WordPress Colibri Page Builder Plugin < 1.0.334 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by savphill in WordPress Plugin Colibri Page Builder versions 1.0.334...

WordPress DriCub Theme <= 2.9 is vulnerable to Broken Access Control

Software DriCub Type Theme Vulnerable versions = 2.9 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2025-58004 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 170d8c12fcfe Credits Bonds Required privilege Unauthenticated...

WordPress Import Markdown Plugin <= 1.14 is vulnerable to Cross Site Scripting (XSS)

Software Import Markdown Type Plugin Vulnerable versions = 1.14 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2025-57901 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 3d88e282a665 Credits minseok Kim Required privilege Contributo...

WordPress Ads by WPQuads Plugin <= 2.0.94 is vulnerable to Cross Site Scripting (XSS)

Software Ads by WPQuads Type Plugin Vulnerable versions = 2.0.94 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2025-53459 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 4aae3292fa40 Credits Fiqro Najiah Required privilege...

WordPress DriCub Theme <= 2.9 is vulnerable to Server Side Request Forgery (SSRF)

Software DriCub Type Theme Vulnerable versions = 2.9 Fixed in N/A OWASP Top 10 A3: Injection Classification Server Side Request Forgery SSRF CVE CVE-2025-58005 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 1d20e3f4bf71 Credits Bonds Required privilege Unauthenticated...

WordPress Core <= 6.8.2 is vulnerable to Cross Site Scripting (XSS)

Software WordPress Type WordPress Core Vulnerable versions = 6.8.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2025-58674 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 5699e05fdc3a Credits savphill Required privilege Author...

WordPress Core <= 6.8.2 is vulnerable to Sensitive Data Exposure

Software WordPress Type WordPress Core Vulnerable versions = 6.8.2 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2025-58246 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 1cbfa3e3eda1 Credits Abu Hurayra Required...

WordPress WPLMS Theme <= 4.970 is vulnerable to Broken Access Control

Software WPLMS Type Theme Vulnerable versions = 4.970 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2025-58668 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID b45c9c5a0459 Credits Rafie Muhammad Patchstack Required privile...

openSUSE Security Advisory (SUSE-SU-2025:03271-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress Custom Login And Signup Widget plugin <= 1.0 - Cross-Site Request Forgery vulnerability

Cross-Site Request Forgery vulnerability discovered by sk4r1 in WordPress Plugin Custom Login And Signup Widget versions = 1.0...

WordPress Browser Sniff plugin <= 2.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability

Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability discovered by johska in WordPress Plugin Browser Sniff versions = 2.3...

WordPress Secure Passkeys plugin <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Passkey Exposure and Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Passkey Exposure and Deletion vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Secure Passkeys versions = 1.2.1...

SUSE CVE-2025-30681

unknown...

SUSE CVE-2025-50082

unknown...

WordPress Robcore Netatmo plugin <= 1.7 - Authenticated (Contributor+) SQL Injection via robcore-netatmo Shortcode vulnerability

Authenticated Contributor+ SQL Injection via robcore-netatmo Shortcode vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Robcore Netatmo versions = 1.7...

PT-2025-38520

Westermo Network Technologies has identified a severe command injection vulnerability in its WeOS 5 operating system that could allow attackers to execute unauthorized commands remotely. Key Points: - A CVSS v4 score of 8.7 indicates a high risk of exploitation. - Remote attackers with...

SUSE CVE-2025-10502

Heap buffer overflow in ANGLE in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via malicious network traffic. Chromium security severity: High...

SUSE CVE-2025-10585

Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

WordPress Embed PDF for WPForms plugin <= 1.1.5 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by theviper17y in WordPress Plugin Embed PDF for WPForms versions = 1.1.5...

WordPress Download Manager plugin <= 3.3.23 - Reflected Cross-Site Scripting via `user_ids` Parameter vulnerability

Reflected Cross-Site Scripting via userids Parameter vulnerability discovered by vgo0 in WordPress Plugin Download Manager versions = 3.3.23...