PT-2025-21384 · WordPress · Illi Link Party!

Name of the Vulnerable Software and Affected Versions: The illi Link Party! WordPress plugin version 1.0 Description: The issue is related to the lack of a CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. Recommendations: For...

PT-2025-21379 · WordPress · Abitgone Commentsafe

Name of the Vulnerable Software and Affected Versions: aBitGone CommentSafe WordPress plugin versions 1.0.0 and earlier Description: The issue concerns the lack of CSRF checks in certain areas and missing sanitization as well as escaping. This could allow attackers to make logged-in admins add...

PT-2025-21405 · WordPress · Countdown Timer For Wordpress Block Editor

Name of the Vulnerable Software and Affected Versions: Countdown Timer for WordPress Block Editor version 1.0.5 Description: The issue concerns the Countdown Timer for WordPress Block Editor plugin, which does not validate and escape some of its block options before outputting them back in a page...

PT-2025-21567 · Unknown · Phpgurukul Company Visitor Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Company Visitor Management System version 2.0 Description: A critical issue was found in the PHPGurukul Company Visitor Management System, affecting an unknown function of the file /visitors-form.php. The manipulation of the fullna...

PT-2025-21375 · WordPress · Payment Gateway For Telcell

Name of the Vulnerable Software and Affected Versions: The Payment Gateway for Telcell WordPress plugin versions 2.0.1 and earlier Description: The issue is related to an Open Redirect problem. It occurs because the api url parameter is not validated before the user is redirected to its value. Th...

PT-2025-21467 · WordPress · S3Player

Name of the Vulnerable Software and Affected Versions: S3Player WordPress plugin versions 4.2.1 and earlier Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page...

PT-2025-21575 · Auth0 · Auth0/Wordpress +3

Name of the Vulnerable Software and Affected Versions: Auth0-PHP versions 8.0.0-BETA1 through 8.13.x Description: The issue affects applications using the Auth0-PHP SDK configured with CookieStore, where session cookies have authentication tags that can be brute forced, potentially resulting in...

PT-2025-21433 · WordPress · Clasify Classified Listing Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Clasify Classified Listing WordPress plugin versions 1.0.0 through 1.0.7 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted...

PT-2025-21516 · WordPress · Gamipress

Name of the Vulnerable Software and Affected Versions: GamiPress versions prior to 1.0.1 Description: The issue concerns the lack of CSRF check when updating settings, which could allow attackers to make a logged-in administrator change them via a CSRF attack. This could potentially permit...

PT-2025-21349 · WordPress · Wp2Leads

Name of the Vulnerable Software and Affected Versions: WP2LEADS versions 3.5.0 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application, potentially...

PT-2025-21289 · Sourcecodester · Sourcecodester Best Employee Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Best Employee Management System version V1.0 Description: The issue concerns a Cross Site Request Forgery CSRF in the /admin/change pass.php endpoint via the password parameter. This allows for potential unauthorized password...

PT-2025-21518 · Unknown · Webtoffee-Gdpr-Cookie-Consent

Name of the Vulnerable Software and Affected Versions: webtoffee-gdpr-cookie-consent versions prior to 2.6.1 Description: The issue concerns the lack of CSRF checks in some bulk actions, which could allow attackers to make logged-in admins perform unwanted actions, such as deleting visit logs via...

PT-2025-21430 · WordPress · Simple Basic Contact Form

Name of the Vulnerable Software and Affected Versions: The Simple Basic Contact Form WordPress plugin versions prior to 20250114 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html...

PT-2025-21341 · Unknown · Campcodes Sales/Inventory System

Name of the Vulnerable Software and Affected Versions: Campcodes Sales and Inventory System version 1.0 Description: A critical issue affects the processing of the file "/pages/transaction add.php". The manipulation of the prod name argument leads to SQL injection. The attack may be initiated...

PT-2025-21544 · WordPress · Popup Box

Name of the Vulnerable Software and Affected Versions: The Popup Box WordPress plugin versions prior to 4.7.8 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed,...

PT-2025-21454 · WordPress · Calculated Fields Form

Name of the Vulnerable Software and Affected Versions: Calculated Fields Form WordPress plugin versions prior to 5.2.64 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is...

PT-2025-21576

Name of the Vulnerable Software and Affected Versions: Tornado versions prior to 6.5.0 Description: The issue allows remote attackers to generate a high volume of logs, constituting a denial-of-service DoS attack, by exploiting Tornado's multipart/form-data parser when it encounters certain error...

PT-2025-21533 · WordPress · Database Backup

Name of the Vulnerable Software and Affected Versions: Backup Database WordPress plugin versions prior to 4.9 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some settings are not properly sanitised and...

PT-2025-21570 · Dumb Drop · Dumb Drop

Name of the Vulnerable Software and Affected Versions: DumbDrop versions prior to commit db27b25372eb9071e63583d8faed2111a2b79f1b Description: The issue is related to a DOM cross-site scripting vulnerability in the upload functionality. A user could be tricked into uploading a file with a malicio...

PT-2025-21361 · Emlog · Emlog

Name of the Vulnerable Software and Affected Versions: Emlog versions 2.5.13 and earlier Description: Emlog is an open source website building system. The system has a deserialization issue. A user can create a carefully crafted nickname, causing str replace to replace the value of name orig with...