WordPress Booster for WooCommerce plugin <= 7.2.4 - Unauthenticated Double Extension Arbitrary File Upload vulnerability

Unauthenticated Double Extension Arbitrary File Upload vulnerability discovered by luckybuddy in WordPress Plugin Booster for WooCommerce versions = 7.2.4...

WordPress iATS Online Forms plugin <= 1.2 - Authenticated (Contributor+) SQL Injection via order Parameter vulnerability

Authenticated Contributor+ SQL Injection via order Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin iATS Online Forms versions = 1.2...

WordPress Xagio SEO plugin <= 7.1.0.5 - Unauthenticated Sensitive Information Exposure via Unprotected Back-Up Files vulnerability

Unauthenticated Sensitive Information Exposure via Unprotected Back-Up Files vulnerability discovered by wesley wcraft in WordPress Plugin Xagio SEO versions = 7.1.0.5...

WordPress File Manager, Code Editor, and Backup by Managefy plugin <= 1.4.8 - Authenticated (Admin+) Path Traversal to Arbitrary File Download vulnerability

Authenticated Admin+ Path Traversal to Arbitrary File Download vulnerability discovered by Đỗ Quang Huy in WordPress Plugin File Manager, Code Editor, and Backup by Managefy versions = 1.4.8...

WordPress WP Thumbtack Review Slider Plugin <= 2.6 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Vinit Lakra in WordPress Plugin WP Thumbtack Review Slider versions = 2.6...

WordPress Booking System Trafft Plugin <= 1.0.14 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Martino Spagnuolo r3verii in WordPress Plugin Booking System Trafft versions = 1.0.14...

WordPress Chatbox Manager Plugin <= 1.2.6 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by theviper17 in WordPress Plugin Chatbox Manager versions = 1.2.6...

WordPress Transcoder Plugin <= 1.4.0 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin Transcoder versions = 1.4.0...

WordPress Podlove Podcast Publisher Plugin <= 4.2.5 - Open Redirection Vulnerability

Open Redirection Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Podlove Podcast Publisher versions = 4.2.5...

WordPress Simple Page Access Restriction Plugin <= 1.0.32 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Simple Page Access Restriction versions = 1.0.32...

WordPress AfterShip Tracking Plugin <= 1.17.17 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by ch4r0n in WordPress Plugin AfterShip Tracking versions = 1.17.17...

WordPress UiCore Elements Plugin <= 1.3.4 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Abu Hurayra in WordPress Plugin UiCore Elements versions = 1.3.4...

WordPress WP Bulk Delete Plugin <= 1.3.6 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Que Thanh Tuan - Blue Rock in WordPress Plugin WP Bulk Delete versions = 1.3.6...

Exploits and vulnerabilities in Q2 2025

Vulnerability registrations in Q2 2025 proved to be quite dynamic. Vulnerabilities that were published impact the security of nearly every computer subsystem: UEFI, drivers, operating systems, browsers, as well as user and web applications. Based on our analysis, threat actors continue to leverag...

WordPress Printeers Print & Ship plugin <= 1.17.0 - Directory Traversal vulnerability

Directory Traversal vulnerability discovered by Nguyen Xuan Chien Patchstack Alliance in WordPress Plugin Printeers Print & Ship versions = 1.17.0...

WordPress Pin WP Theme < 7.2 is vulnerable to Arbitrary File Upload

Software Pin WP Type Theme Vulnerable versions 7.2 Fixed in 7.2 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2025-53251 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID 85f8a3209836 Credits Bonds Required privilege Subscriber Published 27 August...

WordPress Makeaholic Theme <= 1.8.5 is vulnerable to Broken Access Control

Software Makeaholic Type Theme Vulnerable versions = 1.8.5 Fixed in 1.8.7 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2025-58210 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID de9323d56155 Credits Tran Nguyen Bao Khanh VCI - VNPT...

WordPress ArcHub Theme <= 1.2.12 is vulnerable to Broken Access Control

Software ArcHub Type Theme Vulnerable versions = 1.2.12 Fixed in N/A OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Access Control CVE CVE-2025-0951 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID deda1a0a86d7 Credits Lucio Sá Required...

Linux Distros Unpatched Vulnerability : CVE-2021-39902

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect Authorization in GitLab CE/EE 13.4 or above allows a user with guest membership in a project to modify the severity of an incident. CVE-2021-39902 Not...

SUSE: Security Advisory (SUSE-SU-2025:02973-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...