52h...

CVE-2026-24405

creationtimestamp| type| source ---|---|--- 2026-01-24 01:21:14+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3md52fi6pzp2a 2026-01-24 03:31:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3md5bnkbwzn2m...

PT-2026-4599

The SurveyJS: Drag & Drop WordPress Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12.20. This is due to missing nonce validation on the SurveyJS AddSurvey AJAX action. This makes it possible for unauthenticated attackers to...

CVE-2026-24572

creationtimestamp| type| source ---|---|--- 2026-01-23 23:57:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3md4vpfmtkv2m 2026-01-24 00:16:06+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3md4wqzvwfn27...

CVE-2025-70458

creationtimestamp| type| source ---|---|--- 2026-01-23 23:41:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3md4usqmo7f2n...

GHSA-RRQ5-R9H5-PC7C

creationtimestamp| type| source ---|---|--- 2026-01-23 23:21:31+00:00| seen| Telegram/6N4H89HKlQ25dlcUXQ6StZ2HC6hTVGf9cPWKhwEg02VLsDU...

CVE-2025-70458

A DOM-based Cross-Site Scripting XSS vulnerability exists in the DomainCheckerApp class within domain/script.js of Sourcecodester Domain Availability Checker v1.0. The vulnerability occurs because the application improperly handles user-supplied data in the createResultElement method by using the...

CVE-2025-70390

creationtimestamp| type| source ---|---|--- 2026-01-23 22:15:21+00:00| seen| https://gist.github.com/syrex1013/4e48d04398339d05a77591dffec8a7e0...

CVE-2025-4620

creationtimestamp| type| source ---|---|--- 2026-01-23 21:26:08+00:00| seen| Telegram/BkMDNWJ5uBM3N87Jr673mIEkhOQ-NJ1VUOOYlPLpwywU5T0...

CVE-2025-67231

creationtimestamp| type| source ---|---|--- 2026-01-23 20:20:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3md4jlxk6pq2r...

CVE-2025-67229

creationtimestamp| type| source ---|---|--- 2026-01-23 19:54:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3md4i4nb35n2i 2026-01-23 20:00:30+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3md4ihy4ywt2h 2026-01-23 20:00:51+00:00| seen|...

GHSA-W7RQ-FGX4-4XCM LavaLite CMS affected by a stored cross-site scripting vulnerability

LavaLite CMS versions up to and including 10.1.0 contain a stored cross-site scripting vulnerability in the package creation and search functionality. Authenticated users can supply crafted HTML or JavaScript in the package Name or Description fields that is stored and later rendered without prop...

CVE-2026-22991

creationtimestamp| type| source ---|---|--- 2026-01-23 18:03:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3md4bwvpxzj2c 2026-03-19 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/ 2026-04-02 17:00:00+00:00| seen|...