PT-2025-17901 · WordPress · Ws Form Lite

Name of the Vulnerable Software and Affected Versions: WS Form LITE – Drag & Drop Contact Form Builder for WordPress versions prior to 1.10.36 Description: The issue allows unauthorized access to data due to a missing capability check on the get config function. This makes it possible for...

PT-2025-10: Server-Side Request Forgery (SSRF) in HTML2PDF

The application performs insufficient validation of the destination address before sending an HTTP request. The vulnerability exploitation leads to the disclosure of sensitive data, denial of service, and etc. Vulnerability status: Confirmed by vendor Date of vulnerability remediation: 25.04.2025...

PT-2025-17878 · WordPress · Shoplentor

Name of the Vulnerable Software and Affected Versions: The ShopLentor plugin for WordPress versions up to, and including, 3.1.2 Description: The issue allows unauthenticated attackers to make web requests to arbitrary locations originating from the web application, potentially querying and...

PT-2025-17772 · Unknown · Novium Wowhead Tooltips

Name of the Vulnerable Software and Affected Versions: Novium WoWHead Tooltips versions n/a through 2.0.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

PT-2025-17747 · Unknown · Acf: Google Font Selector

Name of the Vulnerable Software and Affected Versions: ACF: Google Font Selector versions 3.0.1 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for reflected cross-site scripting XSS. This can be exploited through the ACF:...

PT-2025-17745 · Capturly · Capturly

Name of the Vulnerable Software and Affected Versions: Capturly versions n/a through 2.0.1 Description: The issue is related to Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability. This allows PHP Local File Inclusion ...

PT-2025-17868

Name of the Vulnerable Software and Affected Versions React Router versions 7.0 through 7.5.1 Description The issue allows an attacker to modify pre-rendered data by adding a header to the request, potentially leading to various exploits, including stored XSS. This is possible due to a...

PT-2025-17794 · Unknown · Nepali Post Date

Name of the Vulnerable Software and Affected Versions: Nepali Post Date versions through 5.1.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject...

PT-2025-17736 · Unknown · Online Class/Exam Scheduling System

Name of the Vulnerable Software and Affected Versions: Online Class and Exam Scheduling System version 1.0 Description: A vulnerability has been discovered in the code, affecting some unknown features in the file /Scheduling/pages/class sched.php. Manipulating the class parameter can lead to...

PT-2025-17773 · Unknown · Occupancyplan

Name of the Vulnerable Software and Affected Versions: occupancyplan versions 1.0.3.0 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. Recommendations: For versions 1.0.3.0 and earlier, update to a version that contains a fix for this...

PT-2025-17741 · Unknown · Cww Portfolio

Name of the Vulnerable Software and Affected Versions: CWW Portfolio versions 1.3.1 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion. This...

PT-2025-17804 · Unknown · Navegg Analytics

Name of the Vulnerable Software and Affected Versions: Navegg Analytics versions n/a through 3.3.3 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS in Navegg Analytics. Recommendations: For versions n/a through 3.3.3, update to a version that contai...

PT-2025-17777 · Unknown · Wp Custom Cms Block

Name of the Vulnerable Software and Affected Versions: Wp Custom CMS Block versions through 2.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application,...

PT-2025-17690

Name of the Vulnerable Software and Affected Versions The-wound WordPress theme version 0.0.1 Description The issue concerns the failure to validate certain parameters before using them to generate paths passed to include functions, allowing unauthenticated users to perform Local File Inclusion L...

PT-2025-17850

Name of the Vulnerable Software and Affected Versions h11 versions prior to 0.16.0 Description h11 is a Python implementation of HTTP/1.1. A leniency in h11's parsing of line terminators in chunked-coding message bodies can lead to request smuggling vulnerabilities under certain conditions. This...

PT-2025-17753 · Woocommerce · Checkout Field Visibility For Woocommerce

Name of the Vulnerable Software and Affected Versions: Checkout Field Visibility for WooCommerce versions 1.2.3 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion'. This allows for...

PT-2025-17809 · Unknown · Josheli Simple Google Photos Grid

Name of the Vulnerable Software and Affected Versions: josheli Simple Google Photos Grid versions 1.5 and earlier Description: The issue is related to a Server-Side Request Forgery SSRF vulnerability, which allows for Server Side Request Forgery. Recommendations: For versions 1.5 and earlier,...

PT-2025-17734 · Unknown · Code-Projects Online Class/Exam Scheduling System

Name of the Vulnerable Software and Affected Versions: Code-Projects Online Class and Exam Scheduling System version 1.0 Description: A vulnerability was found in the file /Scheduling/pages/class save.php, where manipulation of the class parameter can lead to SQL injection attacks. Recommendation...

PT-2025-17822 · WordPress · Blog Manager Wp

Name of the Vulnerable Software and Affected Versions: Blog Manager WP versions 1.0.0 through 1.0.5 Description: The issue is related to improper neutralization of input during web page generation, which leads to a Cross-site Scripting XSS vulnerability. Specifically, it is a Stored XSS...

PT-2025-17785 · Unknown · Smart Hashtags

Name of the Vulnerable Software and Affected Versions: Smart Hashtags versions through 7.2.3 Description: The issue is related to a Missing Authorization vulnerability, which allows exploitation of incorrectly configured access control security levels. Recommendations: For versions through 7.2.3,...