RUSTSEC-2025-0024 crossbeam-channel: double free on Drop

The internal Channel type's Drop method has a race which could, in some circumstances, lead to a double-free. This could result in memory corruption. Quoting from the upstream description in merge request \1187: The problem lies in the fact that dicardallmessages contained two paths that could le...

WordPress Motors plugin <= 1.4.64 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Plugin Installation vulnerability discovered by mikemyers in WordPress Plugin Motors versions = 1.4.64...

WordPress coreActivity: Activity Logging for WordPress plugin <= 2.7 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Yassine NEGGAOUI in WordPress Plugin coreActivity: Activity Logging plugin for WordPress versions = 2.7...

WordPress WPFront User Role Editor plugin <= 4.2.1 - Cross-Site Request Forgery to Privilege Escalation via whitelist_options Function vulnerability

Cross-Site Request Forgery to Privilege Escalation via whitelistoptions Function vulnerability discovered by WordFence in WordPress Plugin WPFront User Role Editor versions = 4.2.1...

WordPress GreenPay plugin 3.0.0-3.0.9 - Unauthenticated Information Exposure vulnerability

Unauthenticated Information Exposure vulnerability discovered by Avraham Shemesh in WordPress Plugin GreenPay versions 3.0.0-3.0.9...

WordPress Asgaros Forum plugin <= 3.0.0 - File Upload Numbers Bypass vulnerability

File Upload Numbers Bypass vulnerability discovered by 20kilograma in WordPress Plugin Asgaros Forum versions = 3.0.0...

GHSA-WFPW-HFCP-9M73

creationtimestamp| type| source ---|---|--- 2025-04-06 20:44:01+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/10643...

GHSA-F42F-6FVV-XQX3

creationtimestamp| type| source ---|---|--- 2025-04-06 19:44:13+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/10639 2025-04-06 22:30:35+00:00| published-proof-of-concept| Telegram/9YoJkce8ZLrbJOFjVGYj1Vi2UBwBRdx3KAe6xADJGY12VGo...

vpsmalaysia.com.my Open Redirect vulnerability OBB-4042355

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

WordPress Lafka Plugin plugin <= 7.1.0 - Missing Authorization to Authenticated (Subscriber+) Theme Option Update vulnerability

Missing Authorization to Authenticated Subscriber+ Theme Option Update vulnerability discovered by István Márton in WordPress Plugin Lafka Plugin versions = 7.1.0...

WordPress ZoomSounds plugin <= 6.91 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by István Márton in WordPress Plugin ZoomSounds versions = 6.91...

WordPress UltraAddons – Elementor Addons plugin <= 2.0.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin UltraAddons Elementor Lite versions = 2.0.2...

WordPress RDP Wiki Embed plugin <= 1.2.20 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nabil Irawan in WordPress Plugin RDP Wiki Embed versions = 1.2.20...

WordPress DirectoryPress Plugin <= 3.6.22 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by thiennv in WordPress Plugin DirectoryPress versions = 3.6.22...

WordPress MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin <= 5.9.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin MP3 Audio Player for Music, Radio & Podcast by Sonaar versions = 5.9.4...

WordPress StaffList plugin <= 3.2.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Anhchangmutrang in WordPress Plugin StaffList versions = 3.2.7...

WordPress Privyr CRM plugin <= 1.0.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Privyr CRM Integration versions = 1.0.2...

WordPress Motors plugin <= 1.4.71 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by LVT-tholv2k in WordPress Plugin Motors versions = 1.4.71...

WordPress Arkhe Blocks plugin <= 2.27.1 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by zaim in WordPress Plugin Arkhe Blocks versions = 2.27.1...

WordPress Posts Footer Manager plugin <= 2.2.0 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by timomangcut in WordPress Plugin Posts Footer Manager versions = 2.2.0...