vulnerability-research

vulnerability-...

WordPress EduKart Pro plugin <= 1.0.3 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Alyudin Nafiie in WordPress Plugin EduKart Pro versions = 1.0.3...

MAL-2025-190971 Malicious code in itobuz-angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4fcdbc14cc1282398d0aa27b0ada7027ef96a6c2b95c3fcb0fefb926cbb45a0e The package itobuz-angular was found to contain malicious code. Source: ghsa-malware 7bb8d54de22fc55a5690d5bf3b51d9847a98a5dcf0d9836311c615cd6a30b2df...

WordPress PropertyHive plugin <= 2.1.12 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by daroo in WordPress Plugin PropertyHive versions = 2.1.12...

WordPress Realty Portal plugin <= 0.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Options Update vulnerability discovered by kr0d in WordPress Plugin Realty Portal versions = 0.4.1...

WordPress Groundhogg plugin <= 4.2.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by zaim in WordPress Plugin Groundhogg versions = 4.2.6...

WordPress Islamic Phrases plugin <= 2.12.2015 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zakaria in WordPress Plugin Islamic Phrases versions = 2.12.2015...

WordPress SupportCandy plugin <= 3.4.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by daroo in WordPress Plugin SupportCandy versions = 3.4.1...

WordPress Eagle Booking plugin <= 1.3.4.3 - Settings Change vulnerability

Settings Change vulnerability discovered by Bonds in WordPress Plugin Eagle Booking versions = 1.3.4.3...

WordPress WP Dropzone plugin <= 1.1.0 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by kr0d in WordPress Plugin WP Dropzone versions = 1.1.0...

WordPress VK All in One Expansion Unit plugin <= 9.112.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by r0skie in WordPress Plugin VK All in One Expansion Unit versions = 9.112.1...

WordPress RestroPress plugin <= 3.2.3.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by daroo in WordPress Plugin RestroPress versions = 3.2.3.5...

WordPress Contact Form Email plugin <= 1.3.58 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by daroo in WordPress Plugin Contact Form Email versions = 1.3.58...

WordPress Select Core plugin < 2.6 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Select Core versions 2.6...

GHSA-Q428-6V73-FC4Q sudo-rs doesn't record authenticating user properly in timestamp

Summary When Defaults targetpw or Defaults rootpw is enabled, the password of the target account or root account instead of the invoking user is used for authentication. sudo-rs prior to 0.2.10 incorrectly recorded the invoking user’s UID instead of the authenticated-as user's UID in the...

WordPress WP Count Down Timer plugin <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zakaria in WordPress Plugin WP Count Down Timer versions = 1.0.1...

WordPress WP移行専用プラグイン for CPI plugin <= 1.0.2 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by kr0d in WordPress Plugin WP移行専用プラグイン for CPI versions = 1.0.2...

WordPress Groups plugin <= 3.7.0 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by shark3y in WordPress Plugin Groups versions = 3.7.0...

WordPress WP Delicious plugin <= 1.9.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by theviper17 in WordPress Plugin WP Delicious versions = 1.9.1...

WordPress Ultimate FAQ plugin <= 2.4.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by daroo in WordPress Plugin Ultimate FAQ versions = 2.4.3...