Fedora 40 : rpki-client (2025-d5fdbedb7f)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-d5fdbedb7f advisory. rpki-client 9.5 - rpki-client now includes arin.tal which is no longer legally encumbered. See https://www.arin.net/announcements/20250116-tal/ - rpki-client...

ZooEffect <= 1.11 - Reflected Cross-Site Scripting

Description The ZooEffect plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...

AESHA3: Efficient and Secure Sub-Key Generation for AES Using SHA-3

Advanced Encryption Standard AES is one of the most widely used symmetric cipher for the confidentiality of data. Also it is used for other security services, viz. integrity, authentication and key establishment. However, recently, authors have shown some weakness in the generation of sub-keys in...

CVE-2025-3809

The CVE-2025-3809 entry concerns the WordPress Debug Log Manager plugin, which has an unauthenticated Stored XSS vulnerability in the auto-refresh debug log feature. Affected versions include all up to and including 2.3.4, with exploitation enabling injection of scripts that run when users open t...

CVE-2025-3809 Debug Log Manager <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting

The Debug Log Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the auto-refresh debug log in all versions up to, and including, 2.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...

CVE-2025-3275

CVE-2025-3275 affects the Themesflat Addons For Elementor plugin for WordPress. It allows Stored Cross-Site Scripting via the TF E Slider widget in all versions up to and including 2.2.5. Exploitation requires authentication at Contributor level or higher, and scripts execute when a user loads an...

PT-2025-17354 · WordPress · Element Pack Elementor Addons

Name of the Vulnerable Software and Affected Versions: The Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites plugin for WordPress versions up to, and including, 5.10.28 Description: The issue is related to Stored Cross-Site Scripting due to insufficient...

PT-2025-17355 · WordPress · Themesflat Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Themesflat Addons For Elementor plugin for WordPress versions up to, and including, 2.2.5 Description: The issue is related to Stored Cross-Site Scripting via the TF E Slider widget due to insufficient input sanitization and output escaping...

PT-2025-17373 · WordPress · Sb Chart Block Plugin

Name of the Vulnerable Software and Affected Versions: SB Chart block plugin for WordPress versions up to, and including, 1.2.6 Description: The issue is related to Stored Cross-Site Scripting via the className parameter due to insufficient input sanitization and output escaping. This allows...

PT-2025-17358 · WordPress · Debug Log Manager

Name of the Vulnerable Software and Affected Versions: Debug Log Manager plugin for WordPress versions up to, and including, 2.3.4 Description: The issue is related to Stored Cross-Site Scripting via the auto-refresh debug log due to insufficient input sanitization and output escaping. This allow...

WordPress plugin Themesflat Addons For Elementor 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2025-3056 Download Manager <= 3.3.12 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.3.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and...

CVE-2025-2314

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.13.5 due to insufficient input sanitization and output escaping on...

CVE-2024-13650

The CVE-2024-13650 entry concerns the Piotnet Addons For Elementor WordPress plugin. The connected sources confirm a Stored Cross-Site Scripting vulnerability in the PAFE Before After Image Comparison Slider widget affecting all versions up to 2.4.34, requiring authenticated access at Contributor...

PT-2025-17256 · WordPress · The Coupon Affiliates – Affiliate Plugin For Woocommerce

Name of the Vulnerable Software and Affected Versions: The Coupon Affiliates – Affiliate Plugin for WooCommerce plugin for WordPress versions up to, and including, 6.3.0 Description: The issue is related to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping...

WordPress plugin Piotnet Addons For Elementor 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2025-17287 · WordPress · Download Manager

Name of the Vulnerable Software and Affected Versions: Download Manager plugin for WordPress versions up to, and including, 3.3.12 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows...

PT-2025-17249 · WordPress · Piotnet Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Piotnet Addons For Elementor plugin for WordPress versions up to, and including, 2.4.34 Description: The issue is related to Stored Cross-Site Scripting via the 'PAFE Before After Image Comparison Slider' widget due to insufficient input...

CVE-2025-3487

CVE-2025-3487 affects Forminator Forms – Contact Form, Payment Form & Custom Form Builder (WordPress). It is a Stored Cross-Site Scripting vulnerability via the limit parameter in all versions up to and including 1.42.0, caused by insufficient input sanitization and output escaping. Exploitation ...

CVE-2025-3615

CVE-2025-3615 : Fluent Forms for WordPress is vulnerable to Stored Cross-Site Scripting via form-submission.js in all versions up to and including 6.0.2. Exploitation requires authenticated access at Contributor level or higher, enabling an attacker to inject scripts that run when users load the ...