WordPress Popular Posts by Webline plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Popular Posts by Webline versions = 1.1.1...

CVE-2025-9984

The Featured Image from URL FIFU plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the fifuapidebugposts function in all versions up to, and including, 5.2.7. This makes it possible for unauthenticated attackers to read private/password protect...

CVE-2025-9984 Featured Image from URL (FIFU) <= 5.2.7 - Missing Authorization to Password Protected Post Disclosure

The Featured Image from URL FIFU plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the fifuapidebugposts function in all versions up to, and including, 5.2.7. This makes it possible for unauthenticated attackers to read private/password protect...

CVE-2025-9984

CVE-2025-9984 (FIFU, Featured Image from URL, WordPress) : The FIFU plugin is vulnerable to an unauthorized access exposure due to a missing capability check in fifu_api_debug_posts(). This allows unauthenticated attackers to read private/password protected posts in all versions up to 5.2.7. Conn...

CVE-2025-10037 Featured Image from URL (FIFU) <= 5.2.7 - Authenticated (Admin+) SQL Injection

The Featured Image from URL FIFU plugin for WordPress is vulnerable to SQL Injection via the getpostswithinternalfeaturedimage function in all versions up to, and including, 5.2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2025-9984 Featured Image from URL (FIFU) <= 5.2.7 - Missing Authorization to Password Protected Post Disclosure

The Featured Image from URL FIFU plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the fifuapidebugposts function in all versions up to, and including, 5.2.7. This makes it possible for unauthenticated attackers to read private/password protect...

PT-2025-39498

Name of the Vulnerable Software and Affected Versions Featured Image from URL FIFU plugin for WordPress versions through 5.2.7 Description The plugin is susceptible to unauthorized data access because of a missing capability check within the fifu api debug posts function. This allows...

WordPress plugin Featured Image from URL 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

GHSA-8MJQ-32X3-22QF Duplicate Advisory: Malicious versions of Nx were published

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-cxm3-wv7p-598c. This link is maintained to preserve external references. Original Description Malicious code was inserted into the Nx build system package and several related plugins. The tampered package was...

CVE-2025-10380: Improper Neutralization of Special Elements Used in a Template Engine

The Advanced Views – Display Posts, Custom Fields, and More plugin for WordPress is vulnerable to Server-Side Template Injection in all versions up to, and including, 3.7.19. This is due to insufficient input sanitization and lack of access control when processing custom Twig templates in the Mod...

CVE-2025-57205

iNiLabs School Express SMS Express 6.2 is affected by a Stored Cross-Site Scripting XSS vulnerability in the content-management features available to authenticated admin users. The vulnerability resides in POSTed editor parameters submitted to the /posts/edit/id endpoint and similarly in Notice a...

CVE-2025-57205

iNiLabs School Express SMS Express 6.2 is affected by a Stored Cross-Site Scripting XSS vulnerability in the content-management features available to authenticated admin users. The vulnerability resides in POSTed editor parameters submitted to the /posts/edit/id endpoint and similarly in Notice a...

CVE-2025-57205

iNiLabs School Express SMS Express 6.2 is affected by a Stored Cross-Site Scripting XSS vulnerability in the content-management features available to authenticated admin users. The vulnerability resides in POSTed editor parameters submitted to the /posts/edit/id endpoint and similarly in Notice a...

CVE-2025-57205: Improper Neutralization of Input During Web Page Generation

iNiLabs School Express SMS Express 6.2 is affected by a Stored Cross-Site Scripting XSS vulnerability in the content-management features available to authenticated admin users. The vulnerability resides in POSTed editor parameters submitted to the /posts/edit/id endpoint and similarly in Notice a...

CVE-2025-57205

iNiLabs School Express (SMS Express) version 6.2 is vulnerable to a Stored Cross-Site Scripting (XSS) flaw within its content-management features. The issue stems from insufficient input sanitization and output encoding of POSTed editor parameters submitted to the /posts/edit/{id} endpoint, as we...

CVE-2025-9905

creationtimestamp| type| source ---|---|--- 2025-09-19 10:32:08+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3lz6nxomxeo2b 2025-09-19 11:27:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lz6r36ijyp2t 2025-09-19 16:28:32+00:00| published-proof-of-concept|...

CVE-2025-30187

creationtimestamp| type| source ---|---|--- 2025-09-18 11:17:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lz47ztxdzp2g 2025-10-02 20:42:51+00:00| seen| https://bsky.app/profile/ferramentaslinux.bsky.social/post/3m2ag5mcysc2t...

CVE-2025-30519

creationtimestamp| type| source ---|---|--- 2025-09-18 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-07 2025-09-18 20:03:59+00:00| seen| https://bsky.app/profile/pigondrugs.bsky.social/post/3lz55hd4prc27 2025-09-19 01:32:16+00:00| seen|...

CVE-2025-54754

creationtimestamp| type| source ---|---|--- 2025-09-18 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-06 2025-09-18 20:03:18+00:00| seen| https://bsky.app/profile/pigondrugs.bsky.social/post/3lz55g3jmvi2g 2025-09-18 21:29:01+00:00| seen|...

CVE-2025-10493

creationtimestamp| type| source ---|---|--- 2025-09-18 07:27:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lz3t6amegp2x 2025-12-25 18:30:11+00:00| seen| https://bsky.app/profile/exploitdb-bot.bsky.social/post/3matfvqfi2l2u 2025-12-26 21:03:02+00:00| seen|...