Qualcomm Chipsets 资源管理错误漏洞

Qualcomm Chipsets are a family of chipsets from Qualcomm Incorporated USA. A resource management error vulnerability exists in Qualcomm Chipsets that stems from memory corruption when calling the HGSL memory node IOCTL call from user space...

Qualcomm Chipsets 安全漏洞

Qualcomm Chipsets are a family of chipsets from Qualcomm Incorporated USA. A security vulnerability exists in Qualcomm Chipsets that originates from a transient denial of service during hypervisor virtual I/O operations in a virtual machine...

CVE-2025-1571

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Animated Text and Image Comparison Widgets in all versions up to, and including, 2.7.6 due to insufficient input sanitization and output escaping on user supplied attributes. This...

CVE-2024-13402

The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘linktitle’ parameter in all versions up to, and including, 2.7.70 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2025-1491

CVE-2025-1491 — WP Posts Carousel (WordPress) is vulnerable to Stored Cross-Site Scripting via the auto_play_timeout parameter in all versions up to 1.3.7. The issue arises from insufficient input sanitization and output escaping, enabling authenticated users with Contributor+ privileges to injec...

CVE-2025-1291 Gutenberg Blocks by Kadence Blocks <= 3.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon'

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘icon’ parameter in all versions up to, and including, 3.4.9 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-13901 Counter Box: Add Engaging Countdowns, Timers & Counters to Your WordPress Site <= 2.0.6 - Authenticated (Administrator+) DOM-Based Stored Cross-Site Scripting

The Counter Box: Add Engaging Countdowns, Timers & Counters to Your WordPress Site plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘content’ parameter in all versions up to, and including, 2.0.6 due to insufficient input sanitization and output escaping. This...

CVE-2024-13559

CVE-2024-13559 concerns the TemplatesNext ToolKit WordPress plugin. The vulnerability is a Stored Cross-Site Scripting (Stored XSS) in the plugin’s shortcodes, specifically tx_woo_wishlist_table, and affects all versions up to and including 3.2.9. The root cause is insufficient input sanitization...

CVE-2025-0820

CVE-2025-0820 (Clicface Trombi, WordPress) : The WordPress plugin is vulnerable to a Stored Cross-Site Scripting via the nom parameter in all versions up to and including 2.08. The issue arises from insufficient input sanitization and output escaping. Exploitation requires at least Contributor-le...

SUSE CVE-2025-21814

In the Linux kernel, the following vulnerability has been resolved: ptp: Ensure info-enable callback is always set The ioctl and sysfs handlers unconditionally call the -enable callback. Not all drivers implement that callback, leading to NULL dereferences. Example of affected drivers: ptps390.c,...

WordPress plugin TemplatesNext ToolKit 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A cross-site scripting...

PT-2025-9153 · WordPress · The Counter Box

Name of the Vulnerable Software and Affected Versions: The Counter Box: Add Engaging Countdowns, Timers & Counters to Your WordPress Site plugin for WordPress versions up to, and including, 2.0.6 Description: The issue is related to DOM-Based Stored Cross-Site Scripting due to insufficient input...

CVE-2025-1319

The Site Mailer – SMTP Replacement, Email API Deliverability & Email Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers t...

CVE-2025-1319 Site Mailer <= 1.2.3 - Unauthenticated Stored Cross-Site Scripting

The Site Mailer – SMTP Replacement, Email API Deliverability & Email Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers t...

CVE-2024-6810

The Quiz Organizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web...

CVE-2024-13469 Pricing Table by PickPlugins <= 1.12.10 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Pricing Table by PickPlugins plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Button Link in all versions up to, and including, 1.12.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-lev...

Stored Cross-site Scripting (XSS)

leantime/leantime is vulnerable to Stored Cross-site Scripting XSS. The vulnerability is due to improper input sanitization and output encoding, allowing attackers to inject malicious scripts that get stored and executed when retrieved by users...

CVE-2025-1571

CVE-2025-1571 — The WordPress plugin “Exclusive Addons for Elementor” is vulnerable to Stored Cross-Site Scripting via the Animated Text and Image Comparison Widgets in all versions up to and including 2.7.6. The issue arises from insufficient input sanitization and output escaping on user-suppli...

CVE-2024-12820

The MK Google Directions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'MKGD' shortcode in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-1513

CVE-2025-1513 affects the WordPress plugin contest-gallery (Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons) in all versions up to 26.0.0.1. It is an unauthenticated Stored Cross-Site Scripting via the N...