WordPress Time Based Greeting plugin <= 2.2.2 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Time Based Greeting versions = 2.2.2...

CVE-2025-46435

CVE-2025-46435 - Time Based Greeting (WordPress plugin) : A CSRF flaw in Yash Binani Time Based Greeting, exploitable in versions &lt;= 2.2.2, can lead to Stored XSS. Product: Time Based Greeting plugin for WordPress. Root cause: CSRF enabling stored script execution; Impact per CVSS 3.1: Confide...

WordPress Category Posts Widget plugin < 4.9.20 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Category Posts Widget versions 4.9.20...

Laravel < 5.6.30 RCE Vulnerability

Laravel is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:laravel:laravel"; ...

WordPress Vikinger Theme <= 1.9.30 is vulnerable to Privilege Escalation

Software Vikinger Type Theme Vulnerable versions = 1.9.30 Fixed in 1.9.31 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2025-2238 Patch priority Low CVSS severity Low 8.8 Developer Claim ownership PSID 27a6956156c8 Credits Tonn Required...

Debian: Security Advisory (DLA-4136-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GIMP Buffer Overflow Vulnerability (Apr 2025) - Windows

GIMP is prone to a buffer overflow vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:gimp:gimp"; ifdescription...

Ubuntu: Security Advisory (USN-7454-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-7445-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress Plugin Upgrade Time Out plugin <= 1.0 - Stored XSS via CSRF vulnerability

Stored XSS via CSRF vulnerability discovered by Daniel Ruf in WordPress Plugin Plugin Upgrade Time Out versions = 1.0...

WordPress Advanced Accordion Gutenberg Block plugin <= 5.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by Avraham Shemesh in WordPress Plugin Advanced Accordion Gutenberg Block versions = 5.0.2...

WordPress Lottie Player plugin <= 1.1.8 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via File Upload vulnerability discovered by Avraham Shemesh in WordPress Plugin Lottie Player block - Implement Lottie animations. versions = 1.1.8...

WordPress WPMasterToolKit (WPMTK) – All in one plugin plugin <= 2.5.2 - Authenticated (Administrator+) to Arbitrary File Read and Write vulnerability

Authenticated Administrator+ to Arbitrary File Read and Write vulnerability discovered by nquangit in WordPress Plugin WPMasterToolKit versions = 2.5.2...

WordPress Verification SMS with TargetSMS plugin <= 1.5 - Unauthenticated Limited Remote Code Execution vulnerability

Unauthenticated Limited Remote Code Execution vulnerability discovered by Cheng Liu in WordPress Plugin Verification SMS with TargetSMS versions = 1.5...

WordPress FuseDesk plugin <= 6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via successredirect Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via successredirect Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin FuseDesk versions = 6.7...

WordPress Buddypress Force Password Change plugin <= 0.1 - Authenticated (Subscriber+) Account Takeover via Password Update vulnerability

Authenticated Subscriber+ Account Takeover via Password Update vulnerability discovered by kr0d in WordPress Plugin Buddypress Force Password Change versions = 0.1...

WordPress Frontend Login and Registration Blocks plugin <= 1.0.7 - Authenticated (Subscriber+) Privilege Escalation via Password Reset vulnerability

Authenticated Subscriber+ Privilege Escalation via Password Reset vulnerability discovered by kr0d in WordPress Plugin Frontend Login and Registration Blocks versions = 1.0.8...

WordPress Flynax Bridge plugin <= 2.2.0 - Unauthenticated Privilege Escalation via Account Takeover vulnerability

Unauthenticated Privilege Escalation via Account Takeover vulnerability discovered by kr0d in WordPress Plugin Flynax Bridge versions = 2.2.0...

WordPress Woocommerce Automatic Order Printing plugin <= 4.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Order Information Disclosure vulnerability

Insecure Direct Object Reference to Authenticated Subscriber+ Order Information Disclosure vulnerability discovered by Lucio Sá in WordPress Plugin Woocommerce Automatic Order Printing versions = 4.1...

WordPress My Tickets plugin <= 2.0.16 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by Le Ngoc Anh in WordPress Plugin My Tickets versions = 2.0.16...