WordPress My Reservation System plugin <= 2.3 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Matías Schiappacasse & Lukas Gaete in WordPress Plugin My Reservation System versions = 2.3...

WordPress Dataverse Integration plugin 2.77-2.81 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

Missing Authorization to Authenticated Subscriber+ Privilege Escalation vulnerability discovered by kr0d in WordPress Plugin Dataverse Integration versions 2.77-2.81...

WordPress Affiliate Plus plugin <= 1.3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability

Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability discovered by johska in WordPress Plugin Affiliate Plus versions = 1.3.2...

WordPress Elementor plugin <= 3.30.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Path Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Text Path Widget vulnerability discovered by Asaf Mozes in WordPress Plugin Elementor Website Builder versions = 3.30.2...

WordPress StreamWeasels Twitch Integration plugin <= 1.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Gai Tanaka in WordPress Plugin StreamWeasels Twitch Integration versions = 1.9.3...

WordPress Memory Usage plugin <= 3.98 - Cross-Site Request Forgery to Limited Plugin Installation via wpmemory_install_plugin Function vulnerability

Cross-Site Request Forgery to Limited Plugin Installation via wpmemoryinstallplugin Function vulnerability discovered by wesley wcraft in WordPress Plugin WP memory versions = 3.98...

WordPress SureDash <= 1.0.3 - Privilege Escalation Vulnerability

Privilege Escalation Vulnerability discovered by Denver Jackson in WordPress Plugin SureDash versions = 1.0.3...

WordPress Graphina plugin <= 3.1.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by LVT-tholv2k in WordPress Plugin Graphina versions = 3.1.1...

WordPress WP REST Cache <= 2025.1.0 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by LVT-tholv2k in WordPress Plugin WP REST Cache versions = 2025.1.0...

WordPress Gutenberg Blocks <= 3.3.1 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin Gutenberg Blocks versions = 3.3.1...

WordPress RT-Theme 18 | Extensions plugin <= 2.4 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by Bonds in WordPress Plugin RT-Theme 18 | Extensions versions = 2.4...

WordPress Supermalink <= 1.1 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Chu The Anh Blue Rock in WordPress Plugin Supermalink versions = 1.1...

WordPress Advanced Google Universal Analytics plugin <= 1.0.3 - Broken Access Control to Sensitive Data Exposure vulnerability

Broken Access Control to Sensitive Data Exposure vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Advanced Google Universal Analytics versions = 1.0.3...

WordPress Custom API for WP <= 4.2.2 - Privilege Escalation Vulnerability

Privilege Escalation Vulnerability discovered by Hiro Code016Hiro in WordPress Plugin Custom API for WP versions = 4.2.2...

CVE-2025-8251 code-projects Exam Form Submission delete_s4.php sql injection

A vulnerability has been found in code-projects Exam Form Submission 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/deletes4.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The...

PT-2025-35712

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 140.0.7339.80 Microsoft Edge versions prior to 140.0.7339.80 Description A use-after-free issue exists in the V8 JavaScript engine used by Google Chrome and Microsoft Edge. This flaw could allow a remote attacke...

WordPress News Magazine X Theme <= 1.2.35 is vulnerable to Local File Inclusion

Software News Magazine X Type Theme Vulnerable versions = 1.2.35 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-24766 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID b88166b6f805 Credits LVT-tholv2k Required privilege...

WordPress MinimogWP Theme <= 3.9.0 is vulnerable to Content Injection

Software MinimogWP Type Theme Vulnerable versions = 3.9.0 Fixed in 3.9.1 OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2025-8198 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID d80fff95e821 Credits Valatty Required privilege Unauthenticated Published ...

SUSE: Security Advisory (SUSE-SU-2025:02527-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2025:02501-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...