WordPress Featured Posts Grid plugin <= 1.7 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Featured Posts Grid versions = 1.7...

WordPress REST API TO MiniProgram plugin <= 5.1.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Skalucy in WordPress Plugin REST API TO MiniProgram versions = 5.1.2...

WordPress amoCRM WebForm plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by theviper17 in WordPress Plugin amoCRM WebForm versions = 1.1...

WordPress ZipList Recipe plugin <= 3.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nguyen Thi Huyen Trang - Skalucy in WordPress Plugin ZipList Recipe versions = 3.1...

WordPress Social Snap plugin < 1.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Krugov Artyom in WordPress Plugin Social Snap versions 1.4...

WordPress Javo Core plugin <= 3.0.0.080 - Unauthenticated Privilege Escalation in ajax_signup vulnerability

Unauthenticated Privilege Escalation in ajaxsignup vulnerability discovered by Tonn in WordPress Plugin Javo Core versions = 3.0.0.080...

WordPress Ultimate Video Player plugin <= 10.0 - Unauthenticated Arbitrary File Download vulnerability

Unauthenticated Arbitrary File Download vulnerability discovered by Tonn in WordPress Plugin Ultimate Video Player versions = 10.0...

WordPress WPCOM Member plugin <= 1.7.5 - Authentication Bypass via 'user_phone' vulnerability

Authentication Bypass via 'userphone' vulnerability discovered by wesley wcraft in WordPress Plugin WPCOM Member versions = 1.7.5...

WordPress Moving Media Library plugin <= 1.22 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Deletion vulnerability

Authenticated Administrator+ Directory Traversal to Arbitrary File Deletion vulnerability discovered by omstaendlig in WordPress Plugin Moving Media Library versions = 1.22...

Precurio Intranet Portal 4.4 Remote Command Execution

Precurio Intranet Portal version 4.4 suffers from a remote command execution vulnerability. Exploit Title: Precurio Intranet Portal 4.4 - Remote Command Execution Discovered by: Ahmet Ümit BAYRAM Discovered Date: 05.03.2024 Vendor Homepage: https://www.precurio.com Software Link:...

Ubuntu: Security Advisory (USN-7333-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress DesignThemes Core Features plugin <= 4.7 - Missing Authorization to Unauthenticated Arbitrary File Read via dt_process_imported_file vulnerability

Missing Authorization to Unauthenticated Arbitrary File Read via dtprocessimportedfile vulnerability discovered by Tonn in WordPress Plugin DesignThemes Core Features versions = 4.7...

WordPress SpotBot plugin <= 0.1.8 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Hassan Khan Yusufzai - Splint3r7 in WordPress Plugin SpotBot versions = 0.1.8...

WordPress Limit Bio plugin <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability

Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability discovered by Bob Matyas in WordPress Plugin Limit Bio versions = 1.0...

CVE-2025-25428

CVE-2025-25428 affects the TRENDnet TEW-929DRU router (firmware 1.0.0.10). The vulnerability is a hardcoded password stored in /etc/shadow, which allows an attacker to log in as root. The NVD and related records rate the impact as high (CVSS 3.1: AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected fir...

WordPress Cardealer theme <= 1.6.4 - Cross-Site Request Forgery to User Update via update_user_profile vulnerability

Cross-Site Request Forgery to User Update via updateuserprofile vulnerability discovered by István Márton in WordPress Theme Car Dealer versions = 1.6.4...

WordPress Car Dealer theme <= 1.6.3 - Authenticated (Subscriber+) Arbitrary File Deletion and Read vulnerability

Authenticated Subscriber+ Arbitrary File Deletion and Read vulnerability discovered by Tonn in WordPress Theme Car Dealer versions = 1.6.3...

CVE-2022-49636

In the Linux kernel, the following vulnerability has been resolved: vlan: fix memory leak in vlannewlink Blamed commit added back a bug I fixed in commit 9bbd917e0bec "vlan: fix memory leak in vlandevsetegresspriority" If a memory allocation fails in vlanchangelink after other allocations...

WordPress Classified Listing – Classified ads & Business Directory Plugin plugin <= 4.0.4 - Unauthenticated Settings Exposure vulnerability

Unauthenticated Settings Exposure vulnerability discovered by wesley wcraft in WordPress Plugin Classified Listing versions = 4.0.4...

WordPress WP About Author plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by theviper17 in WordPress Plugin WP About Author versions = 1.5...