WordPress SUMO Affiliates Pro plugin < 11.1.0 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Anhchangmutrang in WordPress Plugin SUMO Affiliates Pro versions 11.1.0...

WordPress WP Pipes plugin <= 1.4.2 - Arbitrary File Deletion Vulnerability

Arbitrary File Deletion Vulnerability discovered by timomangcut in WordPress Plugin WP Pipes versions = 1.4.2...

WordPress WPCHURCH plugin <= 2.7.0 - Privilege Escalation Vulnerability

Privilege Escalation Vulnerability discovered by Phúc ton luoi in WordPress Plugin WPCHURCH versions = 2.7.0...

Apache Commons BeanUtils 1.x < 1.11.0, 2.0.0-M1 < 2.0.0-M2 Improper Access Control Vulnerability

The Apache Commons BeanUtils library is prone to an improper access control vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE ...

CVE-2025-5280

Out of bounds write in V8 in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

WordPress Infility Global plugin <= 2.14.51 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Martino Spagnuolo r3verii in WordPress Plugin Infility Global versions = 2.14.51...

WordPress Apptha Slider Gallery plugin <= 2.5 - Arbitrary File Read vulnerability

Arbitrary File Read vulnerability discovered by Thomas Parkison in WordPress Plugin Apptha Slider Gallery versions = 2.5...

SUSE CVE-2025-5063

Use after free in Compositing in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

WordPress The Fashion - Model Agency One Page Beauty Theme Theme <= 1.4.4 is vulnerable to Deserialization of untrusted data

Software The Fashion - Model Agency One Page Beauty Theme Type Theme Vulnerable versions = 1.4.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Deserialization of untrusted data CVE CVE-2025-31052 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 400ca29478f9 Credi...

WordPress Course Builder Theme < 3.6.6 is vulnerable to PHP Object Injection

Software Course Builder Type Theme Vulnerable versions 3.6.6 Fixed in 3.6.6 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-48336 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 330f3e0387ca Credits Annn Required privilege Unauthenticated...

WordPress Flynax Bridge plugin <= 2.2.0 - Unauthenticated Limited Privilege Escalation vulnerability

Unauthenticated Limited Privilege Escalation vulnerability discovered by kr0d in WordPress Plugin Flynax Bridge versions = 2.2.0...

WordPress Likes and Dislikes Plugin plugin <= 1.0.0 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Nxploited in WordPress Plugin Likes and Dislikes versions = 1.0.0...

CVE-2025-5063

Use after free in Compositing in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2025-5280

Out of bounds write in V8 in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2025-5280

CVE-2025-5280 is a Google Chrome/Chromium vulnerability: an out-of-bounds write in V8 could enable heap corruption via a crafted HTML page, impacting Chrome versions prior to 137.0.7151.55. The Chrome security note confirms the fix in 137.0.7151.55 (Linux/Windows/Mac) and Debian security advisori...

CVE-2025-5063

CVE-2025-5063 is a use-after-free in Chromes’s Compositing component, exploitable via a crafted HTML page on Google Chrome before version 137.0.7151.55. The issue could lead to heap corruption and is addressed in the Chrome 137 stable update (Linux/Windows/macOS). Affected product: Google Chrome ...

CVE-2025-5063

Use after free in Compositing in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2025-5063

Use after free in Compositing in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

WordPress MasterStudy LMS Pro plugin <= 4.7.0 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by Foxyyy in WordPress Plugin MasterStudy LMS Pro versions = 4.7.0...

chromium -- multiple security fixes

Chrome Releases reports: This update includes 11 security fixes: 411573532 High CVE-2025-5063: Use after free in Compositing. Reported by Anonymous on 2025-04-18 417169470 High CVE-2025-5280: Out of bounds write in V8. Reported by pwn2car on 2025-05-12 40058068 Medium CVE-2025-5064: Inappropriate...