MAL-2025-89102 Malicious code in ogi-nasi43-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7755617be0b8abe5a232968b494becf4a519584f21817f75e7817deb97b56004 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-88871 Malicious code in novel_antlion_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6715de625b7fde2c38303bb32fa6b9c7b48d34c9627005e284f8f4aa5d54437 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-91830 Malicious code in vida-oncom67-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d720024b93675caf04f19359b63959577449b10e143dc56295ba3213a31da71b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-88393 Malicious code in maya-serimuka79-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8479c6311557ed97c0f8c07dc04c700a9591b617eb83beddf56071cddad63404 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-83382 Malicious code in bambang-botok5-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27b2ddb696332bd89f8e0f134de1aa818aed0435db9e0fd32aea2cabb697bd46 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-90316 Malicious code in rudi-tapai73-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0250e2439d67fdba2ade0cb6feafbb5d304d30aaece0b63b02deaf4ad2ffc0a6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-12588

The USB Qr Code Scanner For Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation on the settings page. This makes it possible for unauthenticated attackers to update the plugin's settings...

CVE-2025-12631

The Squirrels Auto Inventory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

MAL-2025-79933 Malicious code in mathematical_guineafowl_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0fa49d0ff38621df0c38fa5d315fb49a2b82ce4a7ca875326eb2816edb4fa18d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-11999 Add Multiple Marker <= 1.2 - Missing Authorization to Unauthenticated Settings Update

The Add Multiple Marker plugin for WordPress is vulnerable to unauthorized modification of data to due to a missing capability check on the addmultiplemarkerresetmap and ammsavemapapi functions in all versions up to, and including, 1.2. This makes it possible for unauthenticated attackers to upda...

CVE-2025-12631

CVE-2025-12631 affects the WordPress plugin Squirrels Auto Inventory (versions

CVE-2025-12631 Squirrels Auto Inventory <= 1.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting

The Squirrels Auto Inventory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2025-12631 Squirrels Auto Inventory <= 1.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting

The Squirrels Auto Inventory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2025-12526

CVE-2025-12526 concerns the Private Google Calendars plugin for WordPress. Technical details in connected sources show a missing capability check on the pgc_remove action in versions up to 20250811, enabling authenticated attackers with Subscriber-level access or higher to reset the plugin’s sett...

CVE-2025-12588

CVE-2025-12588 affects the USB Qr Code Scanner For Woocommerce WordPress plugin. The WordPress plugin versions up to 1.0.0 are vulnerable to Cross-Site Request Forgery caused by missing nonce validation on the settings page, allowing unauthenticated attackers to update plugin settings via forged ...

CVE-2025-12588 USB Qr Code Scanner For Woocommerce <= 1.0.0 - Cross-Site Request Forgery to Settings Update

The USB Qr Code Scanner For Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation on the settings page. This makes it possible for unauthenticated attackers to update the plugin's settings...

CVE-2025-12020 Double the Donation <= 3.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting

The Double the Donation – A workplace giving tool to help your fundraising efforts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.0.0 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2025-12589 WP-Walla <= 0.5.3.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The WP-Walla plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versions up to, and including, 0.5.3.5. This is due to missing nonce verification on the settings page and insufficient input sanitization and output escaping. This makes it possibl...

CVE-2025-12132

The CVE-2025-12132 entry concerns the WP Custom Admin Login Page Logo plugin for WordPress. A CSRF vulnerability exists in versions up to 1.4.8.4 due to missing or incorrect nonce validation on the wpclpl_save function, allowing unauthenticated attackers to modify plugin settings by tricking a si...

CVE-2025-12132 WP Custom Admin Login Page Logo <= 1.4.8.4 - Cross-Site Request Forgery to Settings Update

The WP Custom Admin Login Page Logo plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.8.4. This is due to missing or incorrect nonce validation on the wpclplsave functionality. This makes it possible for unauthenticated attackers to modify...