CVE-2025-13977 Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple attack vectors in all versions up to, and including, 6.5.3. This is due to insufficient input sanitization and output escaping in the Event...

EUVD-2025-203868

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple attack vectors in all versions up to, and including, 6.5.3. This is due to insufficient input sanitization and output escaping in the Event...

CVE-2025-67751

ChurchCRM is an open-source church management system. Prior to version 6.5.0, a SQL injection vulnerability exists in the EventEditor.php file. When creating a new event and selecting an event type, the ENtyid POST parameter is not sanitized. This allows an authenticated user with event managemen...

HTTP Client Manager - Less critical - Information disclosure - SA-CONTRIB-2025-126

Http Client Manager introduces a new Guzzle based plugin which allows you to manage HTTP clients using Guzzle Service Descriptions via YAML, JSON or PHP files, in a simple and efficient way. The modules allows administrators to configure HTTP requests as part of Event Condition Action ECA...

PT-2025-51930

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 6.5.3 Description ChurchCRM is an open-source church management system. A SQL injection flaw exists in the Event Attendee Editor. This allows authenticated users to execute arbitrary SQL commands, potentially leadin...

ChurchCRM SQL注入漏洞

ChurchCRM is an open source church management system. ChurchCRM suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in the event participant editor. An attacker can exploit the vulnerability to cause a full database disclosure and...

PT-2025-51804

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple attack vectors in all versions up to, and including, 6.5.3. This is due to insufficient input sanitization and output escaping in the Event...

WordPress plugin Essential Addons for Elementor 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2025-40349

creationtimestamp| type| source ---|---|--- 2025-12-16 14:37:27+00:00| seen| https://gist.github.com/Darkcrai86/7aba91f5b4e18310ee79bf459f484358 2026-04-02 17:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0397/ 2026-04-07 18:00:00+00:00| seen|...

GHSA-565G-HWWR-4PP3

creationtimestamp| type| source ---|---|--- 2025-12-16 13:41:13+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115729529089646381 2026-01-02 18:47:00+00:00| published-proof-of-concept| Telegram/909Vqfy1t-GN-jmnJRhonTHruzsnwKWBWvcbC9dRm7P3pmc...

CVE-2025-64630

creationtimestamp| type| source ---|---|--- 2025-12-16 09:47:23+00:00| seen| https://gist.github.com/Darkcrai86/274f70ec4907d9f85b5221d601077ee5...

CVE-2025-68066

creationtimestamp| type| source ---|---|--- 2025-12-16 09:26:30+00:00| seen| https://gist.github.com/Darkcrai86/51faefb4367da430969ae3d38f16eaee...

CVE-2025-67722

creationtimestamp| type| source ---|---|--- 2025-12-16 08:02:48+00:00| seen| https://gist.github.com/Darkcrai86/4a431d0bf61ea9d21d19c093066d89eb...

CVE-2025-67736

creationtimestamp| type| source ---|---|--- 2025-12-16 07:44:09+00:00| seen| https://gist.github.com/Darkcrai86/eec9ae5d886ef54e3a0260ebc010b82a 2025-12-16 08:02:15+00:00| seen| https://gist.github.com/Darkcrai86/198164d7e69dfb12d84bf6acd9738029 2026-08-29 20:00:18+00:00| seen|...

CVE-2025-67751

ChurchCRM is an open-source church management system. Prior to version 6.5.0, a SQL injection vulnerability exists in the EventEditor.php file. When creating a new event and selecting an event type, the ENtyid POST parameter is not sanitized. This allows an authenticated user with event managemen...

EUVD-2025-203486

ChurchCRM is an open-source church management system. Prior to version 6.5.0, a SQL injection vulnerability exists in the EventEditor.php file. When creating a new event and selecting an event type, the ENtyid POST parameter is not sanitized. This allows an authenticated user with event managemen...

CVE-2025-67751 ChurchCRM has SQL Injection in Event Editor via `EN_tyid` Parameter caused by an Incomplete Fix

ChurchCRM is an open-source church management system. Prior to version 6.5.0, a SQL injection vulnerability exists in the EventEditor.php file. When creating a new event and selecting an event type, the ENtyid POST parameter is not sanitized. This allows an authenticated user with event managemen...

CVE-2025-67751

ChurchCRM prior to version 6.5.0 contains a SQL injection in EventEditor.php. When creating a new event and selecting an event type, the EN_tyid POST parameter is not sanitized, allowing an authenticated user with event management permissions (isAddEvent) to execute arbitrary SQL queries. The iss...

CVE-2025-67751 ChurchCRM has SQL Injection in Event Editor via `EN_tyid` Parameter caused by an Incomplete Fix

ChurchCRM is an open-source church management system. Prior to version 6.5.0, a SQL injection vulnerability exists in the EventEditor.php file. When creating a new event and selecting an event type, the ENtyid POST parameter is not sanitized. This allows an authenticated user with event managemen...

CVE-2025-67751 ChurchCRM has SQL Injection in Event Editor via `EN_tyid` Parameter caused by an Incomplete Fix

ChurchCRM is an open-source church management system. Prior to version 6.5.0, a SQL injection vulnerability exists in the EventEditor.php file. When creating a new event and selecting an event type, the ENtyid POST parameter is not sanitized. This allows an authenticated user with event managemen...