CVE-2025-58210

Missing Authorization vulnerability in ThemeMove Makeaholic makeaholic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Makeaholic: from n/a through = 1.8.5...

CVE-2025-8684 Flatsome <= 3.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Flatsome Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's shortcodes in all versions up to, and including, 3.20.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...

CVE-2025-9990 WordPress Helpdesk Integration <= 5.8.10 - Unauthenticated Local File Inclusion

The WordPress Helpdesk Integration plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.8.10 via the portaltype parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the...

PT-2025-36140

Name of the Vulnerable Software and Affected Versions: WP Email Template versions n/a through 2.8.3 Description: The software contains a Cross-Site Request Forgery CSRF flaw. This issue allows attackers to perform actions on behalf of authenticated users without their knowledge. Recommendations:...

PT-2025-36172

Name of the Vulnerable Software and Affected Versions: INVELITY Invelity MyGLS connect versions through 1.1.1 Description: This issue is a Cross-Site Request Forgery CSRF vulnerability that allows Object Injection. Recommendations: At the moment, there is no information about a newer version that...

PT-2025-36204

Name of the Vulnerable Software and Affected Versions: reimund Compact Admin versions n/a through 1.3.0 Description: A Cross-Site Request Forgery CSRF vulnerability exists in reimund Compact Admin, allowing attackers to perform actions on behalf of an unsuspecting user. This issue allows Cross Si...

PT-2025-36182

Name of the Vulnerable Software and Affected Versions: David Merinas Auto Last Youtube Video versions n/a through 1.0.7 Description: A Cross-Site Request Forgery CSRF vulnerability exists in David Merinas Auto Last Youtube Video, which also allows Stored Cross-Site Scripting XSS. Recommendations:...

PT-2025-36170

Name of the Vulnerable Software and Affected Versions: Parallax Scrolling Enllax.js versions through 0.0.6 Description: A Cross-Site Request Forgery CSRF issue exists in Parallax Scrolling Enllax.js, potentially allowing attackers to perform actions on behalf of authenticated users...

WordPress GlamChic theme <= 1.0.11 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme GlamChic versions = 1.0.11...

WordPress Zuut theme <= 1.4.2 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Zuut versions = 1.4.2...

WordPress The Hospital theme <= 1.8.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme The Hospital versions = 1.8.1...

CVE-2025-6085

CVE-2025-6085 affects the WordPress Make Connector plugin (versions

CVE-2025-6085 Make Connector <= 1.5.10 - Authenticated (Administrator+) Arbitrary File Upload

The Make Connector plugin for WordPress is vulnerable to arbitrary file uploads due to misconfigured file type validation in the 'uploadmedia' function in all versions up to, and including, 1.5.10. This makes it possible for authenticated attackers, with Administrator-level access and above, to...

crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP()

...

PT-2025-35867

Name of the Vulnerable Software and Affected Versions: atec Debug plugin for WordPress versions prior to 1.2.23 Description: The atec Debug plugin for WordPress is susceptible to remote code execution through the custom log parameter due to insufficient sanitization when saving the custom log pat...

scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()

...

WordPress atec Debug plugin <= 1.2.22 - Authenticated (Administrator+) Arbitrary File Deletion vulnerability

Authenticated Administrator+ Arbitrary File Deletion vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin atec Debug versions = 1.2.22...

WordPress Contact Form By Mega Forms Plugin <= 1.6.1 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Le Cong Danh vodanh in WordPress Plugin Contact Form By Mega Forms versions = 1.6.1...

WordPress immonex Kickstart Plugin <= 1.11.6 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by Peter Thaleikis in WordPress Plugin immonex Kickstart versions = 1.11.6...

WordPress Support Genix Plugin <= 1.4.23 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Bao BlueRock in WordPress Plugin Support Genix versions = 1.4.23...