PT-2025-49954

Missing Authorization vulnerability in Constant Contact Constant Contact + WooCommerce constant-contact-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Constant Contact + WooCommerce: from n/a through = 2.4.1...

PT-2025-50063

Missing Authorization vulnerability in Yandex Metrika Yandex.Metrica wp-yandex-metrika allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Yandex.Metrica: from n/a through = 1.2.2...

PT-2025-50013

Missing Authorization vulnerability in ergonet Ergonet Cache ergonet-varnish-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ergonet Cache: from n/a through = 1.0.11...

PT-2025-49982

Cross-Site Request Forgery CSRF vulnerability in Alex Furr PDF Creator Lite pdf-creator-lite allows Stored XSS.This issue affects PDF Creator Lite: from n/a through = 1.2...

PT-2025-49870

CVE-2025-64256 Cross-Site Request Forgery CSRF vulnerability in PressTigers Simple Folio simple-folio allows Cross Site Request Forgery.This issue affects Simple Folio: from n/a t… https://t.co/Cy0kFNJWOf...

PT-2025-49958

Name of the Vulnerable Software and Affected Versions rtCamp GoDAM versions through 1.4.6 Description An authorization issue exists in rtCamp GoDAM, allowing for an incorrect configuration of access control security levels and potential unauthorized access. Recommendations Update rtCamp GoDAM to ...

PT-2025-49924

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in rhewlif Donation Thermometer donation-thermometer allows Stored XSS.This issue affects Donation Thermometer: from n/a through = 2.2.6...

PT-2025-50070

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Shahjada Download Manager download-manager allows Retrieve Embedded Sensitive Data.This issue affects Download Manager: from n/a through = 3.3.32...

PT-2025-50060

Cross-Site Request Forgery CSRF vulnerability in hogash Kallyas kallyas.This issue affects Kallyas: from n/a through = 4.2...

PT-2025-49995

Missing Authorization vulnerability in themerain ThemeRain Core themerain-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ThemeRain Core: from n/a through = 1.1.9...

PT-2025-50003

Cross-Site Request Forgery CSRF vulnerability in Michael Revellin-Clerc Media Library Downloader media-library-downloader allows Cross Site Request Forgery.This issue affects Media Library Downloader: from n/a through = 1.4.0...

PT-2025-49972

Name of the Vulnerable Software and Affected Versions SupportCandy versions through 3.4.1 Description A Cross-Site Request Forgery CSRF issue exists in PSM Plugins SupportCandy. This allows attackers to potentially perform actions on behalf of authenticated users without their knowledge...

PT-2025-50005

Missing Authorization vulnerability in opicron Image Cleanup image-cleanup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Cleanup: from n/a through = 1.9.2...

PT-2025-49997

Cross-Site Request Forgery CSRF vulnerability in wpmediadownload Media Library File Download media-download allows Cross Site Request Forgery.This issue affects Media Library File Download: from n/a through = 1.4...

PT-2025-49994

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in LambertGroup Image&Video FullScreen Background lbg fullscreen fullwidth slider allows SQL Injection.This issue affects Image&Video FullScreen Background: from n/a through = 1.6.7...

PT-2025-49991

Missing Authorization vulnerability in berthaai BERTHA AI bertha-ai-free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BERTHA AI: from n/a through = 1.13...

CVE-2025-65882

An issue was discovered in openmptcprouter thru 0.64 in file common/package/utils/sys-upgrade-helper/src/tools/sysupgrade.c in function createxoripadopad allowing attackers to potentially write arbitrary files or execute arbitrary commands...

WordPress WP AI CoPilot plugin <= 1.2.7 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by benzdeus in WordPress Plugin WP AI CoPilot versions = 1.2.7...

WordPress Live Sales Notification for Woocommerce – Woomotiv plugin <= 3.6.3 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Muhammad Nur Ibnu Hubab Ibnu - Pondok Teknologi in WordPress Plugin Live Sales Notification for Woocommerce - Woomotiv versions = 3.6.3...

WordPress 10Web Booster plugin <= 2.32.7 - Authenticated (Subscriber+) Arbitrary Folder Deletion via two_clear_page_cache vulnerability

Authenticated Subscriber+ Arbitrary Folder Deletion via twoclearpagecache vulnerability discovered by shark3y in WordPress Plugin 10Web Booster – Website speed optimization, Cache & Page Speed optimizer versions = 2.32.7...