WordPress Krowd Theme <= 1.4.1 is vulnerable to Local File Inclusion

Software Krowd Type Theme Vulnerable versions = 1.4.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-32595 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 8a5ee19169be Credits Bonds Required privilege Unauthenticated Published 3...

WordPress Lesya Theme <= 1.7.2 is vulnerable to Local File Inclusion

Software Lesya Type Theme Vulnerable versions = 1.7.2 Fixed in 1.7.3 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-48290 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID b9712c5f2cb9 Credits Bonds Required privilege Unauthenticated Published ...

WordPress Revo Theme <= 4.0.26 is vulnerable to Local File Inclusion

Software Revo Type Theme Vulnerable versions = 4.0.26 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-39476 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 2d973d5613e1 Credits Bonds Required privilege Unauthenticated Published 3...

CVE-2025-5419

Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2025-5419

Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2025-5419

CVE-2025-5419: Out-of-bounds read/write in V8 (Chromium) used by Google Chrome/Chromium-based browsers. A remote attacker could potentially exploit heap corruption via a crafted HTML page. Affected: Google Chrome/Chromium’s V8 until version 137.0.7151.68. Impact described as High (C:E/I/H/A: High...

CVE-2025-5419

Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

WordPress Shared Files plugin <= 1.7.48 - Unauthenticated Stored Cross-Site Scripting via sanitize_file Function vulnerability

Unauthenticated Stored Cross-Site Scripting via sanitizefile Function vulnerability discovered by Martin Martin in WordPress Plugin Shared Files versions = 1.7.48...

WordPress WP Plugin Info Card plugin <= 5.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via containerid Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via containerid Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin WP Plugin Info Card versions = 5.3.1...

WordPress Ultimate Gift Cards for WooCommerce plugin <= 3.1.4 - Authenticated (Administrator+) SQL Injection via wps_wgm_save_post Function vulnerability

Authenticated Administrator+ SQL Injection via wpswgmsavepost Function vulnerability discovered by Abdulaziz Alzamil in WordPress Plugin Ultimate Gift Cards For WooCommerce versions = 3.1.4...

WordPress Ninja Tables – Easy Data Table Builder plugin <= 5.0.18 - Unauthenticated PHP Object Injection to Limited Remote Code Execution vulnerability

Unauthenticated PHP Object Injection to Limited Remote Code Execution vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Ninja Tables versions = 5.0.18...

WordPress Broken Link Checker plugin <= 2.4.4 - Missing Autorization to Authenticated (Subscriber+) Plugin Status Dashboard View vulnerability

Missing Autorization to Authenticated Subscriber+ Plugin Status Dashboard View vulnerability discovered by Nguyễn Trung Kiên in WordPress Plugin Broken Link Checker versions = 2.4.4...

WordPress wpForo Advanced Attachments plugin <= 3.1.3 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Christie BOUTIER in WordPress Plugin wpForo Advanced Attachments versions = 3.1.3...

WordPress WordPress Comments Import & Export plugin <= 2.4.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Missing Authorization to Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Jorgson in WordPress Plugin Comments Import & Export versions = 2.4.3...

WordPress WP-Optimize plugin < 4.2.0 - Admin+ SQLi vulnerability

Admin+ SQLi vulnerability discovered by Francisco Alisson in WordPress Plugin WP-Optimize versions 4.2.0...

WordPress Real Cookie Banner plugin < 5.1.6 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin Real Cookie Banner versions 5.1.6...

WordPress Newsletters plugin <= 4.9.9.9 - Authenticated (Administrator+) Local File Inclusion vulnerability

Authenticated Administrator+ Local File Inclusion vulnerability discovered by m3ssap0 in WordPress Plugin Newsletters versions = 4.9.9.9...

WordPress Ocean Extra plugin <= 2.4.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Asaf Mozes Patchstack Alliance in WordPress Plugin Ocean Extra versions = 2.4.8...

WordPress Contact Forms by Cimatti plugin <= 1.9.8 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Shivam Khanna Patchstack Alliance in WordPress Plugin Contact Forms by Cimatti versions = 1.9.8...

WordPress Uncanny Automator plugin <= 6.4.0.2 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Denver Jackson in WordPress Plugin Uncanny Automator versions = 6.4.0.2...