WordPress Echo RSS Feed Post Generator Plugin for WordPress plugin <= 5.4.8.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Echo RSS Feed Post Generator Plugin for WordPress versions = 5.4.8.1...

Slackware: Security Advisory (SSA:2025-168-01)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress HYDRO Theme <= 2.8 is vulnerable to Cross Site Scripting (XSS)

Software HYDRO Type Theme Vulnerable versions = 2.8 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2025-31428 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d4b1bd6f0305 Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity...

PT-2025-26161

Name of the Vulnerable Software and Affected Versions llama index versions prior to 0.12.42 llama index.core versions prior to 0.12.42 Description The SimpleDirectoryReader component in llama index.core is subject to uncontrolled memory consumption due to a flaw in resource management. The num...

WordPress Rankie plugin < 1.8.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Anhchangmutrang in WordPress Plugin Rankie versions 1.8.2...

WordPress Ivory Search plugin < 5.5.10 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by WPscan in WordPress Plugin Ivory Search versions 5.5.10...

WordPress Master Slider plugin <= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via masterslider_pb and ms_slide Shortcodes vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via mastersliderpb and msslide Shortcodes vulnerability discovered by muhammad yudha in WordPress Plugin Master Slider versions = 3.10.8...

WordPress Blog2Social plugin <= 8.4.4 - Authenticated (Subscriber+) SQL Injection via `prgSortPostType` Parameter vulnerability

Authenticated Subscriber+ SQL Injection via prgSortPostType Parameter vulnerability discovered by mikemyers in WordPress Plugin Blog2Social versions = 8.4.4...

WordPress Wise Chat plugin <= 3.3.4 - Unauthenticated Stored Cross-Site Scripting via X-Forwarded-For Header vulnerability

Unauthenticated Stored Cross-Site Scripting via X-Forwarded-For Header vulnerability discovered by Vincent Fourcade vinceMatsui in WordPress Plugin Wise Chat versions = 3.3.4...

WordPress Simply Schedule Appointments plugin <= 1.6.8.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Multiple Shortcodes vulnerability discovered by muhammad yudha in WordPress Plugin Simply Schedule Appointments versions = 1.6.8.30...

WordPress Slider, Gallery, and Carousel by MetaSlider plugin <= 3.98.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via aria-label Parameter vulnerability

Authenticated Contributor+ Stored DOM-Based Cross-Site Scripting via aria-label Parameter vulnerability discovered by Asaf Mozes in WordPress Plugin Responsive Slider by MetaSlider versions = 3.98.0...

WordPress YITH WooCommerce Wishlist plugin <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via id Parameter vulnerability discovered by Asaf Mozes in WordPress Plugin YITH WooCommerce Wishlist versions = 4.5.0...

WordPress StreamWeasels Kick Integration plugin <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via status-classic-offline-text Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via status-classic-offline-text Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin SW Kick Integration versions = 1.1.3...

WordPress Simple Logo Carousel plugin <= 1.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via id Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin Simple Logo Carousel versions = 1.9.3...

WordPress Poll, Survey & Quiz Maker Plugin by Opinion Stage plugin <= 19.9.0 - Incorrect Authorization to Authenticated (Contributor+) Plugin Settings Update vulnerability

Incorrect Authorization to Authenticated Contributor+ Plugin Settings Update vulnerability discovered by Amin Beheshti in WordPress Plugin Poll, Survey & Quiz Maker Plugin by Opinion Stage versions = 19.9.0...

WordPress Drag and Drop Multiple File Upload for Contact Form 7 plugin <= 1.3.8.9 - Unauthenticated Arbitrary File Upload via Insufficient Blacklist Checks vulnerability

Unauthenticated Arbitrary File Upload via Insufficient Blacklist Checks vulnerability discovered by mikemyers in WordPress Plugin Drag and Drop Multiple File Upload – Contact Form 7 versions = 1.3.8.9...

Moderate: Red Hat Security Advisory: skopeo security update

An update for skopeo is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

Moderate: Red Hat Security Advisory: gvisor-tap-vsock security update

An update for gvisor-tap-vsock is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabili...

Ubuntu: Security Advisory (USN-7568-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE Security Advisory (SUSE-SU-2025:01487-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...