WordPress Carousel Ultimate Plugin <= 1.8 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Nabil Irawan in WordPress Plugin Carousel Ultimate versions = 1.8...

WordPress Ultimate Client Dash Plugin <= 4.7 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Que Thanh Tuan Blue Rock in WordPress Plugin Ultimate Client Dash versions = 4.7...

PT-2025-36193

Name of the Vulnerable Software and Affected Versions: Ultimate AJAX Login versions n/a through 1.2.1 Description: The software contains a Cross-Site Request Forgery CSRF vulnerability that also allows Reflected Cross-Site Scripting XSS. Recommendations: Update Ultimate AJAX Login to a version...

WordPress plugin Ultimate Client Dash 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

WordPress plugin Ultimate AJAX Login 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

WordPress plugin Carousel Ultimate 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2025-58854: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Samer Bechara Ultimate AJAX Login ultimate-ajax-login allows Reflected XSS.This issue affects Ultimate AJAX Login: from n/a through = 1.2.1...

PT-2025-36150

Name of the Vulnerable Software and Affected Versions: WP CodeUs Ultimate Client Dash versions through 4.6 Description: The software contains an Improper Neutralization of Input During Web Page Generation issue, which allows for Stored Cross-site Scripting XSS. Recommendations: Update WP CodeUs...

CVE-2025-58811: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP CodeUs Ultimate Client Dash ulimate-client-dash allows Stored XSS.This issue affects Ultimate Client Dash: from n/a through = 4.7...

CVE-2025-58820: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Themepoints Carousel Ultimate carousel allows Stored XSS.This issue affects Carousel Ultimate: from n/a through = 1.8...

PT-2025-36159

Name of the Vulnerable Software and Affected Versions: Themepoints Carousel Ultimate versions through 1.8 Description: Themepoints Carousel Ultimate is susceptible to a cross-site scripting XSS issue due to improper neutralization of input during web page generation. This allows for stored XSS...

WordPress Ultimate Tag Warrior Importer plugin cross-site request forgery vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. The WordPress Ultimate Tag Warrior Importer plugin suffers from a cross-site request forgery vulnerability that arises when a web application does not adequately validate that a...

Linux Distros Unpatched Vulnerability : CVE-2023-6564

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered in GitLab EE Premium and Ultimate affecting versions 16.4.3, 16.5.3, and 16.6.1. In projects using subgroups to define who can push...

CVE-2025-9374: Cross-Site Request Forgery (CSRF)

The Ultimate Tag Warrior Importer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to import tags granted they can...

WordPress plugin Ultimate Tag Warrior Importer 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. The WordPress Ultimate Tag Warrior Importer plugin suffers from a cross-site request forgery vulnerability that arises when a web application does not adequately validate that a...

WordPress Ultimate Tag Warrior Importer plugin <= 0.2 - Cross-Site Request Forgery vulnerability

Cross-Site Request Forgery vulnerability discovered by Nabil Irawan in WordPress Plugin Ultimate Tag Warrior Importer versions = 0.2...

CVE-2025-48321

CVE-2025-48321 describes a CSRF to Stored XSS vulnerability in the WordPress plugin Ultimate Twitter Profile Widget (versions up to 1.0). Affected: Ultimate Twitter Profile Widget from n/a through 1.0. CVSS 3.1 base score 7.1 (HIGH). Root cause/impact: CSRF condition enables stored XSS via the wi...

CVE-2025-48321: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in dyiosah Ultimate twitter profile widget ultimate-twitter-profile-widget allows Stored XSS.This issue affects Ultimate twitter profile widget: from n/a through = 1.0...

PT-2025-35009

Name of the Vulnerable Software and Affected Versions: dyiosah Ultimate twitter profile widget versions through 1.0 Description: A Cross-Site Request Forgery CSRF vulnerability exists in dyiosah Ultimate twitter profile widget, which also allows Stored Cross-Site Scripting XSS. Recommendations: A...

Linux Distros Unpatched Vulnerability : CVE-2025-5121

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered in GitLab CE/EE affecting all versions from 17.11 before 17.11.4 and 18.0 before 18.0.2. A missing authorization check may have...