WordPress Hostel plugin < 1.1.5.8 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Tommaso Gregori p1s1o in WordPress Plugin Hostel versions 1.1.5.8...

CVE-2025-7188

A vulnerability classified as critical was found in code-projects Chat System 1.0. Affected by this vulnerability is an unknown functionality of the file /user/addmember.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been...

WordPress ProfileGrid plugin <= 5.9.5.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin ProfileGrid versions = 5.9.5.2...

WordPress Wishlist for WooCommerce <= 3.2.3 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by ch4r0n in WordPress Plugin Wishlist for WooCommerce versions = 3.2.3...

WordPress Pro Bulk Watermark Plugin for WordPress Theme <= 2.0 is vulnerable to Path Traversal

Software Pro Bulk Watermark Plugin for WordPress Type Theme Vulnerable versions = 2.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Path Traversal CVE CVE-2025-28973 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID c40f943bba08 Credits Tran Nguyen Bao Khanh VCI -...

WordPress Traveler Theme < 3.2.2 is vulnerable to SQL Injection

Software Traveler Type Theme Vulnerable versions 3.2.2 Fixed in 3.2.2 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2025-52714 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID d97b1d91ed8e Credits Thái An Required privilege Unauthenticated Published 10...

Ubuntu: Security Advisory (USN-7623-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-7627-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress WoodMart Theme <= 8.2.5 is vulnerable to Broken Access Control

Software WoodMart Type Theme Vulnerable versions = 8.2.5 Fixed in 8.2.6 OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Access Control CVE CVE-2025-6745 Patch priority Low CVSS severity Low 5.3 Developer Xtemos PSID db887fae132e Credits stealthcopter Required...

📄 WordPress Events Manager 7.0.3 SQL Injection

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the orderby parameter in all versions up to, and including, 7.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

SUSE: Security Advisory (SUSE-SU-2025:02244-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-7607-3)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2025:02241-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 41 : chromium (2025-c05ae72339)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-c05ae72339 advisory. Update to 138.0.7204.92 High CVE-2025-6554: Type Confusion in V8 Tenable has extracted the preceding description block directly from the Fedora...

Ubuntu: Security Advisory (USN-7622-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-7627-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-7624-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress WP Lightbox 2 plugin < 3.0.6.8 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Pierre Rudloff in WordPress Plugin WP Lightbox 2 versions 3.0.6.8...

WordPress Sharable Password Protected Posts plugin < 1.1.1 - Unauthenticated Password Protect Post Access vulnerability

Unauthenticated Password Protect Post Access vulnerability discovered by Pierre Rudloff in WordPress Plugin Sharable Password Protected Posts versions 1.1.1...

WordPress Easy Contact Form Lite plugin <= 1.1.28 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Krugov Artyom in WordPress Plugin Easy Contact Form Lite versions = 1.1.28...