PT-2025-21502 · WordPress · Simple Job Board

Name of the Vulnerable Software and Affected Versions: Simple Job Board WordPress plugin versions prior to 2.12.2 Description: A vulnerability was found in the Simple Job Board WordPress plugin that allows Stored XSS on behalf of the editor by embedding malicious script. This can lead to account...

PT-2025-21428 · WordPress · Prisna Gwt Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Prisna GWT WordPress plugin versions prior to 1.4.14 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible even when the unfiltered html capability is disallowed,...

PT-2025-21429 · WordPress · Prisna Gwt Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Prisna GWT WordPress plugin versions prior to 1.4.14 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed, fo...

PT-2025-21326

Name of the Vulnerable Software and Affected Versions: Mattermost versions 10.5.x through 10.5.3 Mattermost versions 9.11.x through 9.11.11 Description: The issue arises when a user lacks access to ExperimentalSettings, causing the system to fail in checking the RestrictSystemAdmin setting. This...

PT-2025-21332 · Lila · Lila

Name of the Vulnerable Software and Affected Versions: Lila for Lichess version before ab0beaf Description: The issue is related to an innerHTML usage pattern in powertip.ts, where text is extracted from a DOM node and interpreted as HTML, allowing Cross-Site Scripting XSS in some applications...

PT-2025-21584 · Unknown · Sourcecodester Best Online News Portal

Name of the Vulnerable Software and Affected Versions: SourceCodester Best Online News Portal version 1.0 Description: A critical issue has been found, affecting an unknown function of the file /search.php. The manipulation of the searchtitle argument leads to SQL injection. This issue can be...

PT-2025-21549 · WordPress · Ekc Tournament Manager

Name of the Vulnerable Software and Affected Versions: EKC Tournament Manager versions prior to 2.2.2 Description: The issue concerns the lack of a CSRF check when updating settings in the EKC Tournament Manager WordPress plugin. This could allow attackers to make a logged-in admin change the...

PT-2025-21389

Name of the Vulnerable Software and Affected Versions: Advanced Schedule Posts WordPress plugin versions 2.1.8 and earlier Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back...

PT-2025-21387 · WordPress · Wp Dashboard Notes

Name of the Vulnerable Software and Affected Versions: WP Dashboard Notes versions prior to 1.0.11 Description: The issue concerns the WP Dashboard Notes WordPress plugin, where it fails to validate user access to the post id parameter in its wpdn update note AJAX action. This allows users with a...

PT-2025-21448 · WordPress · The Top Comments Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: The Top Comments WordPress plugin versions 1.0 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is...

PT-2025-21509 · WordPress · The Custom Author Base Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: The Custom Author Base WordPress plugin versions 1.1.1 and earlier Description: The issue is related to the lack of a CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack...

PT-2025-21437

Name of the Vulnerable Software and Affected Versions Advance Post Prefix WordPress plugin versions through 1.1.1 Description The Advance Post Prefix WordPress plugin does not properly sanitize and escape a parameter before displaying it, resulting in a Reflected Cross-Site Scripting issue. This...

PT-2025-21463 · WordPress · Podlove Podcast Publisher

Name of the Vulnerable Software and Affected Versions: Podlove Podcast Publisher WordPress plugin versions prior to 4.1.24 Description: The issue concerns the Podlove Podcast Publisher WordPress plugin, where some settings are not properly sanitized and escaped. This could allow high-privilege...

PT-2025-21468 · WordPress · The Ultimate Noindex Nofollow Tool Ii

Name of the Vulnerable Software and Affected Versions: The Ultimate Noindex Nofollow Tool II WordPress plugin versions prior to 1.3.6 Description: The issue concerns the lack of sanitization and escaping of some settings in the plugin, which could allow high-privilege users, such as admins, to...

PT-2025-21513 · WordPress · Ntz Antispam

Name of the Vulnerable Software and Affected Versions: Ntz Antispam WordPress plugin versions 2.0e and earlier Description: The issue concerns the lack of a CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. Recommendations: For...

PT-2025-21497 · WordPress · Dl Verification Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: DL Verification WordPress plugin versions 1.2 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example,...

PT-2025-21496

Name of the Vulnerable Software and Affected Versions: DL Robots.txt WordPress plugin versions 1.2 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks due to the plugin's failure to sanitise and escape some of its settings...

PT-2025-21342 · Unknown · Campcodes Sales/Inventory System

Name of the Vulnerable Software and Affected Versions: Campcodes Sales and Inventory System version 1.0 Description: A critical issue has been found in the system, affecting an unknown function of the file /pages/sales add.php. The manipulation of the discount argument leads to SQL injection. It ...

PT-2025-21446 · WordPress · Wp Erp

Name of the Vulnerable Software and Affected Versions: The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin versions prior to 1.13.4 Description: The issue allows employees to manipulate parameters and access the data of terminated...

PT-2025-21451 · WordPress · Learnpress

Name of the Vulnerable Software and Affected Versions: LearnPress WordPress plugin versions prior to 4.2.7.5.1 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because the plugin does not properly sanitise and...