CVE-2025-0865

The WP Media Category Management plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 2.0 to 2.3.3. This is due to missing or incorrect nonce validation on the wpmcmhandleactionsettings function. This makes it possible for unauthenticated attackers to alter plugin settings...

CVE-2025-0865 WP Media Category Management 2.0 - 2.3.3 - Cross-Site Request Forgery to Settings Update

The WP Media Category Management plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 2.0 to 2.3.3. This is due to missing or incorrect nonce validation on the wpmcmhandleactionsettings function. This makes it possible for unauthenticated attackers to alter plugin settings...

CVE-2025-0865

The WP Media Category Management plugin for WordPress (WP-MCM) versions 2.0–2.3.3 are affected by a Cross‑Site Request Forgery (CSRF) vulnerability due to missing/incorrect nonce validation in wp_mcm_handle_action_settings(). This could allow unauthenticated attackers to alter the plugin settings...

CVE-2025-0865 WP Media Category Management 2.0 - 2.3.3 - Cross-Site Request Forgery to Settings Update

The WP Media Category Management plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 2.0 to 2.3.3. This is due to missing or incorrect nonce validation on the wpmcmhandleactionsettings function. This makes it possible for unauthenticated attackers to alter plugin settings...

D-Link DIR-853 PSK Parameter Buffer Overflow Vulnerability

The D-Link DIR-853 is a dual-band wireless router that supports the 802.11ac protocol and provides dual-band 2.4GHz up to 400Mbps and 5GHz up to 867Mbps network connectivity for HD video streaming and online gaming. The D-Link DIR-853 suffers from a buffer overflow vulnerability that originates...

CVE-2023-51297

A lack of rate limiting in the 'Email Settings' feature of PHPJabbers Hotel Booking System v4.0 allows attackers to send an excessive amount of email for a legitimate user, leading to a possible Denial of Service DoS via a large amount of generated e-mail messages...

CVE-2023-51297

A lack of rate limiting in the 'Email Settings' feature of PHPJabbers Hotel Booking System v4.0 allows attackers to send an excessive amount of email for a legitimate user, leading to a possible Denial of Service DoS via a large amount of generated e-mail messages...

D-Link DIR-853 Password Parameter Buffer Overflow Vulnerability

The D-Link DIR-853 is a dual-band wireless router that supports the 802.11ac protocol and provides dual-band 2.4GHz up to 400Mbps and 5GHz up to 867Mbps network connectivity for HD video streaming and online gaming. The D-Link DIR-853 suffers from a buffer overflow vulnerability that originates...

WordPress Raptive Ads plugin <= 3.6.3 - Missing Authorization to Unauthenticated Data/Settings Reset vulnerability

Missing Authorization to Unauthenticated Data/Settings Reset vulnerability discovered by Tieu Pham Trong Nhan in WordPress Plugin Raptive Ads versions = 3.6.3...

WordPress WP Media Category Management plugin 2.0-2.3.3 - Cross-Site Request Forgery to Settings Update vulnerability

Cross-Site Request Forgery to Settings Update vulnerability discovered by luckybuddy in WordPress Plugin WP Media Category Management versions 2.0-2.3.3...

CVE-2024-13523

The MemorialDay plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web script...

CVE-2024-13848

The Reaction Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permission...

CVE-2025-0796

The Mortgage Lead Capture System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.2.10. This is due to missing or incorrect nonce validation on the 'wprequalresetdefaults' action. This makes it possible for unauthenticated attackers to reset...

CVE-2024-13848

The CVE-2024-13848 entry concerns the Reaction Buttons WordPress plugin. It describes a Stored Cross-Site Scripting (XSS) vulnerability exploitable via admin settings, due to insufficient input sanitization and output escaping in versions up to 2.1.6. Exploitation requires administrator-level per...

CVE-2024-13687 Team Builder – Meet the Team <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update

The Team Builder – Meet the Team plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveteambuilderoptions function in all versions up to, and including, 1.3. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2024-13687 Team Builder – Meet the Team <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update

The Team Builder – Meet the Team plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveteambuilderoptions function in all versions up to, and including, 1.3. This makes it possible for authenticated attackers, with Subscriber-level...

PT-2025-6559 · WordPress · Memorialday

Name of the Vulnerable Software and Affected Versions: MemorialDay plugin for WordPress versions up to, and including, 1.0.4 Description: The issue is due to missing or incorrect nonce validation on a function, making it possible for unauthenticated attackers to update settings and inject malicio...

PT-2025-7169

Name of the Vulnerable Software and Affected Versions OpenSSH versions 9.5p1 through 9.9p1 Description The issue is related to an uncontrolled consumption of resources in OpenSSH, which can be exploited by a remote attacker to cause a denial of service. This can be achieved through memory...

The vulnerability in the `prog.cgi` script of the SetQuickVPNSettings module of the D-Link DIR-853 A1 router’s software allows a hacker to cause a service failure.

The vulnerability in the prog.cgi script of the SetQuickVPNSettings module of the D-Link DIR-853 A1 router operating system is related to buffer overflow during the processing of the Password parameter. Exploiting this vulnerability can allow an attacker to cause a service failure remotely...

WordPress Mortgage Lead Capture System plugin <= 8.2.11 - Cross-Site Request Forgery to Settings Reset vulnerability

Cross-Site Request Forgery to Settings Reset vulnerability discovered by Dhabaleshwar Das in WordPress Plugin Mortgage Lead Capture System versions = 8.2.11...