WordPress TagDiv Composer plugin <= 5.3 - Unauthenticated Arbitrary PHP Object Instantiation vulnerability

Unauthenticated Arbitrary PHP Object Instantiation vulnerability discovered by mikemyers in WordPress Plugin tagDiv Composer versions = 5.3...

WordPress Product Filter by WBW plugin <= 2.7.9 - Unauthenticated SQL Injection via filtersDataBackend Parameter vulnerability

Unauthenticated SQL Injection via filtersDataBackend Parameter vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Product Filter by WBW versions = 2.7.9...

WordPress Booster for WooCommerce plugin 4.0.1-7.2.4 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by luckybuddy in WordPress Plugin Booster for WooCommerce versions 4.0.1-7.2.4...

CVE-2025-3182

The data shows CVE-2025-3182 affecting projectworlds Online Doctor Appointment Booking System 1.0, with a SQL injection in /patient/getschedule.php caused by manipulating the q parameter. The vulnerability can be exploited remotely and the exploit has been disclosed publicly. Multiple connected s...

WordPress Uncanny Automator plugin <= 6.3.0.2 - Missing Authorization to Privilege Escalation vulnerability

Missing Authorization to Privilege Escalation vulnerability discovered by mikemyers in WordPress Plugin Uncanny Automator versions = 6.3.0.2...

WordPress WP_Identicon plugin <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by johska Patchstack Alliance in WordPress Plugin WPIdenticon versions = 2.0...

WordPress Flickr Photostream plugin <= 3.1.8 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Nguyen Thi Huyen Trang - Skalucy in WordPress Plugin Flickr Photostream versions = 3.1.8...

WordPress DeBounce Email Validator plugin <= 5.7 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin DeBounce Email Validator versions = 5.7...

WordPress CM Header and Footer plugin <= 1.2.4 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin CM Header and Footer versions = 1.2.4...

WordPress Search engine keywords highlighter plugin <= 0.1.3 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by johska in WordPress Plugin Search engine keywords highlighter versions = 0.1.3...

WordPress Latest Custom Post Type Updates plugin <= 1.3.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Latest Custom Post Type Updates versions = 1.3.0...

WordPress Blubrry PowerPress Podcasting plugin MultiSite add-on plugin <= 0.1.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by johska Patchstack Alliance in WordPress Plugin Blubrry PowerPress Podcasting plugin MultiSite add-on versions = 0.1.1...

WordPress include-file plugin <= 1 - Arbitrary File Download Vulnerability

Arbitrary File Download Vulnerability discovered by timomangcut in WordPress Plugin include-file versions = 1...

April Security Advisory Ivanti Connect Secure, Policy Secure & ZTA Gateways (CVE-2025-22457)

This advisory has been updated to make it clear the vulnerability was fully patched in Ivanti Connect Secure released February 11, 2025. Update April 23, 2025: This advisory has been updated to reflect changes to the Ivanti Policy Secure Versioning and the affected release date. Update May 14,...

WordPress TextMe SMS plugin <= 1.9.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Aiden in WordPress Plugin TextMe SMS versions = 1.9.1...

WordPress Publitio plugin <= 2.2.0 - Arbitrary File Read vulnerability

Arbitrary File Read vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Publitio versions = 2.2.0...

WordPress Small Package Quotes – Worldwide Express Edition plugin <= 5.2.19 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mika in WordPress Plugin Small Package Quotes – Worldwide Express Edition versions = 5.2.19...

WordPress FPW Category Thumbnails Plugin <= 1.9.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin FPW Category Thumbnails versions = 1.9.5...

WordPress Payday plugin <= 3.3.18 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mika in WordPress Plugin Payday versions = 3.3.18...

WordPress Docxpresso plugin <= 2.6 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Docxpresso versions = 2.6...