WordPress ListingPro Reviews theme <= 1.7 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin ListingPro Reviews versions 2.9.11...

CVE-2025-49342

Cross-Site Request Forgery CSRF vulnerability in merzedes Custom Style custom-style allows Stored XSS.This issue affects Custom Style: from n/a through = 1.0...

CVE-2025-68885 WordPress Custom Post Status plugin <= 1.1.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in page-carbajal Custom Post Status custom-post-status allows Stored XSS.This issue affects Custom Post Status: from n/a through = 1.1.0...

CVE-2025-68885

CVE-2025-68885: Cross-Site Request Forgery in the Page Carbajal Custom Post Status plugin enables Stored XSS, affecting Custom Post Status up to version 1.1.0. CVSS 3.1 base 7.1 (HIGH). No exploitation details or fixes are provided in the initial or connected documents; refer to Patchstack listin...

CVE-2025-49345 WordPress WP-EasyArchives plugin <= 3.1.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in mg12 WP-EasyArchives wp-easyarchives allows Stored XSS.This issue affects WP-EasyArchives: from n/a through = 3.1.2...

CVE-2025-49346

Cross-Site Request Forgery CSRF vulnerability in peterwsterling Simple Archive Generator simple-archive-generator allows Stored XSS.This issue affects Simple Archive Generator: from n/a through = 5.2...

CVE-2025-59137

No public technical details about CVE-2025-59137 are provided in the connected documents. The initial description mentions a CSRF leading to Stored XSS in Behance Portfolio Manager, but no product/version/root‑cause/exploit/fix details are present here. Monitor for updates.

WordPress Behance Portfolio Manager plugin <= 1.7.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Muhammad Nur Ibnu Hubab in WordPress Plugin Behance Portfolio Manager versions = 1.7.5...

SUSE CVE-2023-54166

In the Linux kernel, the following vulnerability has been resolved: igc: Fix Kernel Panic during ndotxtimeout callback The Xeon validation group has been carrying out some loaded tests with various HW configurations, and they have seen some transmit queue time out happening during the test. This...

WordPress Guten Free Options plugin <= 0.9.5 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Hassan Khan Yusufzai - Splint3r7 in WordPress Plugin Guten Free Options versions = 0.9.5...

WordPress Ketchup Shortcodes plugin <= 0.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zakaria in WordPress Plugin Ketchup Shortcodes versions = 0.1.2...

WordPress WP01 - Speed, Security, SEO consultant plugin <= 2.6.2 - Authenticated (Subscriber+) Arbitrary File Download vulnerability

WordPress WP01 - Speed, Security, SEO consultant plugin = 2.6.2 - Authenticated Subscriber+ Arbitrary File Download vulnerability discovered by theviper17y in WordPress Plugin WP01 versions = 2.6.2...

WordPress tagDiv Composer plugin <= 5.3 - Reflected Cross-Site Scripting via 'data' vulnerability

Reflected Cross-Site Scripting via 'data' vulnerability discovered by Truoc Phan - Techlab Corporation in WordPress Plugin tagDiv Composer versions = 5.3...

PT-2025-54372

Name of the Vulnerable Software and Affected Versions GS Portfolio for Envato versions 1.4.2 and earlier Description An unauthenticated broken access control issue exists in GS Portfolio for Envato. This allows unauthorized access to resources. Recommendations Update GS Portfolio for Envato to a...

PT-2025-54409

Missing Authorization vulnerability in merkulove Walker for Elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Walker for Elementor: from n/a through 1.1.6...

WordPress WordPress Auction plugin <= 3.7 - Editor+ SQL Injection vulnerability

Editor+ SQL Injection vulnerability discovered by Thanh Kieu in WordPress Plugin WordPress Auction Plugin versions = 3.7...

WordPress Age Restriction plugin <= 3.0.2 - Subscriber+ Privilege Escalation vulnerability

Subscriber+ Privilege Escalation vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin Premium Age Verification / Restriction for WordPress versions = 3.0.2...

PT-2025-54355

Name of the Vulnerable Software and Affected Versions MyD Delivery versions through 1.3.7 Description An authorization bypass exists in Eduardo Villão MyD Delivery due to incorrectly configured access control security levels. This allows exploitation through a user-controlled key. Recommendations...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-992883)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992883 advisory. In the Linux kernel, the following vulnerability has been resolved: Input: iforce - wake up after clearing IFORCEXMITRUNNING flag syzbot is reporting hung task at...

PT-2025-54444

Name of the Vulnerable Software and Affected Versions AA-Team Pro Bulk Watermark Plugin for WordPress versions through 2.0 Description The AA-Team Pro Bulk Watermark Plugin for WordPress contains a path traversal flaw. The issue is due to insufficient sanitization of user-supplied input,...