CVE-2025-4723

A vulnerability classified as critical was found in itsourcecode Placement Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /allstudent.php. The manipulation of the argument delete leads to sql injection. The attack can be launched remotely. The exploi...

WordPress Posts per Cat plugin <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by muhammad yudha in WordPress Plugin Posts per Cat versions = 1.4.2...

CVE-2025-4714 Campcodes Sales and Inventory System reprint.php sql injection

A vulnerability was found in Campcodes Sales and Inventory System 1.0. It has been classified as critical. Affected is an unknown function of the file /pages/reprint.php. The manipulation of the argument sid leads to sql injection. It is possible to launch the attack remotely. The exploit has bee...

WordPress Tours plugin <= 1.0.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin Tours versions = 1.0.0...

WordPress Jetpack Debug Tools plugin < 2.0.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin Jetpack Debug Tools versions 2.0.1...

WordPress WP2LEADS plugin <= 3.5.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by johska Patchstack Alliance in WordPress Plugin WP2LEADS versions = 3.5.0...

WordPress TI WooCommerce Wishlist plugin <= 2.10.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin TI WooCommerce Wishlist versions = 2.10.0...

WordPress Drag and Drop File Upload for Elementor Forms plugin <= 1.4.3 - Arbitrary File Deletion Vulnerability

Arbitrary File Deletion Vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Drag and Drop File Upload for Elementor Forms versions = 1.4.3...

WordPress Experto CTA Widget – Call To Action, Sticky CTA, Floating Button Plugin <= 1.1.1 - Settings Change Vulnerability

Settings Change Vulnerability discovered by ch4r0n in WordPress Plugin Experto CTA Widget Call To Action, Sticky CTA, Floating Button Plugin versions = 1.1.1...

WordPress Salon booking system plugin <= 10.16 - CSRF to Arbitrary Content Deletion vulnerability

CSRF to Arbitrary Content Deletion vulnerability discovered by NAWardRox Patchstack Alliance in WordPress Plugin Salon booking system versions = 10.16...

CVE-2025-4706

A vulnerability was found in projectworlds Online Examination System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /Procedure3byearwiseVisit.php. The manipulation of the argument Visityear leads to sql injection. The attack can be initiated remotely. T...

WordPress Front End Users plugin <= 3.2.35 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mika in WordPress Plugin Front End Users versions = 3.2.35...

WordPress Responsive Lightbox & Gallery plugin < 2.5.1 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Pierre Rudloff in WordPress Plugin Responsive Lightbox versions 2.5.1...

WordPress File Manager Advanced Shortcode plugin < 2.6.0 - Authenticated (Administrator+) Local JavaScript File Inclusion via Shortcode vulnerability

Authenticated Administrator+ Local JavaScript File Inclusion via Shortcode vulnerability discovered by TANG Cheuk Hei siunam in WordPress Plugin File Manager Advanced Shortcode versions 2.6.0...

WordPress TicketBAI Facturas para WooCommerce plugin <= 3.18 - Unauthenticated Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion vulnerability discovered by CVEhunter in WordPress Plugin TicketBAI Facturas para WooCommerce versions = 3.18...

Exploit for CVE-2025-4094

CVE-2025-4094 – WordPress Digits Plugin This method is usefu...

WordPress Weluka Lite plugin <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Chuck in WordPress Plugin Weluka Lite versions = 1.0.3...

WordPress Bon Toolkit plugin <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Chuck in WordPress Plugin Bon Toolkit versions = 1.3.2...

WordPress EG-Series plugin <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by muhammad yudha in WordPress Plugin EG-Series versions = 2.1.1...

WordPress 百度站长SEO合集(支持百度/神马/Bing/头条推送) plugin <= 2.0.6 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by theviper17y in WordPress Plugin 百度站长SEO合集支持百度/神马/Bing/头条推送 versions = 2.0.6...