WordPress onepay Payment Gateway For WooCommerce plugin <= 1.1.2 - Other Vulnerability Type vulnerability

Other Vulnerability Type vulnerability discovered by NumeX in WordPress Plugin onepay Payment Gateway For WooCommerce versions = 1.1.2...

CVE-2025-14853 LEAV Last Email Address Validator <= 1.7.1 - Cross-Site Request Forgery to Plugin Settings Update

The LEAV Last Email Address Validator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions = 1.7.1. This is due to missing or incorrect nonce validation on the displaysettingspage function. This makes it possible for unauthenticated attackers to modify plugin settings via ...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-004346)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004346 advisory. An infinite loop issue was found in the vhostnet kernel module in Linux Kernel up to and including v5.1-rc6, while handling incoming packets in handlerx. It could...

WordPress Rede Itaú for WooCommerce - Payment PIX, Credit Card and Debit plugin <= 5.1.2 - Unauthenticated Order Status Manipulation vulnerability

WordPress Rede Itaú for WooCommerce - Payment PIX, Credit Card and Debit plugin = 5.1.2 - Unauthenticated Order Status Manipulation vulnerability discovered by Os in WordPress Plugin Rede Itaú for WooCommerce versions = 5.1.2...

WordPress Livemesh Addons for WPBakery Page Builder plugin <= 3.9.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by ZadWon in WordPress Plugin Livemesh Addons for WPBakery Page Builder versions = 3.9.4...

CVE-2023-7334 Changjetong T+ <= 16.x GetStoreWarehouseByStore Deserialization RCE

Changjetong T+ versions up to and including 16.x contain a .NET deserialization vulnerability in an AjaxPro endpoint that can lead to remote code execution. A remote attacker can send a crafted request to /tplus/ajaxpro/Ufida.T.CodeBehind.PriorityLevel,AppCode.ashx?method=GetStoreWarehouseByStore...

CVE-2011-10041

CVE-2011-10041 affects the WordPress Uploadify plugin (versions up to 1.0). The vulnerability is an arbitrary file upload in process_upload.php caused by missing file type validation. An unauthenticated remote attacker can upload arbitrary files to the web site, which may enable remote code execu...

WordPress Fusion Builder plugin <= 3.14.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Fusion Builder versions = 3.14.1...

WordPress Related Posts Thumbnails Plugin for WordPress plugin <= 4.3.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Carlos Ferreira in WordPress Plugin Related Posts Thumbnails Plugin for WordPress versions = 4.3.2...

CVE-2021-47764

AbsoluteTelnet 11.24 contains a denial of service vulnerability that allows local attackers to crash the application by manipulating DialUp connection and license name fields. Attackers can generate a 1000-character payload and paste it into specific input fields to trigger application crashes an...

WordPress WZone plugin <= 14.0.31 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin WZone versions = 14.0.31...

CVE-2021-47764

AbsoluteTelnet 11.24 contains a denial of service vulnerability that allows local attackers to crash the application by manipulating DialUp connection and license name fields. Attackers can generate a 1000-character payload and paste it into specific input fields to trigger application crashes an...

EUVD-2026-2771

AbsoluteTelnet 11.24 contains a denial of service vulnerability that allows local attackers to crash the application by manipulating DialUp connection and license name fields. Attackers can generate a 1000-character payload and paste it into specific input fields to trigger application crashes an...

CVE-2025-14448 WP-Members Membership Plugin <= 3.5.4.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Checkbox and Multiple Select User Profile Fields

The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Multiple Checkbox and Multiple Select user profile fields in all versions up to, and including, 3.5.4.3 due to insufficient input sanitization and output escaping. This makes it possible for...

WordPress Drag and Drop Multiple File Upload for Contact Form 7 plugin <= 1.3.9.2 - Missing Authorization to Unauthenticated File Deletion vulnerability

Missing Authorization to Unauthenticated File Deletion vulnerability discovered by shark3y in WordPress Plugin Drag and Drop Multiple File Upload – Contact Form 7 versions = 1.3.9.2...

Gogs <= 0.13.3 Multiple Vulnerabilities

According to its self-reported version, the instance of Gogs running on the remote host is prior or equal to 0.13.3. It is, therefore, affected by multiple vulnerabilities, including: - Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code. CVE-2025-8110 -...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001828)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001828 advisory. fs/overlayfs/copyup.c in the Linux kernel before 4.2.6 uses an incorrect cleanup code path, which allows local users to cause a denial of service dentry reference le...

CVE-2026-23550

Incorrect Privilege Assignment vulnerability in Modular DS Modular DS modular-connector allows Privilege Escalation.This issue affects Modular DS: from n/a through = 2.5.1...

CVE-2026-0813

The CVE-2026-0813 entry concerns the WordPress Short Link plugin. A Stored Cross-Site Scripting (XSS) vulnerability exists in all versions up to and including 1.0 due to insufficient input sanitization and output escaping of the short_link_post_title and short_link_page_title parameters. This all...

CVE-2025-14502 News and Blog Designer Bundle <= 1.1 - Unauthenticated Local File Inclusion

The News and Blog Designer Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1 via the template parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution...