CVE-2025-1363

The URL Shortener | Conversion Tracking | AB Testing | WooCommerce WordPress plugin through 9.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is...

WordPress plugin URL Shortener 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-13826

The Email Keep WordPress plugin through 1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-13826

The Email Keep WordPress plugin through 1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-13826 Email Keep <= 1.1 - Email Deletion via CSRF

The Email Keep WordPress plugin through 1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-13826

The CVE-2024-13826 entry affects the Email Keep WordPress plugin up to version 1.1. Root cause: absence of CSRF protection when updating plugin settings. Impact: an attacker could exploit this CSRF vulnerability to cause a logged-in admin to change settings. The description is corroborated by mul...

CVE-2024-13826 Email Keep <= 1.1 - Email Deletion via CSRF

The Email Keep WordPress plugin through 1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2025-2096

A vulnerability classified as critical was found in TOTOLINK EX1800T 9.1.0cu.2112B20220316. This vulnerability affects the function setRebootScheCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument mode/week/minute/recHour leads to os command injection. The attack can be initiat...

CVE-2024-9458

The Reservit Hotel WordPress plugin before 3.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-9458 Reservit Hotel < 3.0 - Admin+ Stored XSS

The Reservit Hotel WordPress plugin before 3.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-9458 Reservit Hotel < 3.0 - Admin+ Stored XSS

The Reservit Hotel WordPress plugin before 3.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

Security Bulletin: IBM Concert Software Standard Edition is vulnerable to login brute force attack

Summary IBM Concert Software Standard Edition is the non-OpenShift Container Platform OCP lightweight product form factor deployed to virtual machine. IBM Concert Software Standard Edition 1.0.5 is vulnerable to login brute force attack due to inadequate account lockout settings and weak password...

CVE-2025-1672 Notibar <= 2.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting

The Notibar – Notification Bar for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-20909

Use of implicit intent for sensitive communication in Settings prior to SMR Mar-2025 Release 1 allows local attackers to access sensitive information...

CVE-2025-20909

CVE-2025-20909 affects Samsung Settings (Settings service) prior to SMR Mar-2025 Release 1, where use of implicit intents for sensitive communication enables local attackers to access sensitive information. Root cause is implicit handling of sensitive data via intents within Settings, leading to ...

CVE-2025-20909

Use of implicit intent for sensitive communication in Settings prior to SMR Mar-2025 Release 1 allows local attackers to access sensitive information...

CVE-2025-20909

Use of implicit intent for sensitive communication in Settings prior to SMR Mar-2025 Release 1 allows local attackers to access sensitive information...

CVE-2024-13686

The VW Storefront theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vwstorefrontresetallsettings function in all versions up to, and including, 0.9.9. This makes it possible for authenticated attackers, with Subscriber-level access and...

SAMSUNG Settings 安全漏洞

SAMSUNG Settings is a settings service from Samsung South Korea. A security vulnerability exists in versions prior to SAMSUNG Settings SMR Mar-2025 Release 1, which stems from the implicit intentional use of sensitive communications and could lead to a local attacker accessing sensitive informati...

CVE-2025-0954

CVE-2025-0954 affects the WordPress plugin “WP Online Contract”. The vulnerability is a missing capability check in json_import() and json_export() across all versions up to 5.1.4, allowing unauthenticated attackers to import/export the plugin’s settings. Public sources in the provided documents ...