WordPress Ivy School Theme <= 1.6.0 is vulnerable to Local File Inclusion

Software Ivy School Type Theme Vulnerable versions = 1.6.0 Fixed in 1.6.1 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-39470 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 2982cc652634 Credits Bonds Required privilege Unauthenticated...

WordPress Dør Theme <= 2.4 is vulnerable to Local File Inclusion

Software Dør Type Theme Vulnerable versions = 2.4 Fixed in 2.4.1 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-39466 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID dbf77e9752df Credits Bonds Required privilege Unauthenticated Published 17...

WordPress Dessau Theme < 1.9 is vulnerable to Local File Inclusion

Software Dessau Type Theme Vulnerable versions 1.9 Fixed in 1.9 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-39463 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 0679c8533d71 Credits Bonds Required privilege Unauthenticated Published 17...

WordPress Foton Theme <= 2.5.2 is vulnerable to Local File Inclusion

Software Foton Type Theme Vulnerable versions = 2.5.2 Fixed in 2.6.1 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-39458 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID e548d81179ab Credits Bonds Required privilege Unauthenticated Published ...

WordPress Eduma Theme <= 5.6.4 is vulnerable to Broken Access Control

Software Eduma Type Theme Vulnerable versions = 5.6.4 Fixed in 5.6.5 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2025-39460 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID a30089a9390c Credits Ananda Dhakal Patchstack Required...

Angular-Base64-Upload Library 0.1.21 - Unauthenticated Remote Code Execution (RCE)

Exploit Title: Angular-Base64-Upload Library 0.1.21 - Unauthenticated Remote Code Execution RCE Date: 10 October 2024 Discovered by : Ravindu Wickramasinghe | rvz @rvizx9 Exploit Author: Ravindu Wickramasinghe | rvz @rvizx9 Vendor Homepage: https://www.npmjs.com/package/angular-base64-upload...

WordPress Real Estate 7 Theme <= 3.5.2 is vulnerable to Privilege Escalation

Software Real Estate 7 Type Theme Vulnerable versions = 3.5.2 Fixed in 3.5.3 OWASP Top 10 A1: Broken Access Control Classification Privilege Escalation CVE CVE-2025-39459 Patch priority High CVSS severity High 7.3 Developer Claim ownership PSID b355428eb863 Credits Ananda Dhakal Patchstack Requir...

CVE-2025-3620

Use after free in USB in Google Chrome prior to 135.0.7049.95 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2025-3620

Use after free in USB in Google Chrome prior to 135.0.7049.95 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2025-3619

Heap buffer overflow in Codecs in Google Chrome on Windows prior to 135.0.7049.95 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Critical...

CVE-2025-3620

Use after free in USB in Google Chrome prior to 135.0.7049.95 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2025-3620

CVE-2025-3620 is a use-after-free in USB handling within Google Chrome/Chromium, fixed in 135.0.7049.95 for Chromium-based builds. The vulnerability allows a remote attacker to trigger heap corruption via a crafted HTML page, with high impact across confidentiality, integrity, and availability as...

CVE-2025-3620

Use after free in USB in Google Chrome prior to 135.0.7049.95 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2025-3619

Heap buffer overflow in Codecs in Google Chrome on Windows prior to 135.0.7049.95 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Critical...

CVE-2025-3619

CVE-2025-3619 affects Google Chrome (Windows) and Chromium code paths dealing with codecs. A heap buffer overflow in Codecs allowed a remote attacker to potentially trigger heap corruption via a crafted HTML page, enabling likely arbitrary code execution or crash as described in the entry. Public...

WordPress WP Editor plugin <= 1.2.9.1 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Read vulnerability

Authenticated Administrator+ Directory Traversal to Arbitrary File Read vulnerability discovered by nquangit in WordPress Plugin WP Editor versions = 1.2.9.1...

WordPress WP Editor plugin <= 1.2.9.1 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Update vulnerability

Authenticated Administrator+ Directory Traversal to Arbitrary File Update vulnerability discovered by nquangit in WordPress Plugin WP Editor versions = 1.2.9.1...

WordPress Form Maker by 10Web plugin < 1.15.32 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Form Maker by 10Web versions 1.15.32...

WordPress Xelion Webchat plugin <= 9.1.0 - Privilege Escalation Vulnerability

Privilege Escalation Vulnerability discovered by LVT-tholv2k in WordPress Plugin Xelion Webchat versions = 9.1.0...

WordPress Starfish Review Generation & Marketing plugin <= 3.1.19 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by LVT-tholv2k in WordPress Plugin Starfish Review Generation & Marketing versions = 3.1.19...