WordPress Zagg Theme <= 1.4.1 is vulnerable to Local File Inclusion

Software Zagg Type Theme Vulnerable versions = 1.4.1 Fixed in N/A OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2025-4200 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 4006cf86f47e Credits Phat RiO - BlueRock Required privilege Unauthenticated...

CVE-2025-48917 EU Cookie Compliance (GDPR Compliance) - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-072

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal EU Cookie Compliance GDPR Compliance allows Cross-Site Scripting XSS.This issue affects EU Cookie Compliance GDPR Compliance: from 0.0.0 before 1.26.0...

WordPress Auto Attachments plugin <= 1.8.5 - Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting vulnerability discovered by l33ch in WordPress Plugin Auto Attachments versions = 1.8.5...

WordPress Game Review Block plugin <= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via className Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin Game Review Block versions = 4.8.1...

WordPress IRM Newsroom plugin <= 1.2.19 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Chuck in WordPress Plugin IRM Newsroom versions = 1.2.19...

WordPress Color Palette plugin <= 4.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via hex Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via hex Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin Color Palette versions = 4.3.2...

WordPress REST API | Custom API Generator For Cross Platform And Import Export In WP plugin <= 2.0.3 - Missing Authorization to Unauthenticated Privilege Escalation via process_handler Function vulnerability

Missing Authorization to Unauthenticated Privilege Escalation via processhandler Function vulnerability discovered by kr0d in WordPress Plugin REST API | Custom API Generator For Cross Platform And Import Export In WP versions = 2.0.3...

WordPress IndieBlocks plugin <= 0.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via kind Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via kind Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin IndieBlocks versions = 0.13.2...

WordPress WP2HTML plugin <= 1.0.2 - Cross-Site Request Forgery to Settings Update vulnerability

Cross-Site Request Forgery to Settings Update vulnerability discovered by Nabil Irawan in WordPress Plugin WP2HTML versions = 1.0.2...

WordPress Telegram for WP plugin <= 1.6.1 - Authenticated (Admin+) Stored Cross-Site Scripting vulnerability

Authenticated Admin+ Stored Cross-Site Scripting vulnerability discovered by Nabil Irawan in WordPress Plugin Telegram for WP versions = 1.6.1...

WordPress WP Sliding Login/Dashboard Panel plugin <= 2.1.1 - Cross-Site Request Forgery to Settings Update vulnerability

Cross-Site Request Forgery to Settings Update vulnerability discovered by Nabil Irawan in WordPress Plugin WP Sliding Login/Dashboard Panel versions = 2.1.1...

WordPress Digital Marketing and Agency Templates Addons for Elementor plugin <= 1.1.1 - Cross-Site Request Forgery to Import vulnerability

Cross-Site Request Forgery to Import vulnerability discovered by Nabil Irawan in WordPress Plugin Digital Marketing and Agency Templates Addons for Elementor versions = 1.1.1...

WordPress Contact Us Page – Contact People plugin <= 3.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via style Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via style Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin Contact Us page - Contact people LITE versions = 3.7.4...

WordPress ACF Onyx Poll plugin <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via class Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin ACF Onyx Poll versions = 1.1.9...

openSUSE Security Advisory (SUSE-SU-2025:01889-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2025-879f3d7695)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

QNAP QuTS hero Multiple OpenSSH Vulnerabilities (QSA-25-14)

QNAP QuTS hero is prone to multiple vulnerabilities in OpenSSH. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:qnap:qutshero";...

QNAP QTS Multiple OpenSSH Vulnerabilities (QSA-25-14)

QNAP QTS is prone to multiple vulnerabilities in OpenSSH. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:qnap:qts"; ifdescriptio...

WordPress Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal Plugin <= 16.8 is vulnerable to Broken Access Control

Software Malcure Malware Scanner — 1 Toolset for WordPress Malware Removal Type Plugin Vulnerable versions = 16.8 Fixed in 16.9 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE N/A Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID...

CVE-2025-41233

Description: VMware AVI Load Balancer contains an authenticated blind SQL Injection vulnerability. VMware has evaluated the severity of the issue to be in the Moderate severity range https://www.broadcom.com/support/vmware-services/security-response with a maximum CVSSv3 base score of 6.8...