WordPress Import WP plugin <= 2.14.16 - Authenticated (Admin+) Arbitrary File Read vulnerability

Authenticated Admin+ Arbitrary File Read vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Import WP versions = 2.14.16...

WordPress Schema & Structured Data for WP & AMP plugin <= 1.51 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Schema & Structured Data for WP & AMP versions = 1.51...

WordPress Qi Blocks plugin <= 1.4.3 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Update vulnerability

Missing Authorization to Authenticated Contributor+ Plugin Settings Update vulnerability discovered by Adrian Lukita in WordPress Plugin Qi Blocks versions = 1.4.3...

WordPress Folderly plugin <= 0.3 - Incorrect Authorization to Authenticated (Author+) Term Deletion vulnerability

Incorrect Authorization to Authenticated Author+ Term Deletion vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin Folderly versions = 0.3...

WordPress List category posts plugin <= 0.92.0 - Authenticated (Contributor+) Information Exposure vulnerability

Authenticated Contributor+ Information Exposure vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin List category posts versions = 0.92.0...

WordPress Flying Images plugin <= 2.4.14 - Authenticated (Admin+) Stored Cross-Site Scripting vulnerability

Authenticated Admin+ Stored Cross-Site Scripting vulnerability discovered by Karuppiah Sabari Kumar - Mobikwik in WordPress Plugin Flying Images versions = 2.4.14...

WordPress Schema Scalpel plugin <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title in JSON-LD Schema vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Post Title in JSON-LD Schema vulnerability discovered by Peter Thaleikis in WordPress Plugin Schema Scalpel versions = 1.6.1...

WordPress CSS & JavaScript Toolbox plugin <= 12.0.5 - Authenticated (Admin+) Stored Cross-Site Scripting vulnerability

Authenticated Admin+ Stored Cross-Site Scripting vulnerability discovered by Kyokito - - in WordPress Plugin CSS & JavaScript Toolbox versions = 12.0.5...

WordPress SiteSEO plugin <= 1.3.1 - Missing Authorization to Authenticated (Author+) Plugin Settings Update vulnerability

Missing Authorization to Authenticated Author+ Plugin Settings Update vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin SiteSEO versions = 1.3.1...

Astra Linux – Vulnerability in Chromium

Inappropriate implementations in Extensions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to perform certain UI gestures to leak cross-origin data through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in OpenSSL

Issue summary: An application that uses the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the ‘noproxy’ environment variable is set and the host portion of the authority component of the HTTP URL is an IPv6 address. Impact summary: An out-of-bounds read can cause a crash,...

WordPress ERI File Library plugin <= 1.1.0 - Missing Authorization to Unauthenticated Protected File Download vulnerability

Missing Authorization to Unauthenticated Protected File Download vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin ERI File Library versions = 1.1.0...

WordPress The Events Calendar plugin <= 6.15.9 - Missing Authorization to Authenticated (Subscriber+) Draft Event Title/QR Code Exposure vulnerability

Missing Authorization to Authenticated Subscriber+ Draft Event Title/QR Code Exposure vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan - Knight Squad in WordPress Plugin The Events Calendar versions = 6.15.9...

WordPress Core <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)

Software Qzzr Shortcode Type WordPress Core Vulnerable versions = 1.0.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2025-11806 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8319539fe579 Credits zakaria Required...

WordPress Smart Coupons for WooCommerce plugin <= 2.2.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin Smart Coupons for WooCommerce versions = 2.2.3...

WordPress Advanced Database Cleaner plugin <= 3.1.6 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Bao - BlueRock in WordPress Plugin Advanced Database Cleaner versions = 3.1.6...

WordPress NS Maintenance Mode for WP plugin <= 1.3.1 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin NS Maintenance Mode for WP versions = 1.3.1...

WordPress K Elements plugin < 5.5.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin K Elements versions 5.5.0...

WordPress Weglot Translate plugin <= 5.1 - Missing Authorization to Unauthenticated Limited Transient Deletion vulnerability

Missing Authorization to Unauthenticated Limited Transient Deletion vulnerability discovered by Nguyen Ngoc Quang Bach maysbachs in WordPress Plugin Weglot Translate versions = 5.1...

WordPress SmartMag Theme <= 10.3.1 is vulnerable to Cross Site Scripting (XSS)

Software SmartMag Type Theme Vulnerable versions = 10.3.1 Fixed in 10.3.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2025-64204 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 6a240fc7988d Credits João Pedro S Alcântara Kinorth Required...