WordPress Cloak Front End Email <= 1.9.5 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by muhammad yudha Patchstack Alliance in WordPress Plugin Cloak Front End Email versions = 1.9.5...

WordPress Széchenyi 2020 Logo <= 1.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Széchenyi 2020 Logo versions = 1.1...

WordPress Smart Agreements plugin <= 1.0.3 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Dimas Maulana Patchstack Alliance in WordPress Plugin Smart Agreements versions = 1.0.3...

WordPress FluentCommunity plugin <= 1.2.15 - PHP Object Injection Vulnerability

PHP Object Injection Vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin FluentCommunity versions = 1.2.15...

WordPress Ultimate Store Kit Elementor Addons plugin <= 2.4.0 - Deserialization of untrusted data Vulnerability

Deserialization of untrusted data Vulnerability discovered by domiee13 in WordPress Plugin Ultimate Store Kit Elementor Addons versions = 2.4.0...

WordPress Quentn WP plugin <= 1.2.8 - SQL Injection Vulnerability

SQL Injection Vulnerability discovered by Le Ngoc Anh in WordPress Plugin Quentn WP versions = 1.2.8...

WordPress Quentn WP plugin <= 1.2.8 - Privilege Escalation Vulnerability

Privilege Escalation Vulnerability discovered by Le Ngoc Anh in WordPress Plugin Quentn WP versions = 1.2.8...

WordPress StoreContrl Woocommerce plugin <= 4.1.3 - Arbitrary File Download Vulnerability

Arbitrary File Download Vulnerability discovered by astra.r3verii in WordPress Plugin StoreContrl Woocommerce versions = 4.1.3...

WordPress Taskbuilder plugin <= 4.0.1 - SQL Injection Vulnerability

SQL Injection Vulnerability discovered by astra.r3verii in WordPress Plugin Taskbuilder versions = 4.0.1...

WordPress ProfileGrid plugin <= 5.9.4.8 - SQL Injection Vulnerability

SQL Injection Vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin ProfileGrid versions = 5.9.4.8...

WordPress Hotel Booking Plugin <= 3.6 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by LVT-tholv2k in WordPress Plugin Hotel Booking versions = 3.6...

WordPress Spice Blocks plugin <= 2.0.7.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Spice Blocks versions = 2.0.7.7...

WordPress Rating by BestWebSoft plugin <= 1.7 - PHP Object Injection Vulnerability

PHP Object Injection Vulnerability discovered by Le Ngoc Anh in WordPress Plugin Rating by BestWebSoft versions = 1.7...

CISA Flags Actively Exploited Vulnerability in SonicWall SMA Devices

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Wednesday added a security flaw impacting SonicWall Secure Mobile Access SMA 100 Series gateways to its Known Exploited Vulnerabilities KEV catalog, based on evidence of active exploitation. The high-severity vulnerability, tracked...

WordPress Ultimate Member plugin <= 2.10.1 - Unauthenticated Blind SQL Injection vulnerability

Unauthenticated Blind SQL Injection vulnerability discovered by Muhamad Visat in WordPress Plugin Ultimate Member versions = 2.10.1...

WordPress Dør Theme <= 2.4 is vulnerable to Local File Inclusion

Software Dør Type Theme Vulnerable versions = 2.4 Fixed in 2.4.1 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-39466 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID dbf77e9752df Credits Bonds Required privilege Unauthenticated Published 17...

WordPress Real Estate 7 Theme <= 3.5.2 is vulnerable to Privilege Escalation

Software Real Estate 7 Type Theme Vulnerable versions = 3.5.2 Fixed in 3.5.3 OWASP Top 10 A1: Broken Access Control Classification Privilege Escalation CVE CVE-2025-39459 Patch priority High CVSS severity High 7.3 Developer Claim ownership PSID b355428eb863 Credits Ananda Dhakal Patchstack Requir...

CVE-2025-3620

Use after free in USB in Google Chrome prior to 135.0.7049.95 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2025-3620

Use after free in USB in Google Chrome prior to 135.0.7049.95 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2025-3620

CVE-2025-3620 is a use-after-free in USB handling within Google Chrome/Chromium, fixed in 135.0.7049.95 for Chromium-based builds. The vulnerability allows a remote attacker to trigger heap corruption via a crafted HTML page, with high impact across confidentiality, integrity, and availability as...