WordPress CarDealerPress plugin <= 6.8.2505.00 - Authenticated (Contributor+) Stored Cross-Site Scripting via saleclass Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via saleclass Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin CarDealerPress versions = 6.8.2505.00...

WordPress Multiple Post Type Order plugin <= 1.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mpto Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via mpto Shortcode vulnerability discovered by Gilang in WordPress Plugin Multiple Post Type Order versions = 1.10.0...

WordPress Woocommerce Multiple Addresses plugin <= 1.0.7.1 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by Chuck in WordPress Plugin Woocommerce Multiple Addresses versions = 1.0.7.1...

WordPress PeproDev Ultimate Profile Solutions plugin 1.9.1-7.5.2 - Missing Authorization to Limited Unauthenticated Arbitrary User Meta Update

Missing Authorization to Limited Unauthenticated Arbitrary User Meta Update vulnerability discovered by kr0d in WordPress Plugin PeproDev Ultimate Profile Solutions versions 1.9.1-7.5.2...

WordPress PeproDev Ultimate Profile Solutions plugin 1.9.1-7.5.2 - Missing Authorization to Unauthenticated Email Enumeration

Missing Authorization to Unauthenticated Email Enumeration vulnerability discovered by kr0d in WordPress Plugin PeproDev Ultimate Profile Solutions versions 1.9.1-7.5.2...

WordPress PeproDev Ultimate Profile Solutions 1.9.1-7.5.2 plugin - Authentication Bypass to Account Takeover

Authentication Bypass to Account Takeover vulnerability discovered by kr0d in WordPress Plugin PeproDev Ultimate Profile Solutions versions 1.9.1-7.5.2...

WordPress WP SmartPay plugin 1.1.0-2.7.13 - Authenticated (Subscriber+) Information Exposure vulnerability

Authenticated Subscriber+ Information Exposure vulnerability discovered by kr0d in WordPress Plugin WP SmartPay versions 1.1.0-2.7.13...

CVE-2025-4359

A vulnerability classified as critical was found in itsourcecode Gym Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=deletemember. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The...

WordPress PGS Core plugin <= 5.8.0 - Missing Authorization via Multiple Functions vulnerability

Missing Authorization via Multiple Functions vulnerability discovered by István Márton in WordPress Plugin PGS Core versions = 5.8.0...

CVE-2025-4313

CVE-2025-4313 affects SourceCodester Advanced Web Store 1.0. The vulnerability is in an unknown function of the file /admin/admin_addnew_product.php, where manipulating the argument txtProdId enables a SQL injection. It is described as exploitable remotely, with public exploit disclosure noted. M...

Ubuntu: Security Advisory (USN-7476-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-7479-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP12 : openssl (EulerOS-SA-2025-1432)

According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact...

WordPress Cision Block plugin <= 4.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via id Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin Cision Block versions = 4.3.0...

WordPress Depicter Slider plugin <= 3.6.1 - Unauthenticated SQL Injection via 's' Parameter vulnerability

Unauthenticated SQL Injection via 's' Parameter vulnerability discovered by Muhamad Visat in WordPress Plugin Depicter Slider versions = 3.6.1...

WordPress User Registration plugin <= 4.2.1 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion vulnerability

Insecure Direct Object Reference to Unauthenticated Limited User Deletion vulnerability discovered by wesley wcraft in WordPress Plugin User Registration versions = 4.2.1...

WordPress LayoutBoxx plugin <= 0.3.1 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Avraham Shemesh in WordPress Plugin LayoutBoxx versions = 0.3.1...

WordPress AHAthat Plugin plugin <= 1.6 - Cross-Site Request Forgery to AHA Page Deletion vulnerability

Cross-Site Request Forgery to AHA Page Deletion vulnerability discovered by Régis SENET in WordPress Plugin AHAthat versions = 1.6...

WordPress Reales WP STPT plugin <= 2.1.2 - Unauthorized User Registration vulnerability

Unauthorized User Registration vulnerability discovered by Foxyyy in WordPress Plugin Reales WP STPT versions = 2.1.2...

CVE-2025-4096

Heap buffer overflow in HTML in Google Chrome prior to 136.0.7103.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...