16950 matches found
PT-2025-17744 · Woocommerce · Holest Engineering Spreadsheet Price Changer
Name of the Vulnerable Software and Affected Versions: Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light versions through 2.4.37 Description: The issue is related to Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP...
PT-2025-17740 · Unknown · Wpoperation Arrival
Name of the Vulnerable Software and Affected Versions: WPoperation Arrival versions 1.4.5 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability. This allows PHP Local...
PT-2025-17810 · Unknown · Vasaio Qr Code
Name of the Vulnerable Software and Affected Versions: Vasaio QR Code versions 1.2.5 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application, and...
PT-2025-17758 · Unknown · Ghozylab Popup Builder
Name of the Vulnerable Software and Affected Versions: GhozyLab Popup Builder versions 1.1.35 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File...
PT-2025-17833 · WordPress · Ankur Vishwakarma Wp Avcl Automation Helper
Name of the Vulnerable Software and Affected Versions: Ankur Vishwakarma WP AVCL Automation Helper formerly WPFlyLeads versions 3.4 and earlier Description: A Server-Side Request Forgery SSRF issue allows for Server Side Request Forgery. Recommendations: For versions 3.4 and earlier, update to a...
PT-2025-17715 · Unknown · Wpmastertoolkit
Name of the Vulnerable Software and Affected Versions: WPMasterToolKit WPMTK versions up to, and including, 2.5.2 Description: The issue allows authenticated attackers with Administrator-level access and above to read and modify the contents of arbitrary files on the server, potentially containin...
PT-2025-17819 · Unknown · All In One Time Clock Lite
Name of the Vulnerable Software and Affected Versions: All in One Time Clock Lite versions 1.3.324 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. Recommendations: For All in One Time Clock Lite versions 1.3.324 and...
PT-2025-17806 · Unknown · Hccoder Paypal Express Checkout
Name of the Vulnerable Software and Affected Versions: hccoder PayPal Express Checkout versions n/a through 2.1.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an...
PT-2025-17780 · WordPress · Trân Minh-Quân Wpvn
Name of the Vulnerable Software and Affected Versions: Trân Minh-Quân WPVN versions 0.7.8 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. Recommendations: For Trân Minh-Quân WPVN...
PT-2025-17812 · WordPress · Wpzon – Amazon Affiliate Plugin
Name of the Vulnerable Software and Affected Versions: WpZon – Amazon Affiliate Plugin versions 1.3 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Reflected XSS. Recommendations: For versions 1.3 and earlier, update to a version that contains a f...
PT-2025-17793 · Unknown · Bbcode Deluxe
Name of the Vulnerable Software and Affected Versions: BBCode Deluxe versions through 2020.08.01.2 Description: The issue is related to improper neutralization of input during web page generation, which allows for DOM-Based XSS. This can lead to Cross-site Scripting attacks. Recommendations: For...
PT-2025-17733 · Trpc · Trpc
Name of the Vulnerable Software and Affected Versions: tRPC versions 11.0.0 through 11.1.0 Description: The issue allows any unauthenticated user to crash a tRPC 11 WebSocket server by throwing an unhandled error when validating invalid connectionParams. This affects tRPC 11 servers with WebSocke...
PT-2025-17781 · John Weissberg · John Weissberg Print Science Designer
Name of the Vulnerable Software and Affected Versions: John Weissberg Print Science Designer versions 1.3.155 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS in John Weissberg Print Science Designer. Recommendations: For versions 1.3.15...
PT-2025-17826 · Unknown · Billy Bryant Tabs
Name of the Vulnerable Software and Affected Versions: Billy Bryant Tabs versions n/a through 4.0.3 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. Recommendations: For versions n/a through 4.0.3, update to a version later than 4.0.3 to resolve th...
WordPress Buddypress Force Password Change plugin <= 0.1 - Authenticated (Subscriber+) Account Takeover via Password Update vulnerability
Authenticated Subscriber+ Account Takeover via Password Update vulnerability discovered by kr0d in WordPress Plugin Buddypress Force Password Change versions = 0.1...
MAL-2025-3373 Malicious code in @sporta-technology/rn-components.text-input (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2025-3366 Malicious code in @sporta-technology/d11-web-components.toggle (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2025-3361 Malicious code in @sporta-technology/d11-web-components.tags.tags-status (npm)
--- -= Per source details. Do not edit below this line.=-...