PT-2025-21541 · WordPress · Team

Name of the Vulnerable Software and Affected Versions: Team WordPress plugin versions prior to 4.4.2 Description: The issue allows high privilege users, such as administrators, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed, f...

PT-2025-21469 · WordPress · Easy Property Listings

Name of the Vulnerable Software and Affected Versions: Easy Property Listings WordPress plugin versions prior to 3.5.4 Description: The issue concerns the Easy Property Listings WordPress plugin, which does not properly sanitise and escape some of its settings. This could allow high-privilege...

PT-2025-21408 · WordPress · Auto Prune Posts

Name of the Vulnerable Software and Affected Versions: Auto Prune Posts WordPress plugin versions prior to 3.0.0 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some settings are not properly sanitised an...

PT-2025-21438 · WordPress · Advance Post Prefix

Name of the Vulnerable Software and Affected Versions: Advance Post Prefix WordPress plugin versions 1.1.1 and earlier Description: The issue allows admins and above to perform SQL injection attacks due to a parameter not being sanitized and escaped before use in a SQL statement. Recommendations:...

PT-2025-21423 · WordPress · Tarteaucitron-Wp

Name of the Vulnerable Software and Affected Versions: tarteaucitron-wp WordPress plugin versions prior to 0.3.0 Description: The issue allows author level and above users to add HTML into a post/page, which could enable users with the contributor role and above to perform Stored Cross-Site...

PT-2025-21572 · Unknown · Campcodes Sales/Inventory System

Name of the Vulnerable Software and Affected Versions: Campcodes Sales and Inventory System version 1.0 Description: A critical issue was found in the system, affecting an unknown functionality of the file /pages/cash transaction.php. The manipulation of the cid argument leads to SQL injection...

PT-2025-21260 · WordPress · Weluka Lite

Name of the Vulnerable Software and Affected Versions: Weluka Lite plugin for WordPress versions up to, and including, 1.0.3 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'weluka-map' shortcode due to insufficient input sanitization and output escaping on...

PT-2025-21410 · WordPress · Jsfiddle Shortcode

Name of the Vulnerable Software and Affected Versions: JSFiddle Shortcode plugin for WordPress versions prior to 1.1.3 Description: The issue concerns the JSFiddle Shortcode plugin for WordPress, where it fails to validate and escape some of its shortcode attributes before outputting them back in...

PT-2025-21474 · WordPress · Advanced Cron Manager

Name of the Vulnerable Software and Affected Versions: The Advanced Cron Manager WordPress plugin versions prior to 2.5.7 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for...

PT-2025-21473 · WordPress · Carousel

Name of the Vulnerable Software and Affected Versions: The Carousel, Slider, Gallery by WP Carousel WordPress plugin versions prior to 2.6.9 Description: The issue concerns the lack of sanitization and escaping of some settings in the plugin, which could allow high-privilege users, such as admins...

PT-2025-21387 · WordPress · Wp Dashboard Notes

Name of the Vulnerable Software and Affected Versions: WP Dashboard Notes versions prior to 1.0.11 Description: The issue concerns the WP Dashboard Notes WordPress plugin, where it fails to validate user access to the post id parameter in its wpdn update note AJAX action. This allows users with a...

PT-2025-21475 · WordPress · Responsive Gallery Grid

Name of the Vulnerable Software and Affected Versions: The Responsive Gallery Grid WordPress plugin versions prior to 2.3.15 Description: The issue concerns the lack of sanitization and escaping of some settings in the plugin, which could allow high-privilege users, such as admins, to perform...

Debian dla-4165 : open-vm-tools - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4165 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4165-1 [email protected] https://www.debian.org/lts/security/...

PT-2025-21415

Name of the Vulnerable Software and Affected Versions: jwp-a11y WordPress plugin versions 4.1.7 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some settings are not properly sanitised and...

Eclipse Jetty Information Disclosure Vulnerability (GHSA-q4rv-gq96-w7c5) - Linux

Eclipse Jetty is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:eclipse:jetty"...

PT-2025-21326 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 10.5.x through 10.5.3 Mattermost versions 9.11.x through 9.11.11 Description: The issue arises when a user lacks access to ExperimentalSettings, causing the system to fail in checking the RestrictSystemAdmin setting. This...

PT-2025-21545 · WordPress · Posts Filter +4

Name of the Vulnerable Software and Affected Versions: Post Grid, Posts Slider, Posts Carousel, Post Filter, Post Masonry WordPress plugin versions prior to 2.2.93 Description: The issue concerns the WordPress plugin's failure to validate and escape some of its block options before outputting the...

PT-2025-21568 · Horilla · Horilla

Name of the Vulnerable Software and Affected Versions: Horilla versions prior to 1.3 Description: Horilla is a free and open source Human Resource Management System HRMS. In affected versions, an attacker can manipulate a Horilla URL to refer to an external domain. Upon clicking and logging in, t...

PT-2025-21506 · WordPress · Sensei Lms

Name of the Vulnerable Software and Affected Versions: The Sensei LMS WordPress plugin versions prior to 4.20.0 Description: The issue allows disclosure of all users of the blog, including their email addresses, to teachers on the students page. Recommendations: For versions prior to 4.20.0, upda...

PT-2025-21529 · WordPress · Z-Downloads

Name of the Vulnerable Software and Affected Versions: Z-Downloads versions prior to 1.11.7 Description: The issue concerns the Z-Downloads WordPress plugin, which does not properly validate uploaded files. This allows for the uploading of SVG files that contain malicious JavaScript...