PT-2026-118674

SocialFit plugin for WordPress through 1.2.2 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the unsanitized msg parameter. Attackers can craft GET requests to /wp-content/plugins/socialfit/popup.php with service=googleplus and...

PT-2026-133925

TuxCare rebuilt @babel/plugin-transform-arrow-functions to address 1 CVE. Fixed in 7.25.7-tuxcare.4...

PT-2026-133856

TuxCare rebuilt @babel/plugin-syntax-flow to address 1 CVE. Fixed in 7.18.9-tuxcare.2...

PT-2026-133987

TuxCare rebuilt @babel/plugin-transform-async-to-generator to address 1 CVE. Fixed in 7.21.5-tuxcare.1...

PT-2026-133971

TuxCare rebuilt @babel/plugin-transform-function-name to address 1 CVE. Fixed in 7.18.9-tuxcare.2...

PT-2026-134056

TuxCare rebuilt @babel/plugin-transform-named-capturing-groups-regex to address 1 CVE. Fixed in 7.18.9-tuxcare.2...

PT-2026-134301

TuxCare rebuilt @babel/plugin-proposal-export-default-from to address 1 CVE. Fixed in 7.16.7-tuxcare.3...

CVE-2014-125132: Improper Neutralization of Input During Web Page Generation

Blogroll Fun plugin for WordPress before 0.8.5 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the 'k' parameter in blogroll.php. Attackers can craft GET requests to /wp-content/plugins/blogroll-fun/blogroll.php with maliciou...

PT-2026-133227

TuxCare rebuilt @babel/plugin-syntax-export-default-from to address 1 CVE. Fixed in 7.18.9-tuxcare.3...

PT-2026-133991

TuxCare rebuilt @babel/plugin-transform-async-to-generator to address 1 CVE. Fixed in 7.18.9-tuxcare.3...

PT-2026-134379

TuxCare rebuilt @babel/plugin-syntax-decorators to address 2 CVEs. Fixed in 7.21.5-tuxcare.2...

PT-2026-133881

TuxCare rebuilt @babel/helper-create-class-features-plugin to address 1 CVE. Fixed in 7.25.7-tuxcare.4...

PT-2026-133861

TuxCare rebuilt @babel/plugin-syntax-flow to address 1 CVE. Fixed in 7.21.0-tuxcare.4...

PT-2026-133329

TuxCare rebuilt @babel/plugin-transform-computed-properties to address 1 CVE. Fixed in 7.25.7-tuxcare.4...

PT-2026-134367

TuxCare rebuilt @babel/plugin-syntax-jsx to address 1 CVE. Fixed in 7.16.7-tuxcare.3...

PT-2026-134372

TuxCare rebuilt @babel/plugin-syntax-decorators to address 1 CVE. Fixed in 7.29.0-tuxcare.1...

CVE-2012-20005: Improper Neutralization of Input During Web Page Generation

SocialFit plugin for WordPress through 1.2.2 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the unsanitized msg parameter. Attackers can craft GET requests to /wp-content/plugins/socialfit/popup.php with service=googleplus and...

PT-2026-133990

TuxCare rebuilt @babel/plugin-transform-async-to-generator to address 2 CVEs. Fixed in 7.21.5-tuxcare.2...

PT-2026-133801

TuxCare rebuilt @babel/plugin-transform-optional-catch-binding to address 1 CVE. Fixed in 7.29.0-tuxcare.2...

PT-2026-118680

Name of the Vulnerable Software and Affected Versions Aspose Importer & Exporter plugin for WordPress versions prior to 3.0 Description A path traversal issue allows unauthenticated attackers to download arbitrary files. This occurs because the file parameter is not properly sanitized. Attackers...