WordPress WC Plus plugin <= 1.2.0 - Missing Authorization to Unauthenticated Settings Manipulation vulnerability

Missing Authorization to Unauthenticated Settings Manipulation vulnerability discovered by ch4r0n in WordPress Plugin WC Plus versions = 1.2.0...

WordPress ShortcodeHub plugin <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via author_link_target Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via authorlinktarget Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin ShortcodeHub - MultiPurpose Shortcode Builder versions = 1.7.1...

WordPress Simpler Checkout <= 1.1.13 - Authentication Bypass vulnerability

Authentication Bypass vulnerability discovered by kr0d in WordPress Plugin Simpler Checkout versions = 1.1.13...

CVE-2025-4609

Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 136.0.7103.113 allowed a remote attacker to potentially perform a sandbox escape via a malicious file. Chromium security severity: High...

CVE-2025-4609

Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 136.0.7103.113 allowed a remote attacker to potentially perform a sandbox escape via a malicious file. Chromium security severity: High...

CVE-2025-4609

CVE-2025-4609 describes a vulnerability in Google Chrome on Windows (Mojo) where an incorrect handle in unspecified circumstances could allow a remote attacker to potentially escape the browser sandbox via a malicious file. The issue is tied to the Chromium-based Chrome versioning and is specific...

CVE-2025-4609

Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 136.0.7103.113 allowed a remote attacker to potentially perform a sandbox escape via a malicious file. Chromium security severity: High...

UnoPim has Broken Access Control

Summary In Unopim, it is possible to create roles and choose the privileges. However, users without the “Delete” privilege for Products cannot delete a single product via the standard endpoint expected behavior, but can still delete products via the mass-delete endpoint, even when the request...

WordPress Church Admin Plugin <= 5.0.26 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by D01EXPLOIT in WordPress Plugin Church Admin versions = 5.0.26...

WordPress JobWP Plugin <= 2.4.3 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nabil Irawan in WordPress Plugin JobWP versions = 2.4.3...

WordPress WPPizza Plugin <= 3.19.8 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Nabil Irawan in WordPress Plugin WPPizza versions = 3.19.8...

WordPress WP Fast Total Search Plugin <= 1.79.270 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nabil Irawan in WordPress Plugin WP Fast Total Search versions = 1.79.270...

WordPress Recurring PayPal Donations Plugin <= 1.8 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Nabil Irawan in WordPress Plugin Recurring PayPal Donations versions = 1.8...

WordPress Fluent Support Plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Bao BlueRock in WordPress Plugin Fluent Support versions = 1.9.1...

WordPress Greenshift Plugin <= 12.1.1 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Denver Jackson in WordPress Plugin Greenshift versions = 12.1.1...

WordPress Advance Food Menu plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Vinit Lakra Patchstack Alliance in WordPress Plugin Advance Food Menu versions = 1.0...

WordPress tli.tl auto Twitter poster plugin <= 3.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Jieun Kim Patchstack Alliance in WordPress Plugin tli.tl auto Twitter poster versions = 3.4...

WordPress WP Admin Theme plugin <= 1.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability

Cross Site Request Forgery CSRF to Stored XSS vulnerability discovered by Ren Kikuchi Patchstack Alliance in WordPress Plugin WP Admin Theme versions = 1.0...

WordPress WP Crontrol plugin 1.17.0-1.19.1 - Authenticated (Administrator+) Server-Side Request Forgery vulnerability

Authenticated Administrator+ Server-Side Request Forgery vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Crontrol versions 1.17.0-1.19.1...

pdns-recursor-5.2.5-1.1 on GA media (moderate)

pdns-recursor-5.2.5-1.1 on GA media Announcement ID: openSUSE-SU-2025:15479-1 Rating: moderate Cross-References: CVE-2025-30192 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...