WordPress illi Link Party! plugin <= 1.0 - Admin+ Stored Cross-Site Scripting vulnerability

Admin+ Stored Cross-Site Scripting vulnerability discovered by Bob Matyas in WordPress Plugin illi Link Party! versions = 1.0...

WordPress Payment Gateway for Telcell plugin < 2.0.4 - Unauthenticated Open Redirect vulnerability

Unauthenticated Open Redirect vulnerability discovered by Enrico Marcolini, Claudio Marchesini in WordPress Plugin Payment Gateway for Telcell versions 2.0.4...

WordPress WolfNet IDX for WordPress plugin <= 1.19.1 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Ma Long in WordPress Plugin WolfNet IDX versions = 1.19.1...

WordPress LogDash Activity Log plugin < 1.1.4 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by Nicolas Surribas in WordPress Plugin LogDash Activity Log versions 1.1.4...

WordPress Jupiterx Core plugin <= 4.8.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Inline SVG vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Inline SVG vulnerability discovered by stealthcopter in WordPress Plugin JupiterX Core versions = 4.8.12...

WordPress EventON plugin <= 4.9.6 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Missing Authorization to Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Nguyễn Trung Kiên in WordPress Plugin EventON versions = 4.9.6...

WordPress Wholesale Market plugin < 2.2.2 - Settings Update via CSRF vulnerability

Settings Update via CSRF vulnerability discovered by WPScan in WordPress Plugin Wholesale Market versions 2.2.2...

WordPress Booking Calendar plugin <= 10.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpbc Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via wpbc Shortcode vulnerability discovered by muhammad yudha in WordPress Plugin Booking Calendar versions = 10.11.1...

WordPress WP-Members plugin <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpmem_user_memberships Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via wpmemusermemberships Shortcode vulnerability discovered by muhammad yudha in WordPress Plugin WP-Members versions = 3.5.2...

WordPress WPBot Pro Wordpress Chatbot plugin <= 13.6.2 - Authenticated (Subscriber+) Arbitrary File Deletion vulnerability

Authenticated Subscriber+ Arbitrary File Deletion vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin WPBot Pro Wordpress Chatbot versions = 13.6.2...

WordPress Crawlomatic Multipage Scraper Post Generator plugin <= 2.6.8.1 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Foxyyy in WordPress Plugin Crawlomatic Multisite Scraper Post Generator versions = 2.6.8.1...

WordPress Echo RSS Feed Post Generator plugin <= 5.4.8.1 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Foxyyy in WordPress Plugin Echo RSS Feed Post Generator Plugin for WordPress versions = 5.4.8.1...

WordPress AlT Monitoring plugin <= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability

Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability discovered by johska in WordPress Plugin AlT Monitoring versions = 1.0.3...

WordPress Audio Comments Plugin plugin <= 1.0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability

Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability discovered by johska in WordPress Plugin Audio Comments versions = 1.0.4...

WordPress Simple Lightbox plugin < 2.9.4 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Pierre Rudloff in WordPress Plugin Simple Lightbox versions 2.9.4...

WordPress Kali Forms plugin < 2.4.3 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Kali Forms versions 2.4.3...

CVE-2025-4664

Insufficient policy enforcement in Loader in Google Chrome prior to 136.0.7103.113 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

Vyper's `slice()` may elide side-effects when output length is 0

Impact the slice builtin can elide side effects when the output length is 0, and the source bytestring is a builtin msg.data or .code. the reason is that for these source locations, the check that length = 1 is skipped:...

GHSA-QHR6-MGQR-MCHM Vyper's `concat()` builtin may elide side-effects for zero-length arguments

Impact concat may skip evaluation of side effects when the length of an argument is zero. this is due to a fastpath in the implementation which skips evaluation of argument expressions when their length is zero:...

Vyper's `concat()` builtin may elide side-effects for zero-length arguments

Impact concat may skip evaluation of side effects when the length of an argument is zero. this is due to a fastpath in the implementation which skips evaluation of argument expressions when their length is zero:...