CVE-2025-7369 Shortcodes Ultimate <= 7.4.2 - Cross-Site Request Forgery to Arbitrary Shortcode Execution

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.4.2. This is due to missing or incorrect nonce validation on the preview function. This makes it possible for unauthenticated attackers to execut...

WordPress Shortcodes Ultimate plugin <= 7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Plugin Shortcodes vulnerability discovered by stealthcopter in WordPress Plugin Shortcodes Ultimate versions = 7.4.2...

WordPress plugin Shortcodes Ultimate 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-30244 · WordPress · Shortcodes Ultimate

Name of the Vulnerable Software and Affected Versions: WP Shortcodes Plugin — Shortcodes Ultimate versions prior to 7.4.2 Description: The WordPress Shortcodes Ultimate plugin is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation on the preview function. This...

WordPress plugin Shortcodes Ultimate 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin ... A cross-site request...

PT-2025-30243 · WordPress · Shortcodes Ultimate

Name of the Vulnerable Software and Affected Versions: WP Shortcodes Plugin — Shortcodes Ultimate versions prior to 7.4.3 Description: The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is susceptible to Stored Cross-Site Scripting through the plugin’s shortcodes. Insufficient...

CVE-2025-50028

Missing Authorization vulnerability in CodeSolz Ultimate Push Notifications ultimate-push-notifications allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Push Notifications: from n/a through = 1.2.0...

ESET多款产品 安全漏洞

ESET NOD32 Antivirus and others are products of ESET Corporation.ESET NOD32 Antivirus is an antivirus program.ESET Internet Security is an advanced antivirus with antivirus.ESET Smart Security Premium is an antivirus program that includes data encryption, ESET Smart Security Premium is a network...

CVE-2025-50028

Missing Authorization vulnerability in CodeSolz Ultimate Push Notifications ultimate-push-notifications allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Push Notifications: from n/a through = 1.2.0...

CVE-2025-6993 Ultimate WP Mail 1.0.17 - 1.3.6 - Missing Authorization to Authenticated (Contributor+) Privilege Escalation via get_email_log_details Function

The Ultimate WP Mail plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization within the getemaillogdetails AJAX handler in versions 1.0.17 to 1.3.6. The handler reads the client-supplied postid and retrieves the corresponding email log post content including the...

CVE-2025-6993 Ultimate WP Mail 1.0.17 - 1.3.6 - Missing Authorization to Authenticated (Contributor+) Privilege Escalation via get_email_log_details Function

The Ultimate WP Mail plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization within the getemaillogdetails AJAX handler in versions 1.0.17 to 1.3.6. The handler reads the client-supplied postid and retrieves the corresponding email log post content including the...

WordPress plugin Ultimate Push Notifications 安全漏洞

WordPress Ultimate Push Notifications is a plugin that is mainly used to implement real-time push functionality in WordPress websites, supporting sending desktop and mobile device notifications to users. WordPress Ultimate Push Notifications suffers from a lack of authorization vulnerability, no...

PT-2025-29810 · Unknown · Codesolz Ultimate Push Notifications

Name of the Vulnerable Software and Affected Versions: CodeSolz Ultimate Push Notifications versions through 1.1.9 Description: The software contains a missing authorization flaw due to incorrectly configured access control security levels. Recommendations: Update CodeSolz Ultimate Push...

WordPress plugin Ultimate WP Mail 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress KBx Pro Ultimate plugin <= 8.0.5 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin KBx Pro Ultimate versions = 8.0.5...

ESET多款产品 安全漏洞

ESET NOD32 Antivirus and others are products of ESET Corporation.ESET NOD32 Antivirus is an antivirus program.ESET Internet Security is an advanced antivirus with antivirus.ESET Smart Security Premium is an antivirus program that includes data encryption, ESET Smart Security Premium is a network...

WordPress Ultimate Video Player Plugin <= 10.1 - Server Side Request Forgery (SSRF) Vulnerability

Server Side Request Forgery SSRF Vulnerability discovered by Anhchangmutrang in WordPress Plugin Ultimate Video Player versions = 10.1...

CVE-2025-5567

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-url' DOM element attribute in all versions up to, and including, 7.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticate...

CVE-2025-5567

CVE-2025-5567 affects the WordPress plugin "WP Shortcodes Plugin — Shortcodes Ultimate" up to version 7.4.0. The root cause is insufficient input sanitization and output escaping for the DOM data-url attribute, enabling stored Cross-Site Scripting. An authenticated attacker with Contributor-level...

CVE-2025-5567 Shortcodes Ultimate <= 7.4.0 - Authenticted (Contributor+) Stored Cross-Site Scripting via 'data-url' Attribute

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-url' DOM element attribute in all versions up to, and including, 7.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticate...