WordPress Download Monitor plugin <= 5.1.9 - Non-Arbitrary File Download vulnerability

Non-Arbitrary File Download vulnerability discovered by daroo in WordPress Plugin Download Monitor versions = 5.1.9...

CVE-2025-27299

CVE-2025-27299 is about WP Asia MyTicket Events. A path restriction flaw allows unauthenticated file read (path traversal) in MyTicket Events versions 1.2.4 and earlier. The Red Hat/RedHat-affiliate listing and CVE records confirm the vulnerability and note no public details on a fix version; the...

CVE-2025-26940 WordPress Pie Register Premium plugin <= 3.8.3.2 - Path Traversal to Non-Arbitrary File Deletion vulnerability

Path Traversal vulnerability in NotFound Pie Register Premium. This issue affects Pie Register Premium: from n/a through 3.8.3.2...

WordPress MyTicket Events plugin <= 1.2.4 - Non-Arbitrary File Read vulnerability

Non-Arbitrary File Read vulnerability discovered by Anhchangmutrang in WordPress Plugin MyTicket Events versions = 1.2.4...

CVE-2024-38792 WordPress ConveyThis Translate plugin <= 234 - Non-arbitrary Options Update vulnerability

Missing Authorization vulnerability in ConveyThis Translate Team Language Translate Widget for WordPress – ConveyThis allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Language Translate Widget for WordPress – ConveyThis: from n/a through 234...

WordPress ConveyThis Translate plugin <= 234 - Non-arbitrary Options Update vulnerability

Non-arbitrary Options Update vulnerability discovered by Humberto Castelo Branco Patchstack Alliance in WordPress Plugin ConveyThis versions = 234...

NewStart CGSL MAIN 6.06 : dnsmasq Vulnerability (NS-SA-2023-0141)

The remote NewStart CGSL host, running version MAIN 6.06, has dnsmasq packages installed that are affected by a vulnerability: - A single-byte, non-arbitrary write/use-after-free flaw was found in dnsmasq. This flaw allows an attacker who sends a crafted packet processed by dnsmasq, potentially...

Feather Login Page < 1.1.2 - Missing Authorization to Non-Arbitrary User Deletion

The plugin does not check authorization when processing the ftlpp-ext-expirable-delete-user ajax action, which could allow users with roles as low as subscriber to delete temporary users generated by the plugin, furthermore it does not protect the action against CSRF attacks, allowing an...