PT-2025-22097 · Chimpstudio · Chimpstudio Foodbakery Sticky Cart

Name of the Vulnerable Software and Affected Versions: Chimpstudio Foodbakery Sticky Cart versions 3.2 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. Recommendations: For versions 3.2 and earlier, update to a version that fixes...

PT-2025-22048 · Unknown · Wp-Cyr-Cho

Name of the Vulnerable Software and Affected Versions: wp-cyr-cho versions 0.1 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For versions 0.1 and earlier, update to a versi...

PT-2025-21964 · Unknown · Back Button Widget

Name of the Vulnerable Software and Affected Versions: Back Button Widget versions 1.6.8 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can injec...

PT-2025-22096 · Unknown · Roninwp Fat Services Booking

Name of the Vulnerable Software and Affected Versions: roninwp FAT Services Booking versions n/a through 5.6 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2025-22105 · Unknown · Mojoomla Hospital Management System

Name of the Vulnerable Software and Affected Versions: mojoomla Hospital Management System versions prior to 47.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential...

PT-2025-21971 · WordPress · Wp Mapa Politico Espana

Name of the Vulnerable Software and Affected Versions: WP Mapa Politico España versions 3.8.0 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. Recommendations: For WP Mapa Politico...

ALSA-2025:7893 Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: grafana: Cross-site Scripting XSS in Grafana via Custom Frontend Plugins and Open Redirect CVE-2025-4123 For more details about the security issues, including the impact, ...

PT-2025-22016 · Templateinvaders · Ti Woocommerce Wishlist

Name of the Vulnerable Software and Affected Versions: TemplateInvaders TI WooCommerce Wishlist versions through 2.9.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an...

CVE-2024-55063

Multiple Code Injection vulnerabilities in EasyVirt DC NetScope = 8.7.0 allows remote authenticated attackers to execute arbitrary code via the 1 lang parameter to /international/keyboard/options; the 2 keyboardlayout or 3 keyboardvariant parameter to /international/settings/keyboard; the 4...

PT-2025-22088 · WordPress · Themegoods Grand Restaurant

Name of the Vulnerable Software and Affected Versions: ThemeGoods Grand Restaurant WordPress versions n/a through 7.0 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal'. This allows for Path Traversal in ThemeGoods...

PT-2025-21947 · Unknown · Affiliates Manager Google Recaptcha Integration

Name of the Vulnerable Software and Affected Versions: Affiliates Manager Google reCAPTCHA Integration versions 1.0.0 through 1.0.6 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS in the Affiliates Manager Google reCAPTCHA Integration...

PT-2025-21965 · Woocommerce · Free Shipping Bar: Amount Left For Free Shipping For Woocommerce

Name of the Vulnerable Software and Affected Versions: Free Shipping Bar: Amount Left for Free Shipping for WooCommerce versions through 2.4.6 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stor...

PT-2025-21957 · Elementor · Exclusive Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Exclusive Addons Elementor versions n/a through 2.7.9 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means an attacker can...

PT-2025-21987 · Woocommerce · Japanized For Woocommerce

Name of the Vulnerable Software and Affected Versions: Japanized For WooCommerce versions 2.6.40 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user. This issue can be exploited by tricking a user...

PT-2025-21972 · Unknown · Ninjateam Gdpr Ccpa Compliance Support

Name of the Vulnerable Software and Affected Versions: Ninja Team GDPR CCPA Compliance Support versions 2.7.3 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For...

PT-2025-22061 · Unknown · Binti76 Total Donations

Name of the Vulnerable Software and Affected Versions: binti76 Total Donations versions 3.0.8 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers ...

PT-2025-22076 · Mojoomla · Wpams

Name of the Vulnerable Software and Affected Versions: WPAMS versions prior to 44.0 Description: The issue affects the mojoomla WPAMS, allowing PHP Local File Inclusion due to improper control of filename for include/require statement in PHP program, also known as 'PHP Remote File Inclusion'...

PT-2025-22110 · Symfony · Symfony/Ux-Live-Component +1

Name of the Vulnerable Software and Affected Versions: symfony/ux-twig-component versions prior to 2.25.1 symfony/ux-live-component versions prior to 2.25.1 Description: The issue concerns the rendering of attributes or the use of methods that return a ComponentAttributes instance, which can lead...

WordPress AffiliateImporterEb plugin <= 1.0.6 - Reflected XSS via Search vulnerability

Reflected XSS via Search vulnerability discovered by Bob Matyas in WordPress Plugin AffiliateImporterEb versions = 1.0.6...

MAL-2025-3955 Malicious code in muto-kaiju-npm-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c0ab3464568eaf7276dd21b69d889e2dfa9dcf3b71917dd7f1c9bf08a310de52 The OpenSSF Package Analysis project identified 'muto-kaiju-npm-native' @ 1.0.4 npm as malicious. It is considered malicious because: - The...