CVE-2025-47691

Improper Control of Generation of Code 'Code Injection' vulnerability in Ultimate Member Ultimate Member ultimate-member allows Code Injection.This issue affects Ultimate Member: from n/a through = 2.10.3...

CVE-2025-47493

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ultimate Blocks Ultimate Blocks ultimate-blocks allows DOM-Based XSS.This issue affects Ultimate Blocks: from n/a through = 3.2.9...

CVE-2025-47466

Cross-Site Request Forgery CSRF vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows Cross Site Request Forgery.This issue affects Ultimate WP Mail: from n/a through = 1.3.4...

CVE-2025-47490

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows SQL Injection.This issue affects Ultimate WP Mail: from n/a through = 1.3.4...

CVE-2025-3844

The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to Authentication Bypass in versions 1.9.1 to 7.5.2. This is due to handelajaxreq function not having proper restrictions on the changeusermeta functionality that makes it possible to set a OTP code and subsequently log in...

PT-2025-20561

Name of the Vulnerable Software and Affected Versions Norton Utilities Ultimate version 24.2.16862.6344 Description The issue allows local attackers to escalate privileges and execute arbitrary code in the context of SYSTEM via the creation of a symbolic link and leveraging a time-of-check to...

Gen Digital Norton Utilities Ultimate 安全漏洞

Gen Digital Norton Utilities Ultimate is a suite of professional-grade PC optimization tools from Gen Digital USA. A security vulnerability exists in Gen Digital Norton Utilities Ultimate version 24.2.16862.6344, which stems from a mishandling of symbolic links in NortonUtilitiesSvc, which could...

CVE-2024-13944: Time-of-check Time-of-use (TOCTOU) Race Condition

Link Following Local Privilege Escalation Vulnerability in NortonUtilitiesSvc in Norton Utilities Ultimate Version 24.2.16862.6344 on Windows 10 Pro x64 allows local attackers to escalate privileges and execute arbitrary code in the context of SYSTEM via the creation of a symbolic link and...

CVE-2025-4208: Improper Control of Generation of Code

The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to Limited Code Execution in all versions up to, and including, 8.9.1 via the gettablerecords function. This is due to the unsanitized use of user-supplied input in calluserfunc. This makes it...

CVE-2025-3468: Improper Neutralization of Input During Web Page Generation

The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the cleanhtml and formfields parameters in all versions up to, and including, 8.9.1 due to insufficient input sanitization and output escaping. This makes it...

Exploit for Unrestricted Upload of File with Dangerous Type in Themefic Ultimate_Before_After_Image_Slider_\&_Gallery

Ultimate Before After Image Slider & Gallery – BEAF 1: lo: mt...

CVE-2025-47691

Improper Control of Generation of Code 'Code Injection' vulnerability in Ultimate Member Ultimate Member ultimate-member allows Code Injection.This issue affects Ultimate Member: from n/a through = 2.10.3...

CVE-2025-47490

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows SQL Injection.This issue affects Ultimate WP Mail: from n/a through = 1.3.4...

CVE-2025-47493

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ultimate Blocks Ultimate Blocks ultimate-blocks allows DOM-Based XSS.This issue affects Ultimate Blocks: from n/a through = 3.2.9...

CVE-2025-47466

Cross-Site Request Forgery CSRF vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows Cross Site Request Forgery.This issue affects Ultimate WP Mail: from n/a through = 1.3.4...

CVE-2025-47691 WordPress Ultimate Member plugin <= 2.10.3 - Arbitrary Function Call vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in Ultimate Member Ultimate Member ultimate-member allows Code Injection.This issue affects Ultimate Member: from n/a through = 2.10.3...

CVE-2025-47691 WordPress Ultimate Member plugin <= 2.10.3 - Arbitrary Function Call vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in Ultimate Member Ultimate Member allows Code Injection. This issue affects Ultimate Member: from n/a through 2.10.3...

CVE-2025-47691

CVE-2025-47691 corresponds to an authenticated Arbitrary Function Call/Code Injection vulnerability in the WordPress plugin Ultimate Member up to version 2.10.3. The issue is categorized as Improper Generation of Code and affects Ultimate Member until 2.10.3. The CVSSbase score is 5.5 (Medium); a...

CVE-2025-47493

CVE-2025-47493 : WordPress plugin Ultimate Blocks (Ultimate Blocks) contains a DOM-based XSS due to improper input neutralization during web page generation. Affected versions are n/a through 3.2.9. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) yields a base score of 6.5 (Medium). Exploit...

CVE-2025-47493 WordPress Ultimate Blocks plugin <= 3.2.9 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ultimate Blocks Ultimate Blocks ultimate-blocks allows DOM-Based XSS.This issue affects Ultimate Blocks: from n/a through = 3.2.9...