WordPress Membership For WooCommerce plugin <= 2.8.0 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by zaim in WordPress Plugin Membership For WooCommerce versions = 2.8.0...

CVE-2025-39543

creationtimestamp| type| source ---|---|--- 2025-04-16 13:56:05+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/12049...

WordPress HelpGent plugin <= 2.2.5 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by LVT-tholv2k in WordPress Plugin HelpGent versions = 2.2.5...

Buffer Overflow

Overview Affected versions of this package are vulnerable to Buffer Overflow in hotspot/compiler due to improper handling of buffers in addnode.cpp. Remediation A fix was pushed into the master branch but not yet published. References - GitHub Commit - GitHub Commit - GitHub Commit - GitHub Commi...

GHSA-6MV3-WM7J-H4W5

creationtimestamp| type| source ---|---|--- 2025-04-15 03:54:31+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/11750...

WordPress Betheme Theme <= 28.0.3 is vulnerable to Cross Site Scripting (XSS)

Software Betheme Type Theme Vulnerable versions = 28.0.3 Fixed in 28.0.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2025-3077 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 7b297a9d938e Credits Webbernaut Required privilege...

GHSA-WVJG-9879-3M7W

creationtimestamp| type| source ---|---|--- 2025-04-14 23:53:50+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/11735...

Server-side Request Forgery (SSRF)

Overview agpt is an An open-source attempt to make GPT-4 autonomous Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the requests wrapper. An attacker can manipulate the request process to access unauthorized data or interact with internal services by...

WordPress Logo Carousel Gutenberg Block plugin <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via sliderId Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via sliderId Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin Logo Carousel Gutenberg Block versions = 2.1.6...

WordPress WooCommerce Products without featured images Plugin <= 0.1 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability

CSRF to Reflected Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 in WordPress Plugin WooCommerce Products without featured images versions = 0.1...

WordPress MemberPress Discord Addon Plugin <= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 in WordPress Plugin MemberPress Discord Addon versions = 1.1.1...

CVE-2021-4290

creationtimestamp| type| source ---|---|--- 2025-04-14 16:53:37+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/11644...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the soupmultipartnewfrommessage function. An attacker can induce the server to read out of bounds by sending a specially crafted HTTP request. Remediation A fix was pushed into the master branch but not yet...

WordPress TS Poll – Survey, Versus Poll, Image Poll, Video Poll plugin <= 2.4.6 - Authenticated (Administrator+) SQL Injection via 's' Parameter vulnerability

Authenticated Administrator+ SQL Injection via 's' Parameter vulnerability discovered by broccoli in WordPress Plugin TS Poll versions = 2.4.6...

WordPress PowerPress Podcasting plugin < 11.9.18 - Author+ XSS via Podcast URL vulnerability

Author+ XSS via Podcast URL vulnerability discovered by Bob Matyas in WordPress Plugin PowerPress Podcasting versions 11.9.18...

CVE-2022-46582

creationtimestamp| type| source ---|---|--- 2025-04-11 22:51:27+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/11498...

WordPress Cart66 Cloud plugin <= 2.3.7 - Unauthenticated Information Exposure vulnerability

Unauthenticated Information Exposure vulnerability discovered by Avraham Shemesh in WordPress Plugin Cart66 Cloud versions = 2.3.7...

CVE-2022-46596

creationtimestamp| type| source ---|---|--- 2025-04-11 16:51:10+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/11460...

WordPress Kargo Entegratör plugin <= 1.1.14 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Le Ngoc Anh Patchstack Alliance in WordPress Plugin Kargo Entegratör versions = 1.1.14...

WordPress WooCommerce Loyal Customers plugin <= 2.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mika in WordPress Plugin WooCommerce Loyal Customers versions = 2.6...