CVE-2025-64368

Summary: CVE-2025-64368 affects Mikado-Themes Bard Bardwp (WordPress Bard theme plugin). The vuln is a Cross-Site Request Forgery (CSRF) in Bardwp that allows an attacker to perform actions on behalf of authenticated users. Affected: Bard versions up to and including 1.6. Root cause: insufficient...

CVE-2025-64353 WordPress Polylang plugin <= 3.7.3 - Deserialization of untrusted data vulnerability

Deserialization of Untrusted Data vulnerability in Chouby Polylang polylang allows Object Injection.This issue affects Polylang: from n/a through = 3.7.3...

CVE-2025-64350 WordPress Rank Math SEO plugin <= 1.0.252.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Rank Math SEO Rank Math SEO seo-by-rank-math allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rank Math SEO: from n/a through = 1.0.252.1...

CVE-2025-8385

The Zombify plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.7.5. This is due to insufficient input validation in the zfgetfilebyurl function. This makes it possible for authenticated attackers, with subscriber-level access and above, to read arbitrary...

CVE-2025-8385

CVE-2025-8385 affects the WordPress Zombify plugin (versions

WordPress Jobmonster theme <= 4.8.1 - Authentication Bypass vulnerability

Authentication Bypass vulnerability discovered by Thái An in WordPress Theme Jobmonster versions = 4.8.1...

PT-2025-44640

Name of the Vulnerable Software and Affected Versions BLU-IC2 versions through 1.19.5 BLU-IC4 versions through 1.19.5 Description The software exhibits an insufficient password policy. This allows for the use of weak or easily guessable passwords, potentially compromising account security...

CVE-2021-4461

CVE-2021-4461 affects Seeyon Zhiyuan OA Web Application System

CVE-2025-12477

Server Version Disclosure.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5...

CVE-2025-12515

Systemic Internal Server Errors - HTTP 500 ResponseThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5...

CVE-2025-5342

Zohocorp ManageEngine Exchange Reporter Plus through 5721 are vulnerable to ReDOS vulnerability in the search module...

CVE-2025-64288

Cross-Site Request Forgery CSRF vulnerability in Premmerce Premmerce premmerce allows Cross Site Request Forgery.This issue affects Premmerce: from n/a through = 1.3.19...

CVE-2025-64216

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeSphere SmartMag smart-mag allows PHP Local File Inclusion.This issue affects SmartMag: from n/a through = 10.3.0...

WordPress NS Maintenance Mode for WP plugin <= 1.3.1 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin NS Maintenance Mode for WP versions = 1.3.1...

WordPress Site Checkup AI Troubleshooting with Wizard and Tips for Each Issue plugin <= 1.47 - Unauthenticated Log File Poisoning vulnerability

Unauthenticated Log File Poisoning vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Site Checkup versions = 1.47...

CVE-2025-12425

Local Privilege Escalation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5...

EUVD-2025-36680

Server Version Disclosure.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5...

CVE-2025-12478

Non-Compliant TLS Configuration.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5...

CVE-2025-12476

Resource Lacking AuthN.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5...

CVE-2025-11632 Call Now Button <= 1.5.4 - Authenticated (Subscriber+) Missing Authorization to Multiple Functions

The Call Now Button – The 1 Click to Call Button for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple functions in all versions up to, and including, 1.5.4. This makes it possible for authenticated attackers, with...