WordPress Internal Linking of Related Contents plugin <= 1.1.8 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by astra.r3verii Patchstack Alliance in WordPress Plugin Internal Linking of Related Contents versions = 1.1.8...

WordPress WP Pipes plugin <= 1.4.3 - SQL Injection Vulnerability

SQL Injection Vulnerability discovered by LVT-tholv2k in WordPress Plugin WP Pipes versions = 1.4.3...

WordPress smart SEO plugin <= 4.0 - SQL Injection Vulnerability

SQL Injection Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme smart SEO versions = 4.0...

WordPress Responsive Coming Soon Landing Page / Holding Page for WordPress plugin <= 3.0 - Privilege Escalation Vulnerability

Privilege Escalation Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Responsive Coming Soon Landing Page / Holding Page for WordPress versions = 3.0...

Exploit for CVE-2024-7954

CVE-2024-7954 - SPIP 4.2.8 Remote Command Execution RCE Expl...

WordPress Noisa Theme <= 2.6.0 is vulnerable to PHP Object Injection

Software Noisa Type Theme Vulnerable versions = 2.6.0 Fixed in 2.6.2 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-53560 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 60e4fbd75f25 Credits Bonds Required privilege Subscriber Published 8 Jul...

WordPress Sala Theme <= 1.1.4 is vulnerable to Privilege Escalation

Software Sala Type Theme Vulnerable versions = 1.1.4 Fixed in N/A OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2025-4606 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID e358e6b6574a Credits Thái An Required...

WordPress Hillter Theme <= 3.0.7 is vulnerable to PHP Object Injection

Software Hillter Type Theme Vulnerable versions = 3.0.7 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-24777 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 8e030521d3a0 Credits Bonds Required privilege Subscriber Published 8 Jul...

WordPress Sala Theme <= 1.1.3 is vulnerable to Broken Access Control

Software Sala Type Theme Vulnerable versions = 1.1.3 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2025-52803 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 485a6b36a4e6 Credits Thái An Required privilege Unauthenticate...

WordPress Nuss Theme <= 1.3.3 is vulnerable to Broken Access Control

Software Nuss Type Theme Vulnerable versions = 1.3.3 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2025-52804 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID bd7e0e488ec4 Credits Thái An Required privilege Unauthenticate...

Ubuntu: Security Advisory (USN-7619-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress Yogi Theme <= 2.9.0 is vulnerable to PHP Object Injection

Software Yogi Type Theme Vulnerable versions = 2.9.0 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-24779 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 10b2a1712298 Credits Bonds Required privilege Subscriber Published 8 July,...

CVE-2025-7149

A vulnerability was found in Campcodes Advanced Online Voting System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/candidatesdelete.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The explo...

WordPress Guest Support plugin <= 1.2.2 - Missing Authorization to Unauthenticated Ticket Deletion vulnerability

Missing Authorization to Unauthenticated Ticket Deletion vulnerability discovered by Amin Beheshti in WordPress Plugin Guest Support versions = 1.2.2...

WordPress Essential Addons for Elementor plugin <= 6.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via `Calendar` And `Business Reviews` Widgets vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Calendar And Business Reviews Widgets vulnerability discovered by Webbernaut in WordPress Plugin Essential Addons for Elementor versions = 6.1.19...

CVE-2025-7147

A vulnerability has been found in CodeAstro Patient Record Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /login.php. The manipulation of the argument uname leads to sql injection. The attack can be launched remotely. The...

WordPress AI Engine plugin <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via `mwai_chatbot` Shortcode `id` Parameter vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting via mwaichatbot Shortcode id Parameter vulnerability discovered by mikemyers in WordPress Plugin AI Engine versions = 2.8.4...

WordPress GoZen Forms plugin <= 1.1.5 - Unauthenticated SQL Injection via dirGZActiveForm() vulnerability

Unauthenticated SQL Injection via dirGZActiveForm vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin GoZen Forms versions = 1.1.5...

WordPress WP Human Resource Management plugin 2.0.0-2.2.17 - Missing Authorization to Authenticated (Employee+) Privilege Escalation vulnerability

Missing Authorization to Authenticated Employee+ Privilege Escalation vulnerability discovered by kr0d in WordPress Plugin WP Human Resource Management versions 2.0.0-2.2.17...

WordPress WP Firebase Push Notification plugin <= 1.2.0 - Cross-Site Request Forgery to Broadcast Notification vulnerability

Cross-Site Request Forgery to Broadcast Notification vulnerability discovered by Nabil Irawan in WordPress Plugin WP Firebase Push Notification versions = 1.2.0...