PT-2025-46798

Cross-Site Request Forgery CSRF vulnerability in ramon fincken Auto Prune Posts auto-prune-posts allows Cross Site Request Forgery.This issue affects Auto Prune Posts: from n/a through = 3.0.0...

CVE-2025-64500

creationtimestamp| type| source ---|---|--- 2025-11-12 12:42:38+00:00| seen| https://bsky.app/profile/symfony.com/post/3m5gogrgryw26 2025-11-12 12:44:41+00:00| seen| https://bsky.app/profile/symfony.com/post/3m5gokg2mtg2l 2025-11-13 00:25:40+00:00| seen|...

CVE-2025-11828

The Magazine Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'headerHtmlTag' attribute in the bnm-blocks/featured-posts-1 block in all versions up to, and including, 1.2.3. This is due to insufficient input sanitization and output escaping when using...

CVE-2025-11863

The My Geo Posts Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mygeocity' shortcode in all versions up to, and including, 1.2. This is due to the plugin not properly sanitizing user input or escaping output of the 'default' shortcode attribute. This makes it...

CVE-2025-59499

creationtimestamp| type| source ---|---|--- 2025-11-11 17:30:42+00:00| seen| https://www.thezdi.com/blog/2025/11/11/the-november-2025-security-update-review 2025-11-11 20:25:55+00:00| seen| https://bsky.app/profile/jos1264.social.skynetcloud.site.ap.brid.gy/post/3m5extb6maxi2 2025-11-11...

CVE-2025-7429

creationtimestamp| type| source ---|---|--- 2025-11-11 09:46:37+00:00| seen| https://gist.github.com/Darkcrai86/b3af27c92f36f5ea26fb50b2dfc12c18 2025-11-11 09:48:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m5dubcgo5n2u 2025-11-11 09:51:23+00:00| seen|...

CVE-2025-11457

creationtimestamp| type| source ---|---|--- 2025-11-11 07:32:23+00:00| seen| https://infosec.exchange/users/offseq/statuses/115529897855835530 2025-11-11 07:32:24+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3m5dmn3isdz2p 2025-11-14 22:42:51+00:00| published-proof-of-concept|...

Malicious code in changing_wildcat_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03c64287c4545c406e67013f35aa59a7579ab6d15435325f4ff1513bb2f37d22 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-60943

The Magazine Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'headerHtmlTag' attribute in the bnm-blocks/featured-posts-1 block in all versions up to, and including, 1.2.3. This is due to insufficient input sanitization and output escaping when using...

CVE-2025-12813

creationtimestamp| type| source ---|---|--- 2025-11-11 06:02:22+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3m5dhm3jiyq2s 2025-11-11 06:29:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m5dj5czirj2q 2025-11-11 08:35:49+00:00| seen|...

CVE-2025-11828

The Magazine Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'headerHtmlTag' attribute in the bnm-blocks/featured-posts-1 block in all versions up to, and including, 1.2.3. This is due to insufficient input sanitization and output escaping when using...

CVE-2025-11828 Magazine Companion <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Magazine Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'headerHtmlTag' attribute in the bnm-blocks/featured-posts-1 block in all versions up to, and including, 1.2.3. This is due to insufficient input sanitization and output escaping when using...

CVE-2025-11828

The Magazine Companion WordPress plugin (bnm-blocks/featured-posts-1 headerHtmlTag) is vulnerable to Stored XSS in all versions up to and including 1.2.3 due to insufficient input sanitization and output escaping. Exploitation requires authenticated access at contributor level or higher, enabling...

CVE-2025-42890

creationtimestamp| type| source ---|---|--- 2025-11-11 01:32:05+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3m5cyirztho27 2025-11-11 02:12:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m5d2rbdroo2q 2025-11-11 03:31:58+00:00| seen|...

CVE-2018-25124

creationtimestamp| type| source ---|---|--- 2025-11-11 01:30:37+00:00| seen| https://bsky.app/profile/jos1264.social.skynetcloud.site.ap.brid.gy/post/3m5cyftmsabr2 2025-11-11 01:47:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m5czeiianj2q 2025-11-11 03:30:15+00:00| seen|...

MAL-2025-65116 Malicious code in rina-gembus91-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ae5881c8952cda1a35de026b2a1db7a03c8a40b9fe80a65a0cf0ad687ca0aeb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

WordPress plugin My Geo Posts Free 跨站脚本漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

PT-2025-46258

Name of the Vulnerable Software and Affected Versions My Geo Posts Free plugin for WordPress versions prior to 1.3 Description The My Geo Posts Free plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'mygeo city' shortcode. This occurs because the plugin does not...

CVE-2025-11863: Improper Neutralization of Input During Web Page Generation

The My Geo Posts Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mygeocity' shortcode in all versions up to, and including, 1.2. This is due to the plugin not properly sanitizing user input or escaping output of the 'default' shortcode attribute. This makes it...

CVE-2025-11828: Improper Neutralization of Input During Web Page Generation

The Magazine Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'headerHtmlTag' attribute in the bnm-blocks/featured-posts-1 block in all versions up to, and including, 1.2.3. This is due to insufficient input sanitization and output escaping when using...