WordPress Web3Press – Decentralize Publishing with Writing NFT plugin <= 3.2.0 - Arbitrary File Read vulnerability

Arbitrary File Read vulnerability discovered by ch4r0n in WordPress Plugin Web3Press versions = 3.2.0...

WordPress Visual Builder plugin <= 1.2.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by astra.r3verii Patchstack Alliance in WordPress Plugin Visual Builder versions = 1.2.2...

WordPress EC Authorize.net plugin <= 0.3.3 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by johska in WordPress Plugin EC Authorize.net versions = 0.3.3...

WordPress Category Widget plugin <= 2.0.2 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by noven in WordPress Plugin Category Widget versions = 2.0.2...

WordPress Theme Blvd Sliders plugin <= 1.2.5 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Theme Blvd Sliders versions = 1.2.5...

WordPress Motors Theme <= 5.6.65 is vulnerable to Content Injection

Software Motors Type Theme Vulnerable versions = 5.6.65 Fixed in 5.6.66 OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2024-13738 Patch priority Medium CVSS severity Medium 7.3 Developer Claim ownership PSID 81285145e079 Credits Lucio Sá Required privilege Unauthenticated...

WordPress BuddyBoss Platform plugin <= 2.8.50 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'invitee_name' vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting via 'inviteename' vulnerability discovered by Kaique Peres in WordPress Plugin Buddyboss Platform versions = 2.8.50...

wamr:wamr_fuzz_aot_compiler: Crash in check_block_stack

Project: https://github.com/bytecodealliance/wasm-micro-runtime.git Detailed Report: https://oss-fuzz.com/testcase?key=5206320594878464 Project: wamr Fuzzing Engine: libFuzzer Fuzz Target: wamrfuzzaotcompiler Job Type: libfuzzerubsanwamr Platform Id: linux Crash Type: UNKNOWN READ Crash Address:...

Kibana 7.17.24 and 8.12.0 Security Update (ESA-2024-20)

Kibana Unrestricted Upload of File with Dangerous Type Can Lead to XSS ESA-2024-20 Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser XSS via crafted HTML and JavaScript files. The attacker must have access to the Synthetic...

gpac:fuzz_probe_analyze: Heap-buffer-overflow in gf_props_insert_property

Project: https://github.com/gpac/gpac.git Detailed Report: https://oss-fuzz.com/testcase?key=6441917791666176 Project: gpac Fuzzing Engine: afl Fuzz Target: fuzzprobeanalyze Job Type: aflasangpac Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address: 0x50300000abec Crash State:...

WordPress Remote Images Grabber plugin <= 0.6 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by 0x1ceKing Patchstack Alliance in WordPress Plugin Remote Images Grabber versions = 0.6...

WordPress Section Widget plugin <= 3.3.1 - Path Traversal vulnerability

Path Traversal vulnerability discovered by Nguyen Xuan Chien Patchstack Alliance in WordPress Plugin Section Widget versions = 3.3.1...

Advisory ROSA-SA-2025-2860

Software: httpd 2.4.37 OS: ROSA Virtualization 3.0 packageevrstring: httpd-2.4.37-65.rv30.3 CVE-ID: CVE-2016-0736 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: Vulnerability in Apache HTTP Server due to insufficient data encryption in modsessioncrypto, making the server susceptible to padding oracle...

CVE-2025-2817

Thunderbird's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior. By injecting code into the user-privileged process, an attacker could bypass intended access controls, allowing SYSTEM-level file operations...

CVE-2025-2817

Thunderbird's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior. By injecting code into the user-privileged process, an attacker could bypass intended access controls, allowing SYSTEM-level file operations...

WordPress Total Donations <= 3.0.8 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Nguyen Xuan Chien Patchstack Alliance in WordPress Plugin Total Donations versions = 3.0.8...

WordPress Syndicate Out <= 0.9 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Nguyen Xuan Chien Patchstack Alliance in WordPress Plugin Syndicate Out versions = 0.9...

WordPress BP Messages Tool plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Nguyen Xuan Chien Patchstack Alliance in WordPress Plugin BP Messages Tool versions = 2.2...

WordPress Custom PC Builder Lite for WooCommerce <= 1.0.1 - Settings Change Vulnerability

Settings Change Vulnerability discovered by ch4r0n Patchstack Alliance in WordPress Plugin Custom PC Builder Lite for WooCommerce versions = 1.0.1...

WordPress Widgets as Shortcodes plugin <= 5.9.10 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao KhanhVCI - VNPT in WordPress Plugin Widgets as Shortcodes versions = 5.9.10...