Ubuntu: Security Advisory (USN-7496-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-4372

Use after free in WebAudio in Google Chrome prior to 136.0.7103.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-4372

CVE-2025-4372: Use-after-free in WebAudio of Google Chrome before 136.0.7103.92 can allow a remote attacker to potentially trigger heap corruption via a crafted HTML page. The cited CVSSv3.1 metrics indicate a high impact (CVSS: 8.8; AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Chrome has addressed this...

WordPress Frontend Dashboard plugin 1.0-2.2.6 - Missing Authorization to Unauthenticated Privilege Escalation

Missing Authorization to Unauthenticated Privilege Escalation vulnerability discovered by kr0d in WordPress Plugin Frontend Dashboard versions 1.0-2.2.6...

WordPress WZ Followed Posts plugin <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by muhammad yudha in WordPress Plugin WZ Followed Posts - Display what visitors are reading versions = 3.1.0...

WordPress Login Lockdown & Protection plugin <= 2.11 - Missing Authorization to Authenticated (Subscriber+) Arbitrary IP Whitelisting vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary IP Whitelisting vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Login Lockdown versions = 2.11...

WordPress Relevanssi plugin <= 4.24.3 - Unauthenticated Stored Cross-Site Scripting via Search Highlights vulnerability

Unauthenticated Stored Cross-Site Scripting via Search Highlights vulnerability discovered by Jack Taylor in WordPress Plugin Relevanssi versions = 4.24.3...

WordPress WPshop 2 plugin 2.0.0-2.6.0 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover

Authenticated Subscriber+ Privilege Escalation via Account Takeover vulnerability discovered by kr0d in WordPress Plugin WP shop versions 2.0.0-2.6.0...

WordPress WPshop 2 plugin 2.0.0-2.6.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Key Generation

Insecure Direct Object Reference to Authenticated Subscriber+ Arbitrary User Key Generation vulnerability discovered by kr0d in WordPress Plugin WP shop versions 2.0.0-2.6.0...

WordPress Xavin's List Subpages plugin <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Gilang in WordPress Plugin Xavin's List Subpages versions = 1.3...

WordPress CarDealerPress plugin <= 6.8.2505.00 - Authenticated (Contributor+) Stored Cross-Site Scripting via saleclass Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via saleclass Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin CarDealerPress versions = 6.8.2505.00...

WordPress Multiple Post Type Order plugin <= 1.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mpto Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via mpto Shortcode vulnerability discovered by Gilang in WordPress Plugin Multiple Post Type Order versions = 1.10.0...

WordPress Woocommerce Multiple Addresses plugin <= 1.0.7.1 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by Chuck in WordPress Plugin Woocommerce Multiple Addresses versions = 1.0.7.1...

WordPress PeproDev Ultimate Profile Solutions plugin 1.9.1-7.5.2 - Missing Authorization to Limited Unauthenticated Arbitrary User Meta Update

Missing Authorization to Limited Unauthenticated Arbitrary User Meta Update vulnerability discovered by kr0d in WordPress Plugin PeproDev Ultimate Profile Solutions versions 1.9.1-7.5.2...

WordPress PeproDev Ultimate Profile Solutions plugin 1.9.1-7.5.2 - Missing Authorization to Unauthenticated Email Enumeration

Missing Authorization to Unauthenticated Email Enumeration vulnerability discovered by kr0d in WordPress Plugin PeproDev Ultimate Profile Solutions versions 1.9.1-7.5.2...

WordPress PeproDev Ultimate Profile Solutions 1.9.1-7.5.2 plugin - Authentication Bypass to Account Takeover

Authentication Bypass to Account Takeover vulnerability discovered by kr0d in WordPress Plugin PeproDev Ultimate Profile Solutions versions 1.9.1-7.5.2...

WordPress WP SmartPay plugin 1.1.0-2.7.13 - Authenticated (Subscriber+) Information Exposure vulnerability

Authenticated Subscriber+ Information Exposure vulnerability discovered by kr0d in WordPress Plugin WP SmartPay versions 1.1.0-2.7.13...

CVE-2025-4359

A vulnerability classified as critical was found in itsourcecode Gym Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=deletemember. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The...

WordPress PGS Core plugin <= 5.8.0 - Missing Authorization via Multiple Functions vulnerability

Missing Authorization via Multiple Functions vulnerability discovered by István Márton in WordPress Plugin PGS Core versions = 5.8.0...

CVE-2025-4313

CVE-2025-4313 affects SourceCodester Advanced Web Store 1.0. The vulnerability is in an unknown function of the file /admin/admin_addnew_product.php, where manipulating the argument txtProdId enables a SQL injection. It is described as exploitable remotely, with public exploit disclosure noted. M...