CVE-2025-4171

CVE-2025-4171 affects the WordPress plugin WZ Followed Posts – Display what visitors are reading, with Stored XSS via the wfp shortcode in all versions up to 3.1.0. The vulnerability requires authenticated access at the Contributor level or higher and arises from insufficient input sanitization a...

PT-2025-20035 · WordPress · Wz Followed Posts

Name of the Vulnerable Software and Affected Versions: WZ Followed Posts – Display what visitors are reading plugin for WordPress versions up to and including 3.1.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'wfp' shortcode due to insufficient input...

PT-2025-20176 · Data443 Risk Mitigation · Inline Related Posts

Name of the Vulnerable Software and Affected Versions: Data443 Risk Migitation, Inc. Inline Related Posts versions n/a through 3.8.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Stored XSS in...

PT-2025-20136 · Unknown · Eli'S Related Posts Footer Links/Widget

Name of the Vulnerable Software and Affected Versions: ELI's Related Posts Footer Links and Widget versions 1.2.04.20 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended...

PT-2025-20130 · Unknown · Contextual Related Posts

Name of the Vulnerable Software and Affected Versions: Ajay Contextual Related Posts versions n/a through 4.0.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows DOM-Based XSS. This means that an...

CVE-2025-4171: Improper Neutralization of Input During Web Page Generation

The WZ Followed Posts – Display what visitors are reading plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wfp' shortcode in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...

CVE-2025-47514: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Eli ELI's Related Posts Footer Links and Widget spostarbust allows Stored XSS.This issue affects ELI's Related Posts Footer Links and Widget: from n/a through = 1.2.04.20...

CVE-2025-47506: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ajay Contextual Related Posts contextual-related-posts allows DOM-Based XSS.This issue affects Contextual Related Posts: from n/a through = 4.0.2...

CVE-2025-47484: Server-Side Request Forgery (SSRF)

Server-Side Request Forgery SSRF vulnerability in Oliver Campion Display Remote Posts Block display-remote-posts-block allows Server Side Request Forgery.This issue affects Display Remote Posts Block: from n/a through = 1.1.0...

CVE-2025-47636: Path Traversal: '.../...//'

Path Traversal: '.../...//' vulnerability in Fernando Briano List category posts list-category-posts allows PHP Local File Inclusion.This issue affects List category posts: from n/a through = 0.91.0...

CVE-2025-47604: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Data443 Risk Mitigation, Inc. Inline Related Posts intelly-related-posts allows Stored XSS.This issue affects Inline Related Posts: from n/a through = 3.8.0...

CVE-2025-2905

creationtimestamp| type| source ---|---|--- 2025-05-05 09:18:55+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/14842 2025-05-05 10:21:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3log5hwunmf2o 2025-05-05 13:01:47+00:00| seen|...

Improper Authorization

github.com/mattermost/mattermost-server is vulnerable to improper authorization. The vulnerability is due to insufficient permission validation for the API endpoint /plugins/playbooks/api/v0/signal/keywords/ignore-thread, allowing any user or attacker to delete posts created by the Playbooks bot...

CVE-2025-4237

creationtimestamp| type| source ---|---|--- 2025-05-03 15:19:06+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/14695 2025-05-03 16:38:46+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lobq6adw53s2 2025-05-03...

CVE-2024-13738

creationtimestamp| type| source ---|---|--- 2025-05-03 03:00:20+00:00| seen| https://bsky.app/profile/potato.software/post/3loadvtqidf2m 2025-05-03 03:26:30+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3loafeewn5vx2 2025-05-03...

CVE-2023-53141

creationtimestamp| type| source ---|---|--- 2025-05-02 17:34:19+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lo7c2mv5kd32 2025-05-02 20:06:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lo7mr4dh5p2t 2025-05-02...

CVE-2025-2421

creationtimestamp| type| source ---|---|--- 2025-05-02 12:15:26+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/14470 2025-05-02 14:30:45+00:00| seen| Telegram/gpPWfjLuV20S4nQMGoLdmx6S8j9EZS2EZ0Gv11uVGyL8 2025-05-02 14:38:25+00:00| seen|...

CVE-2025-1326: Missing Authorization

The Homey theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the homeyreservationdel function in all versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete...

CVE-2025-46337

creationtimestamp| type| source ---|---|--- 2025-05-01 17:57:29+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114433867704399481 2025-05-01 20:00:50+00:00| published-proof-of-concept| Telegram/QFVP5TcYkEi5fC3DYhpbJ3tJ8sPusYmL1ImuYd1RRjGW6cE 2025-05-01 20:35:57+00:00| seen|...

CVE-2025-3952

creationtimestamp| type| source ---|---|--- 2025-05-01 05:14:24+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/14234 2025-05-01 05:48:40+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114431001387714484 2025-05-01 05:56:14+00:00| seen|...