WordPress WPGYM - Wordpress Gym Management System plugin <= 67.7.0 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover vulnerability

WordPress WPGYM - Wordpress Gym Management System plugin = 67.7.0 - Authenticated Subscriber+ Privilege Escalation via Account Takeover vulnerability discovered by Michelle Porter in WordPress Plugin WPGYM versions = 67.7.0...

WordPress Auto Save Remote Images (Drafts) plugin <= 1.0.9 - Authenticated (Contributor+) Server-Side Request Forgery vulnerability

Authenticated Contributor+ Server-Side Request Forgery vulnerability discovered by Nabil Irawan in WordPress Plugin Auto Save Remote Images Drafts versions = 1.0.9...

WordPress Testimonial plugin <= 2.3 - Authenticated (Contributor+) SQL Injection vulnerability

Authenticated Contributor+ SQL Injection vulnerability discovered by ch4r0n in WordPress Plugin IndiaNIC Testimonial versions = 2.3...

WordPress Duplicate Page and Post plugin <= 2.9.5 - Authenticated (Contributor+) SQL Injection via meta_key Parameter vulnerability

Authenticated Contributor+ SQL Injection via metakey Parameter vulnerability discovered by ISMAILSHADOW in WordPress Plugin Duplicate Page and Post versions = 2.9.5...

WordPress Maspik plugin <= 2.5.6 - Cross-Site Request Forgery vulnerability

Cross-Site Request Forgery vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Maspik – Spam blacklist versions = 2.5.6...

WordPress PowerPack Lite for Elementor plugin <= 2.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting Via 'cursor_url' vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting Via 'cursorurl' vulnerability discovered by zer0gh0st in WordPress Plugin PowerPack Addons for Elementor versions = 2.9.4...

WordPress WPBOT plugin < 7.1.0 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin ChatBot versions 7.1.0...

WordPress Accessibility Checker by Equalize Digital Plugin <= 1.31.0 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Certus Cybersecurity in WordPress Plugin Accessibility Checker by Equalize Digital versions = 1.31.0...

WordPress WP eBay Product Feeds Plugin <= 3.4.8 - Server Side Request Forgery (SSRF) Vulnerability

Server Side Request Forgery SSRF Vulnerability discovered by Nabil Irawan in WordPress Plugin WP eBay Product Feeds versions = 3.4.8...

WordPress PDF Generator for WordPress Plugin <= 1.5.4 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Tran Hoang Tuan Kiet in WordPress Plugin PDF Generator for WordPress versions = 1.5.4...

WordPress Accessibility Checker by Equalize Digital Plugin <= 1.31.0 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Certus Cybersecurity in WordPress Plugin Accessibility Checker by Equalize Digital versions = 1.31.0...

WordPress Pixeline's Email Protector Plugin <= 1.3.8 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Nabil Irawan in WordPress Plugin Pixelines Email Protector versions = 1.3.8...

WordPress Additional Custom Product Tabs for WooCommerce Plugin <= 1.7.3 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin Additional Custom Product Tabs for WooCommerce versions = 1.7.3...

WordPress My Tickets Plugin <= 2.0.22 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin My Tickets versions = 2.0.22...

WordPress Tutor LMS Plugin <= 3.7.4 - SQL Injection Vulnerability

SQL Injection Vulnerability discovered by YCInfosec in WordPress Plugin Tutor LMS versions = 3.7.4...

Security Advisory September 2025 for Ivanti EPM 2024 SU3 and EPM 2022 SU8

Security Advisory Ivanti Endpoint Manager CVE-2025-9712, CVE-2025-9872 Summary Ivanti has released updates for Ivanti Endpoint Manager EPM which addresses high severity vulnerabilities. We are not aware of any customers being exploited by these vulnerabilities at the time of disclosure...

Advisory ROSA-SA-2025-2982

software: tomcat 9.0.37 WASP: ROSA-CHROME unaffected versions = tomcat-9.0.37-11 affected versions tomcat-9.0.37-11 CVE-ID: CVE-2025-49125 BDU-ID: 2025-09499 CVE-Crit: HIGH CVE-DESC.: Apache Tomcat application server vulnerability related to bypassing the authentication procedure by using an...

Advisory ROSA-SA-2025-2975

Software: libarchive 3.6.2 OS: ROSA-CHROME unaffected versions = libarchive-3.6.2-6 affected versions libarchive-3.6.2-6 CVE-ID: CVE-2025-5914 BDU-ID: None CVE-Crit: HIGH CVE-DESC.: A vulnerability has been discovered in libarchive archivereadformatrarseekdata related to an integer overflow that...

Advisory ROSA-SA-2025-2974

software: libreswan 4.15 WASP: ROSA-CHROME unaffected versions = libreswan-4.15-1 affected versions libreswan-4.15-1 CVE-ID: CVE-2024-3652 BDU-ID: 2024-04885 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the "IPsec" VPN protocol library libreswan is related to a reachability assertion when...

Advisory ROSA-SA-2025-2971

software: less 608 WASP: ROSA-CHROME unaffected versions = less-608-3 affected versions less-608-3 CVE-ID: CVE-2024-32487 BDU-ID: 2024-03717 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the UNIX-like UNIX text terminal utility Less is related to incorrect handling of quotation marks in the...