CVE-2025-3259

A vulnerability, which was classified as critical, has been found in Tenda RX3 16.03.13.11. This issue affects the function formSetDeviceName of the file /goform/SetOnlineDevName. The manipulation of the argument devName leads to stack-based buffer overflow. The attack may be initiated remotely...

WordPress Drag and Drop Multiple File Upload for WooCommerce plugin <= 1.1.4 - Unauthenticated Arbitrary File Move vulnerability

Unauthenticated Arbitrary File Move vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin Drag and Drop Multiple File Upload for WooCommerce versions = 1.1.4...

WordPress Lafka Plugin plugin <= 7.1.0 - Missing Authorization to Authenticated (Subscriber+) Theme Option Update vulnerability

Missing Authorization to Authenticated Subscriber+ Theme Option Update vulnerability discovered by István Márton in WordPress Plugin Lafka Plugin versions = 7.1.0...

WordPress ZoomSounds - WordPress Wave Audio Player with Playlist plugin <= 6.91 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update and Settings Manipulation vulnerability

WordPress ZoomSounds - WordPress Wave Audio Player with Playlist plugin = 6.91 - Missing Authorization to Authenticated Subscriber+ Limited Options Update and Settings Manipulation vulnerability discovered by Lucio Sá in WordPress Plugin ZoomSounds versions = 6.91...

WordPress ZoomSounds plugin <= 6.91 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by István Márton in WordPress Plugin ZoomSounds versions = 6.91...

WordPress WC Marketplace plugin <= 4.2.19 - Missing Authorization to Unauthenticated Table Rates Deletion vulnerability

Missing Authorization to Unauthenticated Table Rates Deletion vulnerability discovered by Brian Sans-Souci liardom in WordPress Plugin MultiVendorX versions = 4.2.19...

WordPress KB Support plugin <= 1.7.4 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory vulnerability

Unauthenticated Sensitive Information Exposure Through Unprotected Directory vulnerability discovered by Tim Coen in WordPress Plugin KB Support versions = 1.7.4...

WordPress AI Content Pipelines plugin <= 1.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by Avraham Shemesh in WordPress Plugin AI Content Pipelines versions = 1.6...

WordPress Read More & Accordion plugin <= 3.4.5 - Cross-Site Request Forgery to Local File Inclusion vulnerability

Cross-Site Request Forgery to Local File Inclusion vulnerability discovered by Bassem Essam in WordPress Plugin Read More & Accordion versions = 3.4.7...

WordPress Link Library plugin <= 7.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Link Additional Parameters vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Link Additional Parameters vulnerability discovered by siavashvafshar in WordPress Plugin Link Library versions = 7.7.3...

WordPress Maps - Google Maps plugin <= 1.0.6 - Contributor+ Stored XSS vulnerability

WordPress Maps - Google Maps plugin = 1.0.6 - Contributor+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin Maps versions = 1.0.6...

Exploit for Path Traversal in Yeswiki

--- CVE-2025-31131 - YesWiki 4.5.2 Path Traversal Exploit...

WordPress WP Project Manager plugin < 2.6.25 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Manab Jyoti Dowarah in WordPress Plugin WP Project Manager versions 2.6.25...

WordPress Live Forms plugin <= 4.8.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mika in WordPress Plugin Live Forms versions = 4.8.5...

WordPress Table Block by RioVizual plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Mika in WordPress Plugin Table Block by RioVizual versions = 2.3.1...

WordPress RepairBuddy plugin <= 3.8213 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dhabaleshwar Das in WordPress Plugin RepairBuddy versions = 3.8213...

WordPress Administrator Z plugin <= 2026.02.08 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Chazz Wolcott Patchstack in WordPress Plugin Administrator Z versions = 2026.02.08...

WordPress w3all phpBB integration Plugin <= 2.9.8 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin WP w3all phpBB versions = 2.9.8...

WordPress Freetobook Responsive Widget Plugin <= 1.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Freetobook Responsive Widget versions = 1.1...

WordPress Wishlist plugin <= 1.0.46 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by LVT-tholv2k in WordPress Plugin Wishlist versions = 1.0.46...