CVE-2025-58625

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Spiffy Plugins WP Flow Plus wp-imageflow2 allows Stored XSS.This issue affects WP Flow Plus: from n/a through = 5.2.5...

CVE-2025-58623

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Bohemia Plugins Event Feed for Eventbrite event-feed-for-eventbrite allows DOM-Based XSS.This issue affects Event Feed for Eventbrite: from n/a through = 1.3.2...

In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not affect Ansible modules, as those are executed in a separate process.

...

org.jenkins-ci.plugins:bitbucket-approve (>=1.0.1, <=1.0.3), org.jenkins-ci.plugins:git (>=2.2.10, <=2.3.2) potentially affected by CVE-2025-58458 via org.jenkins-ci.plugins:git-client (1.13.0)

org.jenkins-ci.plugins:git-client MAVEN version 1.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git-client and may be impacted: - org.jenkins-ci.plugins:bitbucket-approve =1.0.1, =2.2.10, =2.3.2 Source cves: CVE-2025-58458...

CVE-2025-58625

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Spiffy Plugins WP Flow Plus wp-imageflow2 allows Stored XSS.This issue affects WP Flow Plus: from n/a through = 5.2.5...

CVE-2025-58613

Missing Authorization vulnerability in Barn2 Plugins Posts Table with Search & Sort posts-data-table allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Posts Table with Search & Sort: from n/a through = 1.4.10...

WordPress Posts Table with Search & Sort Plugin <= 1.4.10 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Bao - BlueRock in WordPress Plugin Posts Table with Search & Sort versions = 1.4.10...

CVE-2025-58613: Missing Authorization

Missing Authorization vulnerability in Barn2 Plugins Posts Table with Search & Sort posts-data-table allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Posts Table with Search & Sort: from n/a through = 1.4.10...

CVE-2025-58623: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Bohemia Plugins Event Feed for Eventbrite event-feed-for-eventbrite allows DOM-Based XSS.This issue affects Event Feed for Eventbrite: from n/a through = 1.3.2...

PT-2025-35756

Name of the Vulnerable Software and Affected Versions: Bohemia Plugins Event Feed for Eventbrite versions through 1.3.2 Description: The software contains a DOM-Based Cross-site Scripting XSS issue due to improper neutralization of input during web page generation. Recommendations: Update Bohemia...

IntelliJ IDEA Plugin Execution

The vulnerability of the IntelliJ IDEA software development environment lies in the inclusion of functions from an unverified and uncontrolled area. Exploiting this vulnerability can allow attackers to execute arbitrary plugins...

CVE-2025-0951

Multiple plugins and/or themes for WordPress by LiquidThemes are vulnerable to unauthorized access due to a missing capability check on the liquidresetwordpressbefore AJAX in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivat...

Linux Distros Unpatched Vulnerability : CVE-2023-45133

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Babel is a compiler for writingJavaScript. In @babel/traverse prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of babel-traverse, using Babel to...

CVE-2025-8147 LWSCache <= 2.8.5 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Activation via lwscache_activatePlugin Function

The LWSCache plugin for WordPress is vulnerable to unauthorized modification of data due to improper authorization on the lwscacheactivatePlugin function in all versions up to, and including, 2.8.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

CVE-2025-8147

The CVE-2025-8147 entry concerns the WordPress LWSCache plugin (versions up to and including 2.8.5). The underlying issue is improper authorization in the lwscache_activatePlugin() function, allowing authenticated users with Subscriber-level access and above to activate arbitrary whitelisted LWS ...

PT-2025-35187

Name of the Vulnerable Software and Affected Versions: LWSCache plugin for WordPress versions up to and including 2.8.5 Description: The LWSCache plugin for WordPress is susceptible to unauthorized data modification because of insufficient authorization within the lwscache activatePlugin function...

Wordfence Intelligence Weekly WordPress Vulnerability Report (August 18, 2025 to August 24, 2025)

Calling all Vulnerability Researchers and Bug Bounty Hunters! Spring into Summer with Wordfence! Now through September 4, 2025, earn 2X bounty rewards forall in-scope submissions from our 'High Threat' list in software with fewer than 5 million active installs. Bounties up to $31,200 per...

CVE-2025-0951

Multiple plugins and/or themes for WordPress by LiquidThemes are vulnerable to unauthorized access due to a missing capability check on the liquidresetwordpressbefore AJAX in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivat...

CVE-2025-0951

Summary of CVE-2025-0951 (LiquidThemes for WordPress): The issue arises from a missing capability check in the liquid_reset_wordpress_before AJAX path across LiquidThemes plugins/themes, enabling authenticated attackers with Subscriber-level access and above to deactivate all plugins. The root ca...

CVE-2025-0951 LiquidThemes Themes <= Various Versions - Missing Authorization to Authenticated (Subscriber+) All Plugins Deactivated

Multiple plugins and/or themes for WordPress by LiquidThemes are vulnerable to unauthorized access due to a missing capability check on the liquidresetwordpressbefore AJAX in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivat...