WordPress MelaPress Login Security plugin 2.1.0-2.1.1 - Authentication Bypass to Privilege Escalation via get_valid_user_based_on_token Function

Authentication Bypass to Privilege Escalation via getvaliduserbasedontoken Function vulnerability discovered by kr0d in WordPress Plugin MelaPress Login Security versions 2.1.0-2.1.1...

WordPress WPeMatico RSS Feed Fetcher plugin <= 2.8.7 - Cross-Site Request Forgery to Plugin Deactivation via handle_feedback_submission Function vulnerability

Cross-Site Request Forgery to Plugin Deactivation via handlefeedbacksubmission Function vulnerability discovered by wesley wcraft in WordPress Plugin WPeMatico RSS Feed Fetcher versions = 2.8.7...

WordPress GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin <= 2.8.97 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by mikemyers in WordPress Plugin GeoDirectory versions = 2.8.97...

WordPress SEOPress for MainWP <= 1.4 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin SEOPress for MainWP versions = 1.4...

WordPress Geo Mashup plugin <= 1.13.16 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Dimas Maulana in WordPress Plugin Geo Mashup versions = 1.13.16...

WordPress Timber plugin <= 1.23.1 - Use of a Vulnerable Dependency vulnerability

Use of a Vulnerable Dependency vulnerability discovered by WordFence in WordPress Plugin Timber versions = 1.23.1...

WordPress Cena Store Theme <= 2.11.26 is vulnerable to Local File Inclusion

Software Cena Store Type Theme Vulnerable versions = 2.11.26 Fixed in 2.11.27 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-48171 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 349bfe1912dd Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber...

WordPress WoodMart Theme <= 8.2.6 is vulnerable to Broken Access Control

Software WoodMart Type Theme Vulnerable versions = 8.2.6 Fixed in 8.2.7 OWASP Top 10 A3: Injection Classification Broken Access Control CVE CVE-2025-8097 Patch priority Low CVSS severity Low 5.3 Developer Xtemos PSID edd2e4c45666 Credits Samir El Khaouti Required privilege Unauthenticated Publish...

WordPress KALLYAS - Creative eCommerce Multi-Purpose WordPress Theme Theme <= 4.21.0 is vulnerable to Local File Inclusion

Software KALLYAS - Creative eCommerce Multi-Purpose WordPress Theme Type Theme Vulnerable versions = 4.21.0 Fixed in 4.22.0 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2025-6991 Patch priority Low CVSS severity Low 7.5 Developer EPC PSID 34bd1e68ee25 Credits stealthcopt...

WordPress Educenter Theme <= 1.6.2 is vulnerable to Cross Site Scripting (XSS)

Software Educenter Type Theme Vulnerable versions = 1.6.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2025-5529 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8465b696cfd2 Credits Peter Thaleikis Required privileg...

WordPress Frontend File Manager plugin <= 21.5 - Missing Authorization to Unauthenticated Arbitrary Post Deletion vulnerability

Missing Authorization to Unauthenticated Arbitrary Post Deletion vulnerability discovered by WordFence in WordPress Plugin Frontend File Manager versions = 21.5...

WordPress Droip plugin <= 2.2.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Foxyyy in WordPress Plugin Droip versions = 2.2.6...

CVE-2025-22165

This Medium severity ACE Arbitrary Code Execution vulnerability was introduced in version 4.2.8 of Sourcetree for Mac. This ACE Arbitrary Code Execution vulnerability, with a CVSS Score of 5.9, allows a locally authenticated attacker to execute arbitrary code which has high impact to...

CVE-2025-22165

CVE-2025-22165 describes an ARBITRARY CODE EXECUTION vulnerability in Sourcetree for Mac starting with version 4.2.8. The flaw is exploitable by a locally authenticated attacker who can execute code with the user’s privileges, impacting confidentiality, integrity, and availability. The CVSS data ...

WordPress WooCommerce Point Of Sale (POS) <= 1.4 - SQL Injection Vulnerability

SQL Injection Vulnerability discovered by Nguyen Kim Sang in WordPress Plugin WooCommerce Point Of Sale POS versions = 1.4...

WordPress ProfileGrid plugin <= 5.9.5.3 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin ProfileGrid versions = 5.9.5.3...

WordPress Omnishop plugin <= 1.0.9 - Missing Registration Restriction to Unauthenticated Account Creation via /users/register REST Endpoint vulnerability

Missing Registration Restriction to Unauthenticated Account Creation via /users/register REST Endpoint vulnerability discovered by ch4r0n in WordPress Plugin Omnishop versions = 1.0.9...

SUSE: Security Advisory (SUSE-SU-2025:02463-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DLA-4248-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-7663-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...