PT-2025-16168 · WordPress · User Registration & Membership

Name of the Vulnerable Software and Affected Versions: User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress versions up to, and including, 4.1.3 Description: The issue allows unauthenticated attackers to update other users' passwords if they...

PT-2025-16169 · WordPress · Wpc Admin Columns

Name of the Vulnerable Software and Affected Versions: WPC Admin Columns plugin for WordPress versions 2.0.6 through 2.1.0 Description: The issue is related to privilege escalation due to the plugin not properly restricting user meta values that can be updated through the ajax edit save function...

CVE-2025-31932

Deserialization of untrusted data issue exists in BizRobo! all versions. If this vulnerability is exploited, an arbitrary code is executed on the Management Console. The vendor provides the workaround information and recommends to apply it to the deployment environment...

CVE-2025-31362

BizRobo! is affected by CVE-2025-31362 due to use of a hard-coded cryptographic key (CWE-321). Credentials inside robot files may be obtained if the encryption key is available. Affected product: BizRobo! all versions. Impact stated: credentials in robot files may be disclosed when the key is kno...

PT-2025-16094 · Unknown · Notfound Testimonial Slider/Showcase Pro

Name of the Vulnerable Software and Affected Versions: NotFound Testimonial Slider And Showcase Pro versions 2.3.15 and earlier Description: The issue is related to improper control of filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows P...

PT-2025-16041 · WordPress · Mailhawk

Name of the Vulnerable Software and Affected Versions: Adrian Tobey WordPress SMTP Service, Email Delivery Solved! — MailHawk versions 1.3.1 and earlier Description: The issue is related to improper control of filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File...

PT-2025-16076 · Woocommerce · Aba Payway Payment Gateway For Woocommerce

Name of the Vulnerable Software and Affected Versions: ABA PayWay Payment Gateway for WooCommerce versions prior to 2.1.3 Description: The issue is related to improper neutralization of input during web page generation, which allows for reflected Cross-site Scripting XSS. This enables an attacker...

PT-2025-16080 · Unknown · Miunosoft Task Scheduler

Name of the Vulnerable Software and Affected Versions: miunosoft Task Scheduler versions 1.6.3 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Reflected Cross-site Scripting XSS. This enables potential attackers to...

PT-2025-16083 · WordPress · Wp Online Users Stats

Name of the Vulnerable Software and Affected Versions: WP Online Users Stats versions prior to 1.0.0 Description: The issue is related to the improper neutralization of special elements used in an SQL command, allowing for Blind SQL Injection. This can be exploited through API endpoints, although...

PT-2025-16097 · Unknown · G5Theme Ultimate Bootstrap Elements For Elementor

Name of the Vulnerable Software and Affected Versions: g5theme Ultimate Bootstrap Elements for Elementor versions 1.4.9 and earlier Description: The issue is related to improper control of filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allo...

PT-2025-16025

Name of the Vulnerable Software and Affected Versions: InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress versions up to, and including, 0.1.0.85 Description: The InstaWP Connect plugin is vulnerable to Local File Inclusion via the instawp-database-manager parameter. This allow...

PT-2025-16049 · Unknown · N-Media Bulk Product Sync

Name of the Vulnerable Software and Affected Versions: N-Media Bulk Product Sync versions n/a through 8.6 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection, potentially...

PT-2025-16075 · Unknown · Trusty Plugins Shop Products Filter

Name of the Vulnerable Software and Affected Versions: Trusty Plugins Shop Products Filter versions 1.2 and earlier Description: The issue affects Trusty Plugins Shop Products Filter, allowing PHP Local File Inclusion due to a Path Traversal vulnerability. Recommendations: For Trusty Plugins Shop...

PT-2025-16048 · Unknown · Wpsmartcontracts

Name of the Vulnerable Software and Affected Versions: WPSmartContracts versions prior to 2.0.10 Description: The issue is related to an improper neutralization of special elements used in an SQL command, allowing Blind SQL Injection. This enables an attacker to inject malicious SQL code,...

PT-2025-16026

Name of the Vulnerable Software and Affected Versions: ch-go library versions prior to 0.65.0 Description: The issue arises when the ch-go library is used under a specific condition where the query includes large, uncompressed malicious external data. This allows an attacker in control of such da...

PT-2025-16144 · Mediawiki · Mediawiki Mobilefrontend Extension

Name of the Vulnerable Software and Affected Versions: Mediawiki - Mobile Frontend Extension versions 1.39 through 1.43 Description: The issue affects the Mediawiki - Mobile Frontend Extension, allowing exposure of sensitive information to an unauthorized actor. This enables shared resource...

PT-2025-16064 · Unknown · Woocommerce Sales Mis Report

Name of the Vulnerable Software and Affected Versions: WooCommerce Sales MIS Report versions prior to 4.0.3 Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting'. This allows for Reflected XSS. Recommendations: For...

PT-2025-16102 · WordPress · Wp Project Manager

Name of the Vulnerable Software and Affected Versions: WP Project Manager plugin for WordPress versions up to and including 2.6.22 Description: The issue is related to Stored Cross-Site Scripting via SVG file uploads, caused by insufficient input sanitization and output escaping. This allows...

PT-2025-16044 · WordPress · Wp Food Ordering/Restaurant Menu

Name of the Vulnerable Software and Affected Versions: WP Food ordering and Restaurant Menu versions 1.1 and earlier Description: The issue is related to an improper control of filename for include/require statement in PHP program, also known as PHP Remote File Inclusion, which allows PHP Local...

PT-2025-16084 · WordPress · Wpbookingly

Name of the Vulnerable Software and Affected Versions: WpBookingly versions 1.2.0 and earlier Description: The issue is related to the deserialization of untrusted data, which allows object injection in WpBookingly. Recommendations: For versions 1.2.0 and earlier, update to a version that contain...