PT-2025-21447

Name of the Vulnerable Software and Affected Versions: The Custom Field Manager WordPress plugin version 1.0 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page...

PT-2025-21505 · WordPress · The Joy Of Text Lite

Name of the Vulnerable Software and Affected Versions: The Joy Of Text Lite WordPress plugin versions 2.3.1 and earlier Description: The issue is related to the lack of a CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack...

PT-2025-21438 · WordPress · Advance Post Prefix

Name of the Vulnerable Software and Affected Versions: Advance Post Prefix WordPress plugin versions 1.1.1 and earlier Description: The issue allows admins and above to perform SQL injection attacks due to a parameter not being sanitized and escaped before use in a SQL statement. Recommendations:...

PT-2025-21508 · WordPress · The Smooth Gallery Replacement

Name of the Vulnerable Software and Affected Versions: The Smooth Gallery Replacement WordPress plugin versions 1.0 and earlier Description: The issue is related to the lack of CSRF checks in some areas of the plugin, as well as missing sanitization and escaping. This could allow attackers to mak...

PT-2025-21466 · WordPress · The Badgearoo

Name of the Vulnerable Software and Affected Versions: The Badgearoo WordPress plugin versions 1.0.14 and earlier Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the...

PT-2025-21462 · WordPress · Memberspace

Name of the Vulnerable Software and Affected Versions: MemberSpace WordPress plugin versions prior to 2.1.14 Description: The issue arises from the plugin's failure to sanitise and escape a parameter before outputting it back in the page. This leads to a Reflected Cross-Site Scripting issue that...

PT-2025-21411 · WordPress · Wp Google Review Slider

Name of the Vulnerable Software and Affected Versions: WP Google Review Slider versions prior to 15.6 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed, for...

PT-2025-21414 · WordPress · Social Share/Social Locker

Name of the Vulnerable Software and Affected Versions: The Social Share And Social Locker WordPress plugin versions prior to 1.4.2 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html...

PT-2025-21336 · Ni · Ni Circuit Design Suite

Name of the Vulnerable Software and Affected Versions: NI Circuit Design Suite versions 14.3.0 and prior versions Description: The issue is due to a memory corruption vulnerability caused by an out of bounds read in the GetSymbolBorderRectSize function when using the SymbolEditor. This may result...

PT-2025-21541 · WordPress · Team

Name of the Vulnerable Software and Affected Versions: Team WordPress plugin versions prior to 4.4.2 Description: The issue allows high privilege users, such as administrators, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed, f...

PT-2025-21539 · WordPress · Powerpress Podcasting Plugin

Name of the Vulnerable Software and Affected Versions: PowerPress Podcasting plugin by Blubrry for WordPress versions prior to 11.9.18 Description: The issue concerns the PowerPress Podcasting plugin's failure to properly sanitize and escape certain settings when adding a podcast. This could enab...

PT-2025-21548 · WordPress · Ekc Tournament Manager

Name of the Vulnerable Software and Affected Versions: EKC Tournament Manager WordPress plugin versions prior to 2.2.2 Description: The issue is related to the lack of a CSRF check when updating settings in the EKC Tournament Manager WordPress plugin. This could allow attackers to make a logged-i...

PT-2025-21543 · Unknown · Free Booking Plugin

Name of the Vulnerable Software and Affected Versions: Free Booking Plugin for Hotels, Restaurants and Car Rentals versions prior to 1.3.15 Description: The issue concerns the lack of CSRF check when updating settings, which could allow attackers to make a logged-in subscriber change them via a...

PT-2025-21415

Name of the Vulnerable Software and Affected Versions: jwp-a11y WordPress plugin versions 4.1.7 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some settings are not properly sanitised and...

PT-2025-21521 · WordPress · Hustle

Name of the Vulnerable Software and Affected Versions: Hustle WordPress plugin versions 7.8.5 and earlier Description: The issue concerns the Hustle WordPress plugin, which does not properly sanitise and escape some of its settings. This could allow high-privilege users, such as editors, to perfo...

PT-2025-21325

Name of the Vulnerable Software and Affected Versions: Mattermost versions 10.5.x through 10.5.2 Mattermost versions 9.11.x through 9.11.11 Description: The issue is related to improper verification of a user's permissions when accessing groups. This allows an attacker to view group information v...

PT-2025-21263 · Unknown · Pgina.Fork

Name of the Vulnerable Software and Affected Versions: pGina.Fork versions 3.9.9.12 and earlier Description: The issue allows authentication bypass when an adversary controls DNS resolution for pginaloginserver. This occurs due to a flaw in the HttpAuth plugin. Recommendations: For versions...

PT-2025-21574 · Unknown · Itsourcecode Placement Management System

Name of the Vulnerable Software and Affected Versions: itsourcecode Placement Management System version 1.0 Description: A critical issue affects the processing of the file /drive.php. The manipulation of the ID argument leads to SQL injection. This issue can be exploited remotely. Recommendation...

PT-2025-21577 · Unknown · Itsourcecode Placement Management System

Name of the Vulnerable Software and Affected Versions: itsourcecode Placement Management System version 1.0 Description: A critical issue has been discovered, affecting an unknown function of the file /edit profile.php. The manipulation of the Name argument leads to SQL injection. This issue can ...

PT-2025-21568 · Horilla · Horilla

Name of the Vulnerable Software and Affected Versions: Horilla versions prior to 1.3 Description: Horilla is a free and open source Human Resource Management System HRMS. In affected versions, an attacker can manipulate a Horilla URL to refer to an external domain. Upon clicking and logging in, t...