PT-2025-43591

Name of the Vulnerable Software and Affected Versions Check Plagiarism plugin for WordPress versions up to and including 2.0 Description The Check Plagiarism plugin for WordPress has an issue where data can be modified without authorization. This is due to a missing capability check within the ch...

PT-2025-43594

Name of the Vulnerable Software and Affected Versions WordPress Supervisor Plugin versions up to and including 1.3.2 Description The Supervisor plugin for WordPress is susceptible to unauthorized data modification. This is due to a missing capability check in multiple AJAX functions. Authenticate...

Security Analysis of LTE Connectivity in Connected Cars: A Case Study of Tesla

Modern connected vehicles rely on persistent LTE connectivity to enable remote diagnostics, over-the-air OTA updates, and critical safety services. While mobile network vulnerabilities are well documented in the smartphone ecosystem, their impact in safety-critical automotive settings remains...

PT-2025-43592

Name of the Vulnerable Software and Affected Versions LLM Hubspot Blog Import plugin for WordPress versions up to and including 1.0.1 Description The LLM Hubspot Blog Import plugin for WordPress is susceptible to unauthorized data modification. This is due to a missing capability check on the...

PT-2025-43590

Name of the Vulnerable Software and Affected Versions Originality.ai AI Checker plugin for WordPress versions through 1.0.12 Description The Originality.ai AI Checker plugin for WordPress is susceptible to unauthorized data loss. This is due to a missing capability check within the ai scan result...

WordPress Check Plagiarism plugin <= 2.0 - Missing Authorization to Authenticated (Subscriber+) Settings Update vulnerability

Missing Authorization to Authenticated Subscriber+ Settings Update vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Check Plagiarism versions = 2.0...

WordPress LLM Hubspot Blog Import plugin <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Hubspot Import vulnerability

Missing Authorization to Authenticated Subscriber+ Hubspot Import vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin LLM Hubspot Blog Import versions = 1.0.1...

WordPress Supervisor plugin <= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update vulnerability

Missing Authorization to Authenticated Subscriber+ Settings Update vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Supervisor versions = 1.3.2...

WordPress Originality.ai AI Checker plugin <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'ai_get_table' vulnerability

Missing Authorization to Authenticated Subscriber+ Sensitive Information Disclosure via 'aigettable' vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Originality.ai AI Checker versions = 1.0.12...

WordPress Originality.ai AI Checker plugin <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) Scan Log Deletion via ' ai_scan_result_remove' vulnerability

Missing Authorization to Authenticated Subscriber+ Scan Log Deletion via ' aiscanresultremove' vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Originality.ai AI Checker versions = 1.0.12...

CVE-2025-11128

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.1.0 via the 'feedzysanitizefeeds' function. This makes it possible for authenticated attackers...

CVE-2025-6833

The All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0 via the 'aiotimeclocklitejs' AJAX action due to missing validation on a user controlled key. This makes it...

CVE-2025-10570

The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.38 via the saverefundrequest function. This makes it possible for authenticated attackers, with subscriber-level access and above, to submit...

CVE-2025-10638

The NS Maintenance Mode for WP WordPress plugin through 1.3.1 lacks authorization in its subscriber export function allowing unauthenticated attackers to download a list of a site's subscribers containing their name and email address...

CVE-2025-6833

The All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0 via the 'aiotimeclocklitejs' AJAX action due to missing validation on a user controlled key. This makes it...

CVE-2025-10570

CVE-2025-10570 affects the WordPress plugin Flexible Refund and Return Order for WooCommerce (versions

CVE-2025-10570 Flexible Refund and Return Order for WooCommerce <= 1.0.38 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Refund

The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.38 via the saverefundrequest function. This makes it possible for authenticated attackers, with subscriber-level access and above, to submit...

EUVD-2025-35351

The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.38 via the saverefundrequest function. This makes it possible for authenticated attackers, with subscriber-level access and above, to submit...

EUVD-2025-35354

The NS Maintenance Mode for WP WordPress plugin through 1.3.1 lacks authorization in its subscriber export function allowing unauthenticated attackers to download a list of a site's subscribers containing their name and email address...

CVE-2025-10638

The NS Maintenance Mode for WP WordPress plugin through 1.3.1 lacks authorization in its subscriber export function allowing unauthenticated attackers to download a list of a site's subscribers containing their name and email address...