PT-2025-21429 · WordPress · Prisna Gwt Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Prisna GWT WordPress plugin versions prior to 1.4.14 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed, fo...

PT-2025-21574 · Unknown · Itsourcecode Placement Management System

Name of the Vulnerable Software and Affected Versions: itsourcecode Placement Management System version 1.0 Description: A critical issue affects the processing of the file /drive.php. The manipulation of the ID argument leads to SQL injection. This issue can be exploited remotely. Recommendation...

PT-2025-21424 · WordPress · Tarteaucitron-Wp

Name of the Vulnerable Software and Affected Versions: tarteaucitron-wp WordPress plugin versions prior to 0.3.0 Description: The issue concerns a lack of CSRF check in some areas and missing sanitization as well as escaping. This could allow attackers to make logged-in admins add Stored XSS...

PT-2025-21446 · WordPress · Wp Erp

Name of the Vulnerable Software and Affected Versions: The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin versions prior to 1.13.4 Description: The issue allows employees to manipulate parameters and access the data of terminated...

PT-2025-21569 · Spotipy · Spotipy

Name of the Vulnerable Software and Affected Versions: Spotipy versions prior to the commit that reverted the change commit 9dfb7177b8d7bb98a5a6014f8e6436812a47576f Description: The issue concerns the use of pull request target in .github/workflows/integration tests.yml, which can be exploited by...

PT-2025-21332 · Lila · Lila

Name of the Vulnerable Software and Affected Versions: Lila for Lichess version before ab0beaf Description: The issue is related to an innerHTML usage pattern in powertip.ts, where text is extracted from a DOM node and interpreted as HTML, allowing Cross-Site Scripting XSS in some applications...

PT-2025-21428 · WordPress · Prisna Gwt Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Prisna GWT WordPress plugin versions prior to 1.4.14 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible even when the unfiltered html capability is disallowed,...

PT-2025-21519 · Unknown · Webtoffee-Gdpr-Cookie-Consent

Name of the Vulnerable Software and Affected Versions: webtoffee-gdpr-cookie-consent versions prior to 2.6.1 Description: The issue allows visitors to conduct Stored Cross-Site Scripting attacks due to improper sanitization and escaping of IP headers when logging them. The payload is triggered wh...

PT-2025-21539 · WordPress · Powerpress Podcasting Plugin

Name of the Vulnerable Software and Affected Versions: PowerPress Podcasting plugin by Blubrry for WordPress versions prior to 11.9.18 Description: The issue concerns the PowerPress Podcasting plugin's failure to properly sanitize and escape certain settings when adding a podcast. This could enab...

PT-2025-21400 · WordPress · Hubbub Lite

Name of the Vulnerable Software and Affected Versions: Hubbub Lite WordPress plugin versions prior to 1.34.4 Description: The issue allows high privilege users, such as administrators, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is...

PT-2025-21383 · WordPress · The Illi Link Party!

Name of the Vulnerable Software and Affected Versions: The illi Link Party! WordPress plugin version 1.0 Description: The issue allows unauthenticated visitors to perform Cross-Site Scripting attacks due to the plugin's failure to sanitise and escape some parameters. Recommendations: For The illi...

PT-2025-21342 · Unknown · Campcodes Sales/Inventory System

Name of the Vulnerable Software and Affected Versions: Campcodes Sales and Inventory System version 1.0 Description: A critical issue has been found in the system, affecting an unknown function of the file /pages/sales add.php. The manipulation of the discount argument leads to SQL injection. It ...

PT-2025-21413 · WordPress · Sailthru Triggermail Plugin

Name of the Vulnerable Software and Affected Versions: Sailthru Triggermail plugin for WordPress versions 1.1 and earlier Description: The issue concerns the Sailthru Triggermail WordPress plugin, which does not properly sanitise and escape some of its settings. Additionally, it lacks CSRF...

PT-2025-21403 · WordPress · Responsive Contact Form Builder & Lead Generation Plugin

Name of the Vulnerable Software and Affected Versions: Responsive Contact Form Builder & Lead Generation Plugin versions prior to 1.9.8 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html...

PT-2025-21568 · Horilla · Horilla

Name of the Vulnerable Software and Affected Versions: Horilla versions prior to 1.3 Description: Horilla is a free and open source Human Resource Management System HRMS. In affected versions, an attacker can manipulate a Horilla URL to refer to an external domain. Upon clicking and logging in, t...

PT-2025-21545 · WordPress · Posts Filter +4

Name of the Vulnerable Software and Affected Versions: Post Grid, Posts Slider, Posts Carousel, Post Filter, Post Masonry WordPress plugin versions prior to 2.2.93 Description: The issue concerns the WordPress plugin's failure to validate and escape some of its block options before outputting the...

PT-2025-21408 · WordPress · Auto Prune Posts

Name of the Vulnerable Software and Affected Versions: Auto Prune Posts WordPress plugin versions prior to 3.0.0 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some settings are not properly sanitised an...

PT-2025-21514 · WordPress · Babelz

Name of the Vulnerable Software and Affected Versions: BabelZ WordPress plugin versions 1.1.5 and earlier Description: The issue concerns the lack of CSRF check and missing sanitization as well as escaping in certain areas of the plugin. This could allow attackers to make logged-in admins add...

PT-2025-21475 · WordPress · Responsive Gallery Grid

Name of the Vulnerable Software and Affected Versions: The Responsive Gallery Grid WordPress plugin versions prior to 2.3.15 Description: The issue concerns the lack of sanitization and escaping of some settings in the plugin, which could allow high-privilege users, such as admins, to perform...

PT-2025-21572 · Unknown · Campcodes Sales/Inventory System

Name of the Vulnerable Software and Affected Versions: Campcodes Sales and Inventory System version 1.0 Description: A critical issue was found in the system, affecting an unknown functionality of the file /pages/cash transaction.php. The manipulation of the cid argument leads to SQL injection...