WordPress Ajar in5 Embed plugin <= 3.1.5 - Arbitrary File Upload Vulnerability

Arbitrary File Upload Vulnerability discovered by LVT-tholv2k in WordPress Plugin Ajar in5 Embed versions = 3.1.5...

WordPress Lead Form Data Collection to CRM plugin <= 3.1 - Arbitrary Option Update to Privilege Escalation vulnerability

Arbitrary Option Update to Privilege Escalation vulnerability discovered by LVT-tholv2k in WordPress Plugin Lead Form Data Collection to CRM versions = 3.1...

WordPress belingoGeo plugin <= 1.12.0 - Arbitrary File Download Vulnerability

Arbitrary File Download Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin belingoGeo versions = 1.12.0...

PT-2025-20604 · Undefined · Undefined

⚠️ Vulnerability Alert: Multiple vulnerabilities in GL-MT2500 and GL-MT2500A 📅 Timeline: Not provided 🆔 cveId: CVE-2024-57391 📊 baseScore: 7.2 📏 cvssMetrics: AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H cvssSeverity: High 🟠 📈 EPSS Percentile: Not available 🛠️...

WordPress Drag and Drop Multiple File Upload for WooCommerce plugin <= 1.1.6 - Unauthenticated Arbitrary File Upload via upload Function vulnerability

Unauthenticated Arbitrary File Upload via upload Function vulnerability discovered by Milinxee in WordPress Plugin Drag and Drop Multiple File Upload for WooCommerce versions = 1.1.6...

WordPress Website Builder by SeedProd plugin <= 6.18.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure vulnerability

Missing Authorization to Authenticated Subscriber+ Sensitive Information Exposure vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Coming Soon Page, Under Construction & Maintenance Mode by SeedProd versions = 6.18.15...

WordPress Envolve Plugin plugin <= 1.0 - Unauthenticated Arbitrary File Upload via language_file and fonts_file vulnerability

Unauthenticated Arbitrary File Upload via languagefile and fontsfile vulnerability discovered by Foxyyy in WordPress Plugin Envolve Plugin versions = 1.0...

WordPress Frontend Login and Registration Blocks plugin <= 1.1.1 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by kr0d in WordPress Plugin Frontend Login and Registration Blocks versions = 1.1.1...

WordPress 1 Click WordPress Migration Plugin plugin <= 2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by Kate Kligman Sunsword in WordPress Plugin 1 Click WordPress Migration versions = 2.2...

WordPress WPBookit plugin <= 1.0.2 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Account Takeover vulnerability

Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Account Takeover vulnerability discovered by kr0d in WordPress Plugin WPBookit versions = 1.0.2...

WordPress NEX-Forms plugin <= 8.9.1 - Authenticated (Custom) Limited Code Execution via get_table_records Function vulnerability

Authenticated Custom Limited Code Execution via gettablerecords Function vulnerability discovered by m3ssap0 in WordPress Plugin NEX-Forms versions = 8.9.1...

WordPress NEX-Forms plugin <= 8.9.1 - Authenticated (Custom) Stored Cross-Site Scripting vulnerability

Authenticated Custom Stored Cross-Site Scripting vulnerability discovered by m3ssap0 in WordPress Plugin NEX-Forms versions = 8.9.1...

WordPress Contest Gallery plugin <= 26.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via id Parameter vulnerability discovered by stealthcopter in WordPress Plugin Contest Gallery versions = 26.0.6...

WordPress BMI Adult & Kid Calculator plugin <= 1.2.2 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by stealthcopter in WordPress Plugin BMI Adult & Kid Calculator versions = 1.2.2...

WordPress xili-tidy-tags plugin <= 1.12.06 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin xili-tidy-tags versions = 1.12.06...

WordPress WP Job Portal plugin <= 2.3.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin WP Job Portal versions = 2.3.1...

WordPress Eventin plugin <= 4.0.26 - Arbitrary File Download Vulnerability

Arbitrary File Download Vulnerability discovered by astra.r3verii in WordPress Plugin Eventin versions = 4.0.26...

WordPress PSW Front-end Login & Registration plugin <= 1.13 - Broken Authentication Vulnerability

Broken Authentication Vulnerability discovered by LVT-tholv2k in WordPress Plugin PSW Front-end Login & Registration versions = 1.13...

WordPress ELEX HelpDesk & Customer Ticketing System plugin <= 3.2.9 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin ELEX WordPress HelpDesk & Customer Ticketing System versions = 3.2.9...

CVE-2025-4313

A vulnerability, which was classified as critical, was found in SourceCodester Advanced Web Store 1.0. Affected is an unknown function of the file /admin/adminaddnewproduct.php. The manipulation of the argument txtProdId leads to sql injection. It is possible to launch the attack remotely. The...