2007 matches found
CVE-2025-8561
The Ova Advent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...
CVE-2025-10406
The BlindMatrix e-Commerce WordPress plugin before 3.1 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users, such as contributors, to perform LFI attacks...
EUVD-2025-34519
The BlindMatrix e-Commerce WordPress plugin before 3.1 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users, such as contributors, to perform LFI attacks...
CVE-2025-10406 BlindMatrix e-Commerce < 3.1 - Contributor+ LFI
The BlindMatrix e-Commerce WordPress plugin before 3.1 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users, such as contributors, to perform LFI attacks...
CVE-2025-10406
The BlindMatrix e-Commerce WordPress plugin (versions before 3.1 ) is vulnerable to a Local File Inclusion (LFI) attack. The root cause is a failure to validate certain shortcode attributes , which are subsequently used to generate paths passed to include functions . This flaw allows authenticate...
CVE-2025-10406 BlindMatrix e-Commerce < 3.1 - Contributor+ LFI
The BlindMatrix e-Commerce WordPress plugin before 3.1 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users, such as contributors, to perform LFI attacks...
PT-2025-42229
The BlindMatrix e-Commerce WordPress plugin before 3.1 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users, such as contributors, to perform LFI attacks...
CVE-2025-10406: Improper Limitation of a Pathname to a Restricted Directory
The BlindMatrix e-Commerce WordPress plugin before 3.1 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users, such as contributors, to perform LFI attacks...
PT-2025-42286
Name of the Vulnerable Software and Affected Versions Quick Social Login plugin for WordPress versions prior to 1.4.7 Description The Quick Social Login plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'quick-login' shortcode. This is due to inadequate input...
EUVD-2018-20769
Malware in sbrugna...
EUVD-2021-11380
Malware in sbrugna...
CVE-2025-9876
The Ird Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'irdslider' shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...
EUVD-2022-51958
Malicious code in bioql PyPI...
EUVD-2022-51818
Malicious code in bioql PyPI...
EUVD-2022-51802
Malicious code in bioql PyPI...
EUVD-2022-51794
Malicious code in bioql PyPI...
EUVD-2022-52106
Malicious code in bioql PyPI...
EUVD-2023-12301
Malicious code in bioql PyPI...