WordPress Google News plugin <= 2.5.1 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Google News versions = 2.5.1...

WordPress occupancyplan plugin <= 1.0.3.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability

Cross Site Request Forgery CSRF to Stored XSS vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin occupancyplan versions = 1.0.3.0...

WordPress Animate plugin <= 0.5 - Server Side Request Forgery (SSRF) Vulnerability

Server Side Request Forgery SSRF Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Animate versions = 0.5...

WordPress SCSS-Library plugin <= 0.4.1 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin SCSS-Library versions = 0.4.1...

WordPress Plugin Central plugin <= 2.5.1 - CSRF to Arbitrary File Deletion vulnerability

CSRF to Arbitrary File Deletion vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Plugin Central versions = 2.5.1...

WordPress Time Based Greeting plugin <= 2.2.2 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Time Based Greeting versions = 2.2.2...

CVE-2025-46435

CVE-2025-46435 - Time Based Greeting (WordPress plugin) : A CSRF flaw in Yash Binani Time Based Greeting, exploitable in versions &lt;= 2.2.2, can lead to Stored XSS. Product: Time Based Greeting plugin for WordPress. Root cause: CSRF enabling stored script execution; Impact per CVSS 3.1: Confide...

WordPress Category Posts Widget plugin < 4.9.20 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Category Posts Widget versions 4.9.20...

WordPress Vikinger Theme <= 1.9.30 is vulnerable to Privilege Escalation

Software Vikinger Type Theme Vulnerable versions = 1.9.30 Fixed in 1.9.31 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2025-2238 Patch priority Low CVSS severity Low 8.8 Developer Claim ownership PSID 27a6956156c8 Credits Tonn Required...

Laravel < 5.6.30 RCE Vulnerability

Laravel is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:laravel:laravel"; ...

Debian: Security Advisory (DLA-4136-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-7454-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GIMP Buffer Overflow Vulnerability (Apr 2025) - Windows

GIMP is prone to a buffer overflow vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:gimp:gimp"; ifdescription...

Ubuntu: Security Advisory (USN-7445-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress Plugin Upgrade Time Out plugin <= 1.0 - Stored XSS via CSRF vulnerability

Stored XSS via CSRF vulnerability discovered by Daniel Ruf in WordPress Plugin Plugin Upgrade Time Out versions = 1.0...

WordPress Advanced Accordion Gutenberg Block plugin <= 5.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by Avraham Shemesh in WordPress Plugin Advanced Accordion Gutenberg Block versions = 5.0.2...

WordPress Lottie Player plugin <= 1.1.8 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via File Upload vulnerability discovered by Avraham Shemesh in WordPress Plugin Lottie Player block - Implement Lottie animations. versions = 1.1.8...

WordPress WPMasterToolKit (WPMTK) – All in one plugin plugin <= 2.5.2 - Authenticated (Administrator+) to Arbitrary File Read and Write vulnerability

Authenticated Administrator+ to Arbitrary File Read and Write vulnerability discovered by nquangit in WordPress Plugin WPMasterToolKit versions = 2.5.2...

WordPress Verification SMS with TargetSMS plugin <= 1.5 - Unauthenticated Limited Remote Code Execution vulnerability

Unauthenticated Limited Remote Code Execution vulnerability discovered by Cheng Liu in WordPress Plugin Verification SMS with TargetSMS versions = 1.5...

WordPress FuseDesk plugin <= 6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via successredirect Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via successredirect Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin FuseDesk versions = 6.7...