CVE-2025-12410: Cross-Site Request Forgery (CSRF)

The SH Contextual Help plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1. This is due to missing or incorrect nonce validation in the shcontextualhelpdashboardwidget function. This makes it possible for unauthenticated attackers to update...

CVE-2025-12400: Cross-Site Request Forgery (CSRF)

The LMB^Box Smileys plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2. This is due to missing or incorrect nonce validation on the managepage function. This makes it possible for unauthenticated attackers to update settings and inject...

Remote Code Execution (RCE)

mahocommerce/maho is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper validation of uploaded file types in the product management module, which allows an attacker with staff access to upload malicious .php files and execute arbitrary code on the server...

EUVD-2022-34704

Malicious code in bioql PyPI...

EUVD-2022-25190

Malicious code in bioql PyPI...

EUVD-2023-54579

Malicious code in bioql PyPI...

EUVD-2024-50406

Malicious code in bioql PyPI...

EUVD-2025-4822

Malicious code in bioql PyPI...

EUVD-2024-46785

Malicious code in bioql PyPI...

EUVD-2024-34372

Malicious code in bioql PyPI...

EUVD-2024-51643

Malicious code in bioql PyPI...

EUVD-2024-50870

Malicious code in bioql PyPI...

EUVD-2025-13310

Malicious code in bioql PyPI...

CVE-2025-9946: Cross-Site Request Forgery (CSRF)

The LockerPress – WordPress Security Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and...

CVE-2025-9881: Cross-Site Request Forgery (CSRF)

The Ultimate Blogroll plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web...

CVE-2025-9880: Cross-Site Request Forgery (CSRF)

The Side Slide Responsive Menu plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicio...

CVE-2025-9620: Cross-Site Request Forgery (CSRF)

The Seo Monster plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.3. This is due to missing or incorrect nonce validation on the checkintegration function. This makes it possible for unauthenticated attackers to update settings and inject...

CVE-2025-7683: Cross-Site Request Forgery (CSRF)

The LatestCheckins plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1. This is due to missing or incorrect nonce validation on the 'LatestCheckins' page. This makes it possible for unauthenticated attackers to update settings and inject...

CVE-2025-7688: Cross-Site Request Forgery (CSRF)

The Add User Meta plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the 'add-user-meta' page. This makes it possible for unauthenticated attackers to update settings and inject...

CVE-2025-6054: Cross-Site Request Forgery (CSRF)

The YANewsflash plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing or incorrect nonce validation on the 'yanewsflash/yanewsflash.php' page. This makes it possible for unauthenticated attackers to update settings and...