SUSE CVE-2025-21813

In the Linux kernel, the following vulnerability has been resolved: timers/migration: Fix off-by-one root mis-connection Before attaching a new root to the old root, the children counter of the new root is checked to verify that only the upcoming CPU's top group have been connected to it. However...

SUSE SLES15 / openSUSE 15 Security Update : azure-cli (SUSE-SU-2025:0751-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:0751-1 advisory. - CVE-2024-43591: improper neutralization of special elements could allow users to run Azure CLI commands that result in certa...

PT-2025-9144 · WordPress · Buddypress Woocommerce My Account Integration

Name of the Vulnerable Software and Affected Versions: The BuddyPress WooCommerce My Account Integration plugin versions up to, and including, 3.4.25 Description: The issue is related to a missing capability check on the wc4bp delete page function, allowing authenticated attackers with...

CVE-2025-1560

The WOW Entrance Effects WEE! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wee' shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...

CVE-2024-13832 Ultra Addons Lite for Elementor <= 1.1.8 - Authenticated (Contributor+) Restricted Post Disclosure

The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.8 via the 'utelementor' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with...

CVE-2025-1405

The Product Catalog Simple plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's showproducts shortcode in all versions up to, and including, 1.7.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-1405

CVE-2025-1405 affects the WordPress plugin Product Catalog Simple (post-type-x). It is a stored XSS vulnerability via the plugin’s show_products shortcode in versions up to 1.7.11, caused by insufficient input sanitization and output escaping on user-supplied attributes. Exploitation requires an ...

CVE-2024-12820

CVE-2024-12820 concerns the MK Google Directions plugin for WordPress. The vulnerability is an authenticated (Contributor+) Stored Cross-Site Scripting via the plugin’s MKGD shortcode , caused by insufficient input sanitization and output escaping on user-supplied attributes. Impact: attackers wi...

PT-2025-9071 · WordPress · Ultra Addons Lite For Elementor

Name of the Vulnerable Software and Affected Versions: Ultra Addons Lite for Elementor plugin for WordPress versions up to, and including, 1.1.8 Description: The issue allows authenticated attackers with Contributor-level access and above to extract data from password-protected, private, or draft...

DEBIAN-CVE-2025-21813

In the Linux kernel, the following vulnerability has been resolved: timers/migration: Fix off-by-one root mis-connection Before attaching a new root to the old root, the children counter of the new root is checked to verify that only the upcoming CPU's top group have been connected to it. However...

UBUNTU-CVE-2025-21813

In the Linux kernel, the following vulnerability has been resolved: timers/migration: Fix off-by-one root mis-connection Before attaching a new root to the old root, the children counter of the new root is checked to verify that only the upcoming CPU's top group have been connected to it. However...

CVE-2025-21813

CVE-2025-21813 affects the Linux kernel timers/migration code. The root cause is an off-by-one mis-count during the migration of the top CPU group to a new root, where the old root is pre-accounted as a child of the new root. After attaching the upcoming CPU’s top group, the expected children cou...

CVE-2024-13402

The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘linktitle’ parameter in all versions up to, and including, 2.7.70 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2024-13402 BuddyBoss Platform <= 2.7.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link_title'

The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘linktitle’ parameter in all versions up to, and including, 2.7.70 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2024-13402 BuddyBoss Platform <= 2.7.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link_title'

The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘linktitle’ parameter in all versions up to, and including, 2.7.70 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2024-13695

The Enfold theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.9 via the 'attachmentid' parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations...

CVE-2025-1690

The CVE-2025-1690 entry concerns ThemeMakers Stripe Checkout for WordPress, which has a Stored Cross-Site Scripting (XSS) flaw in the stripe shortcode up to version 1.0.1 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level permissions can inj...

CVE-2024-6261

CVE-2024-6261 affects the Image Photo Gallery Final Tiles Grid plugin for WordPress. It is a Stored DOM-based Cross-Site Scripting vulnerability via the FinalTilesGallery shortcode in all versions up to 3.6.0. Exploitation requires authenticated access at contributor level or higher, enabling inj...

CVE-2025-0469

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the slider template data in all versions up to, and including, 1.39.2 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2025-0469

CVE-2025-0469 : Forminator Forms – Contact Form, Payment Form & Custom Form Builder (WordPress) is affected by a Stored Cross-Site Scripting vulnerability up to version 1.39.2 due to insufficient input sanitization and output escaping in the slider template data. An attacker with Contributor+ pri...