CVE-2025-12578

The Reuters Direct plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.0. This is due to missing or incorrect nonce validation on the the 'class-reuters-direct-settings.php' page. This makes it possible for unauthenticated attackers to reset...

CVE-2025-12579 Reuters Direct <= 3.0.0 - Missing Authorization to Unauthenticated Settings Reset

The Reuters Direct plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'logoff' action in all versions up to, and including, 3.0.0. This makes it possible for unauthenticated attackers to reset the plugin's settings...

CVE-2025-12579

CVE-2025-12579 affects the Reuters Direct WordPress plugin. The vulnerability is a missing capability check on the logoff action in all versions up to and including 3.0.0, enabling unauthenticated attackers to reset the plugin’s settings (unauthorized modification of data). Connected sources conf...

CVE-2025-12578 Reuters Direct <= 3.0.0 - Cross-Site Request Forgery to Settings Reset

The Reuters Direct plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.0. This is due to missing or incorrect nonce validation on the the 'class-reuters-direct-settings.php' page. This makes it possible for unauthenticated attackers to reset...

CVE-2025-12578

The Reuters Direct WordPress plugin (

CVE-2025-12578 Reuters Direct <= 3.0.0 - Cross-Site Request Forgery to Settings Reset

The Reuters Direct plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.0. This is due to missing or incorrect nonce validation on the the 'class-reuters-direct-settings.php' page. This makes it possible for unauthenticated attackers to reset...

WordPress Reuters Direct plugin <= 3.0.0 - Cross-Site Request Forgery to Settings Reset vulnerability

Cross-Site Request Forgery to Settings Reset vulnerability discovered by Nabil Irawan - Heroes Cyber Security in WordPress Plugin Reuters Direct versions = 3.0.0...

CVE-2025-12751 WSChat – WordPress Live Chat <= 3.1.6 - Missing Authorization to Authenticated (Subscriber+) Settings Reset

The WSChat – WordPress Live Chat plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'resetsettings' AJAX endpoint in all versions up to, and including, 3.1.6. This makes it possible for authenticated attackers, with Subscriber-level...

WordPress SiteSEO – SEO Simplified plugin <= 1.3.2 - Improper Authorization to Authenticated Settings Reset vulnerability

Improper Authorization to Authenticated Settings Reset vulnerability discovered by Supakiad S. m3ez - E-CQURITY Thailand in WordPress Plugin SiteSEO versions = 1.3.2...

WordPress WSChat – WordPress Live Chat plugin <= 3.1.6 - Missing Authorization to Authenticated (Subscriber+) Settings Reset vulnerability

Missing Authorization to Authenticated Subscriber+ Settings Reset vulnerability discovered by Powpy in WordPress Plugin WSChat versions = 3.1.6...

CVE-2025-12526

CVE-2025-12526 concerns the Private Google Calendars plugin for WordPress. Technical details in connected sources show a missing capability check on the pgc_remove action in versions up to 20250811, enabling authenticated attackers with Subscriber-level access or higher to reset the plugin’s sett...

EUVD-2019-11577

Malware in sbrugna...

EUVD-2016-9084

Malware in sbrugna...

EUVD-2019-11573

Malware in sbrugna...

EUVD-2019-5918

Malware in sbrugna...

EUVD-2021-12004

Malware in sbrugna...

EUVD-2017-2939

Malware in sbrugna...

EUVD-2024-17486

Malicious code in bioql PyPI...

EUVD-2022-24736

Malicious code in bioql PyPI...

EUVD-2024-42218

Malicious code in bioql PyPI...