WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin <= 2.4.37 - Privilege Escalation Vulnerability

Privilege Escalation Vulnerability discovered by ch4r0n in WordPress Plugin Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light versions = 2.4.37...

WordPress Builty Theme <= 1.4.0 is vulnerable to Local File Inclusion

Software Builty Type Theme Vulnerable versions = 1.4.0 Fixed in 1.5.0 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-48290 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 59fa2331d0c1 Credits Bonds Required privilege Unauthenticated Published...

WordPress Ober Theme <= 1.3.3 is vulnerable to Local File Inclusion

Software Ober Type Theme Vulnerable versions = 1.3.3 Fixed in 1.3.4 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-48290 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 56419d7eb55a Credits Bonds Required privilege Unauthenticated Published 2...

WordPress Kaffen Theme <= 1.2.5 is vulnerable to Local File Inclusion

Software Kaffen Type Theme Vulnerable versions = 1.2.5 Fixed in 1.2.6 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-48290 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 362157fa6efa Credits Bonds Required privilege Unauthenticated Published...

WordPress Grand Tour | Travel Agency WordPress Theme <= 5.5.1 is vulnerable to PHP Object Injection

Software Grand Tour | Travel Agency WordPress Type Theme Vulnerable versions = 5.5.1 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-39485 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 2dd075a80458 Credits Bonds Required privile...

WordPress Crafts & Arts Theme <= 2.5 is vulnerable to PHP Object Injection

Software Crafts & Arts Type Theme Vulnerable versions = 2.5 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-31924 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID c2b3d2de486e Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity...

WordPress Madara Theme <= 2.2.2 is vulnerable to Local File Inclusion

Software Madara Type Theme Vulnerable versions = 2.2.2 Fixed in 2.2.2.1 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2025-4524 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID a3266cbf8e97 Credits Kyle Bouchard ptrstr Required privilege...

WordPress Ashley Theme <= 1.7.0 is vulnerable to Local File Inclusion

Software Ashley Type Theme Vulnerable versions = 1.7.0 Fixed in 1.8.0 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-48290 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID fa01b9d5a6af Credits Bonds Required privilege Unauthenticated Published...

WordPress Medicare Theme <= 2.1.0 is vulnerable to PHP Object Injection

Software Medicare Type Theme Vulnerable versions = 2.1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-39499 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 8ac56173cd64 Credits Bonds Required privilege Unauthenticated Published...

WordPress Avantage Theme <= 2.4.6 is vulnerable to PHP Object Injection

Software Avantage Type Theme Vulnerable versions = 2.4.6 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-39495 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 25b40b813078 Credits Bonds Required privilege Unauthenticated Published...

WordPress Simple Video Directory plugin < 1.4.3 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by Project Black in WordPress Plugin Simple Video Directory versions 1.4.3...

WordPress Push Notification for Post and BuddyPress plugin <= 1.93 - Multiple Unauthenticated SQLi vulnerability

Multiple Unauthenticated SQLi vulnerability discovered by Project Black in WordPress Plugin Push Notification for Post and BuddyPress versions = 1.93...

WordPress CouponXL Theme <= 4.5.0 is vulnerable to Privilege Escalation

Software CouponXL Type Theme Vulnerable versions = 4.5.0 Fixed in N/A OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2025-39489 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID ba176572a1dc Credits Bonds Required...

WordPress Motors Theme <= 5.6.67 is vulnerable to Privilege Escalation

Software Motors Type Theme Vulnerable versions = 5.6.67 Fixed in 5.6.68 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2025-4322 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID f2c68f043bd9 Credits Foxyyy Required...

WordPress HotStar – Multi-Purpose Business Theme Theme <= 1.4 is vulnerable to PHP Object Injection

Software HotStar – Multi-Purpose Business Theme Type Theme Vulnerable versions = 1.4 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-31069 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 5302a6861163 Credits Tran Nguyen Bao Khanh...

WordPress Jarvis – Night Club, Concert, Festival WordPress Theme <= 1.8.11 is vulnerable to PHP Object Injection

Software Jarvis – Night Club, Concert, Festival WordPress Type Theme Vulnerable versions = 1.8.11 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-32292 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 4d7f3fe39572 Credits Tran Nguy...

WordPress The Business Theme <= 1.6.1 is vulnerable to PHP Object Injection

Software The Business Type Theme Vulnerable versions = 1.6.1 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-31430 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 6b1df0573f1a Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunit...

WordPress Dash Theme <= 1.3 is vulnerable to PHP Object Injection

Software Dash Type Theme Vulnerable versions = 1.3 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-31049 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID a29d6b30b587 Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity Required...

Huawei EulerOS: Security Advisory for syslinux (EulerOS-SA-2025-1566)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[ASA-202505-11] freetype2: arbitrary code execution

Arch Linux Security Advisory ASA-202505-11 ========================================== Severity: High Date : 2025-05-19 CVE-ID : CVE-2025-27363 Package : freetype2 Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2877 Summary ======= The package freetype2 befo...