EUVD-2025-70783

Malicious code in disabledblackbirdz3n npm...

EUVD-2025-60965

The Fleet Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and abov...

EUVD-2025-64506

Malicious code in disabledpeafowlz3n npm...

Malicious code in precise_reptile_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57d8c07ce3a237757c323730c463cbf763c952d9f415f299033808db1a63eaa8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-12538

The Fleet Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and abov...

CVE-2025-12019

The Featured Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image metadata in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions an...

Malicious code in zul-klanting54-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4e3b8996018679861b57203818104f479e542996447519ddcd44a99c6a6159f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-12019 Featured Image <= 2.1 - Authenticated (Admin+) Stored Cross-Site Scripting

The Featured Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image metadata in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions an...

CVE-2025-12019

CVE-2025-12019 affects the WordPress Featured Image plugin (versions up to 2.1). It is a Stored XSS via image metadata, requiring an authenticated attacker with administrator+ privileges, and applies to multi-site setups or sites with unfiltered_html disabled. The Wordfence report confirms the vu...

CVE-2025-12631

CVE-2025-12631 affects the WordPress plugin Squirrels Auto Inventory (versions

CVE-2025-12538 Fleet Manager <= 2.5.1 - Authenticated (Editor+) Stored Cross-Site Scripting

The Fleet Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and abov...

CVE-2025-12632

CVE-2025-12632 affects the WordPress plugin RandomQuotr. Connected sources confirm a Stored Cross-Site Scripting vulnerability in versions

EUVD-2025-54874

Malicious code in disabled-chocolate-firefly npm...

EUVD-2025-54871

Malicious code in disabled-turquoise-wren npm...

EUVD-2025-54873

Malicious code in disabled-harlequin-baboon npm...

EUVD-2025-54872

Malicious code in disabled-lime-dormouse npm...

EUVD-2025-54875

Malicious code in disabled-azure-condor npm...

PT-2025-46281

Name of the Vulnerable Software and Affected Versions RandomQuotr versions prior to 1.0.5 Description The RandomQuotr plugin for WordPress is susceptible to Stored Cross-Site Scripting through admin settings. Insufficient input sanitization and output escaping allow authenticated attackers with...

SUSE SLED15: MozillaThunderbird / MozillaThunderbird-translations-common / etc (SUSE-SU-2025:4006-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4006-1 advisory. This update for MozillaThunderbird fixes the following issue: Mozilla Thunderbird is updated to...

PT-2025-46280

Name of the Vulnerable Software and Affected Versions Squirrels Auto Inventory plugin for WordPress versions up to and including 1.0.3 Description The software is susceptible to Stored Cross-Site Scripting through the admin settings. This is due to inadequate input sanitization and output escapin...