CVE-2025-27318 WordPress Simple Google Sitemap Plugin <= 1.6 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in ixiter Simple Google Sitemap simple-google-sitemap allows Cross Site Request Forgery.This issue affects Simple Google Sitemap: from n/a through = 1.6...

CVE-2025-27306 WordPress Pathomation plugin <= 2.5.1 - Stored Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in pathomation Pathomation pathomation allows Stored XSS.This issue affects Pathomation: from n/a through = 2.5.1...

CVE-2025-27277

CVE-2025-27277 is a CSRF-to-stored-XSS vulnerability in the WordPress plugin “Add Linked Images To Gallery” affecting version up to 1.4. The CVE details from NVD/Wordfence indicate: vulnerable component/file: the Add Linked Images To Gallery plugin; root cause: Cross-Site Request Forgery enabling...

WordPress Ibtana plugin <= 1.2.5.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Peter Thaleikis in WordPress Plugin Ibtana versions = 1.2.5.6...

WordPress Pie Register Premium plugin <= 3.8.3.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Pie Register Premium versions = 3.8.3.2...

WordPress Fresh Framework plugin <= 1.70.0 - Unauthenticated Broken Access Control vulnerability

Unauthenticated Broken Access Control vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin Fresh Framework versions = 1.70.0...

WordPress FS Poster plugin <= 6.5.8 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin FS Poster versions = 6.5.8...

Xingyuantu SparkShop 安全漏洞

Xingyuantu SparkShop is an open source shopping center from Xingyuantu, a Chinese company. A security vulnerability exists in Xingyuantu SparkShop v1.1.7 and earlier versions, which can be exploited for remote code execution via a specially crafted phar file...

PT-2025-7736 · Unknown · Pathomation

Name of the Vulnerable Software and Affected Versions: Pathomation versions n/a through 2.5.1 Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that an attacker can inject malicious script...

WordPress Strong Testimonials plugin <= 3.2.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Revan Arifio Patchstack Alliance in WordPress Plugin Strong Testimonials versions = 3.2.3...

WordPress Recipe Card Blocks for Gutenberg & Elementor plugin <= 3.4.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Prissy in WordPress Plugin Recipe Card Blocks for Gutenberg & Elementor versions = 3.4.3...

WordPress Services Section block plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Logan Cote Patchstack Alliance in WordPress Plugin Services Section block versions = 1.3.4...

WordPress Counters Block plugin <= 1.1.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Logan Cote Patchstack Alliance in WordPress Plugin Counters Block versions = 1.1.2...

WordPress Greenshift plugin <= 10.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Peter Thaleikis Patchstack Alliance in WordPress Plugin Greenshift versions = 10.8...

WordPress Front End Users Plugin <= 3.2.30 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by zaim Patchstack Alliance in WordPress Plugin Front End Users versions = 3.2.30...

PT-2025-7611 · Unknown · Metaslider Responsive Slider

Name of the Vulnerable Software and Affected Versions: MetaSlider Responsive Slider versions up to 3.94.0 Description: The issue is related to the deserialization of untrusted data, which allows Object Injection. This poses a significant cyber threat. Recommendations: For versions up to 3.94.0,...

GHSA-2P94-8669-XG86 Vyper's sqrt doesn't define rounding behavior

Vyper's sqrt builtin uses the babylonian method to calculate square roots of decimals. Unfortunately, improper handling of the oscillating final states may lead to sqrt incorrectly returning rounded up results. the fix is tracked in https://github.com/vyperlang/vyper/pull/4486 Vulnerability Detai...

CVE-2024-13751

The 3D Photo Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'des' parameter in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and...

WordPress MyTicket Events plugin <= 1.2.4 - Non-Arbitrary File Read vulnerability

Non-Arbitrary File Read vulnerability discovered by Anhchangmutrang in WordPress Plugin MyTicket Events versions = 1.2.4...

WordPress User List plugin <= 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by johska in WordPress Plugin User List versions = 1.5.1...