PT-2025-21584 · Unknown · Sourcecodester Best Online News Portal

Name of the Vulnerable Software and Affected Versions: SourceCodester Best Online News Portal version 1.0 Description: A critical issue has been found, affecting an unknown function of the file /search.php. The manipulation of the searchtitle argument leads to SQL injection. This issue can be...

PT-2025-21414 · WordPress · Social Share/Social Locker

Name of the Vulnerable Software and Affected Versions: The Social Share And Social Locker WordPress plugin versions prior to 1.4.2 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html...

PT-2025-21403 · WordPress · Responsive Contact Form Builder & Lead Generation Plugin

Name of the Vulnerable Software and Affected Versions: Responsive Contact Form Builder & Lead Generation Plugin versions prior to 1.9.8 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html...

PT-2025-21526 · WordPress · Ajax Search Lite

Name of the Vulnerable Software and Affected Versions: Ajax Search Lite versions prior to 4.12.3 Description: The issue concerns the Ajax Search Lite WordPress plugin, which does not properly sanitize and escape some of its settings. This could allow high-privilege users, such as administrators, ...

PT-2025-21404 · WordPress · Contact Form

Name of the Vulnerable Software and Affected Versions: Contact Form, Survey, Quiz & Popup Form Builder versions prior to 1.7.1 Description: The issue concerns the WordPress plugin Contact Form, Survey, Quiz & Popup Form Builder, where it fails to properly sanitise and escape certain parameters wh...

PT-2025-21276 · Esignal · Esignal

Name of the Vulnerable Software and Affected Versions: eSigna versions 1.0 through 1.5 Description: The issue is related to an Insecure Direct Object Reference IDOR vulnerability in the eSignaViewer component. This vulnerability allows an unauthenticated attacker to access arbitrary files in the...

PT-2025-21342 · Unknown · Campcodes Sales/Inventory System

Name of the Vulnerable Software and Affected Versions: Campcodes Sales and Inventory System version 1.0 Description: A critical issue has been found in the system, affecting an unknown function of the file /pages/sales add.php. The manipulation of the discount argument leads to SQL injection. It ...

PT-2025-21539 · WordPress · Powerpress Podcasting Plugin

Name of the Vulnerable Software and Affected Versions: PowerPress Podcasting plugin by Blubrry for WordPress versions prior to 11.9.18 Description: The issue concerns the PowerPress Podcasting plugin's failure to properly sanitize and escape certain settings when adding a podcast. This could enab...

PT-2025-21560 · WordPress · Download Html Tinymce Button

Name of the Vulnerable Software and Affected Versions: Download HTML TinyMCE Button WordPress plugin versions 1.2 and earlier Description: The issue concerns a Reflected Cross-Site Scripting problem. It arises because a parameter is not properly sanitized and escaped before being outputted back i...

PT-2025-21468 · WordPress · The Ultimate Noindex Nofollow Tool Ii

Name of the Vulnerable Software and Affected Versions: The Ultimate Noindex Nofollow Tool II WordPress plugin versions prior to 1.3.6 Description: The issue concerns the lack of sanitization and escaping of some settings in the plugin, which could allow high-privilege users, such as admins, to...

PT-2025-21521 · WordPress · Hustle

Name of the Vulnerable Software and Affected Versions: Hustle WordPress plugin versions 7.8.5 and earlier Description: The issue concerns the Hustle WordPress plugin, which does not properly sanitise and escape some of its settings. This could allow high-privilege users, such as editors, to perfo...

PT-2025-21413 · WordPress · Sailthru Triggermail Plugin

Name of the Vulnerable Software and Affected Versions: Sailthru Triggermail plugin for WordPress versions 1.1 and earlier Description: The issue concerns the Sailthru Triggermail WordPress plugin, which does not properly sanitise and escape some of its settings. Additionally, it lacks CSRF...

PT-2025-21543 · Unknown · Free Booking Plugin

Name of the Vulnerable Software and Affected Versions: Free Booking Plugin for Hotels, Restaurants and Car Rentals versions prior to 1.3.15 Description: The issue concerns the lack of CSRF check when updating settings, which could allow attackers to make a logged-in subscriber change them via a...

PT-2025-21475 · WordPress · Responsive Gallery Grid

Name of the Vulnerable Software and Affected Versions: The Responsive Gallery Grid WordPress plugin versions prior to 2.3.15 Description: The issue concerns the lack of sanitization and escaping of some settings in the plugin, which could allow high-privilege users, such as admins, to perform...

PT-2025-21415

Name of the Vulnerable Software and Affected Versions: jwp-a11y WordPress plugin versions 4.1.7 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some settings are not properly sanitised and...

PT-2025-21514 · WordPress · Babelz

Name of the Vulnerable Software and Affected Versions: BabelZ WordPress plugin versions 1.1.5 and earlier Description: The issue concerns the lack of CSRF check and missing sanitization as well as escaping in certain areas of the plugin. This could allow attackers to make logged-in admins add...

PT-2025-21273 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 9.11.x through 10.6.1 Description: The issue allows attackers to lock external LDAP accounts through repeated login failures due to Mattermost's failure to lock out LDAP users following repeated login failures...

PT-2025-21463 · WordPress · Podlove Podcast Publisher

Name of the Vulnerable Software and Affected Versions: Podlove Podcast Publisher WordPress plugin versions prior to 4.1.24 Description: The issue concerns the Podlove Podcast Publisher WordPress plugin, where some settings are not properly sanitized and escaped. This could allow high-privilege...

PT-2025-21411 · WordPress · Wp Google Review Slider

Name of the Vulnerable Software and Affected Versions: WP Google Review Slider versions prior to 15.6 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed, for...

PT-2025-21509 · WordPress · The Custom Author Base Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: The Custom Author Base WordPress plugin versions 1.1.1 and earlier Description: The issue is related to the lack of a CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack...