11816 matches found
PT-2025-4025 · Postman · Postman
Name of the Vulnerable Software and Affected Versions: Postman versions up to 11.20 Description: A problematic issue has been found in Postman on Windows, affecting an unknown part of the library file profapi.dll. The manipulation leads to an untrusted search path. The attack must be approached...
PT-2025-5001 · Unknown · Donate Visa
Name of the Vulnerable Software and Affected Versions: Saul Morales Pacheco Donate visa versions n/a through 1.0.0 Description: The issue is related to a Missing Authorization vulnerability in the Donate visa, which allows Stored XSS. Recommendations: For versions n/a through 1.0.0, update to a...
CVE-2024-12076
The Target Video Easy Publish plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.3. This is due to missing or incorrect nonce validation on the resynccarousel, seeksnapshot, uploadedcc, and removecc functions. This makes it possible for...
PT-2025-3845 · WordPress · Divi Carousel Maker
Name of the Vulnerable Software and Affected Versions: Divi Carousel Maker plugin for WordPress versions up to, and including, 2.0.4 Description: The Divi Carousel Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Carousel and Logo Carousel in all...
PT-2025-1695 · WordPress · Broadstreet
Name of the Vulnerable Software and Affected Versions: Broadstreet plugin for WordPress versions up to, and including, 1.50.3 Description: The issue is related to Stored Cross-Site Scripting via the zone parameter due to insufficient input sanitization and output escaping. This allows authenticat...
CVE-2025-24726 WordPress Contact Form 7 Widget plugin <= 1.2.1 - Stored Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in HT Plugins HT Contact Form 7 ht-contactform allows Stored XSS.This issue affects HT Contact Form 7: from n/a through = 1.2.1...
CVE-2025-24675
CVE-2025-24675 affects the WordPress plugin WP Visitor Statistics (Real Time Traffic) , with the vulnerability described as Stored Cross-Site Scripting (XSS) due to improper input neutralization during web page generation. The issue targets versions n/a through 7.2 (i.e.,
CVE-2025-24669 WordPress SERPed.net Plugin <= 4.4 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in serpednet SERPed.net serped-net allows SQL Injection.This issue affects SERPed.net: from n/a through = 4.4...
CVE-2025-24663 WordPress Simple Download Monitor plugin <= 3.9.25 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in mra13 Simple Download Monitor simple-download-monitor allows Blind SQL Injection.This issue affects Simple Download Monitor: from n/a through = 3.9.25...
CVE-2025-24623
CVE-2025-24623 is a CSRF vulnerability in the WordPress plugin Really Simple Security (formerly Really Simple SSL) affecting versions n/a through 9.1.4. The CVSSv3.1 base score is 4.3 (Medium) with network attack vector, required user interaction, and no confidentiality/availability impact, and p...
WordPress Simple Download Monitor plugin <= 3.9.25 - SQL Injection vulnerability
SQL Injection vulnerability discovered by shinobu in WordPress Plugin Simple Download Monitor versions = 3.9.25...
WordPress Comment Edit Core – Simple Comment Editing Plugin <= 3.0.33 - Server Side Request Forgery (SSRF) vulnerability
Server Side Request Forgery SSRF vulnerability discovered by Marek Mikita in WordPress Plugin Comment Edit Core – Simple Comment Editing versions = 3.0.33...
WordPress WooCommerce Product Table Lite plugin <= 3.8.7 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Mika in WordPress Plugin WooCommerce Product Table Lite versions = 3.8.7...
WordPress Patreon WordPress plugin <= 1.9.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Mika in WordPress Plugin Patreon WordPress versions = 1.9.1...
WordPress People Lists plugin <= 1.3.10 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Mika in WordPress Plugin People Lists versions = 1.3.10...
WordPress LearnDash LMS Plugin <= 4.20.0.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by David Ojeda Guijarro in WordPress Plugin LearnDash LMS versions = 4.20.0.1...
WordPress Atarim plugin <= 4.0.8 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Mika in WordPress Plugin Atarim versions = 4.0.8...
WordPress Radius Blocks – WordPress Gutenberg Blocks Plugin <= 2.1.2 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Tran Nguyen Bao Khanh in WordPress Plugin Radius Blocks versions = 2.1.2...
WordPress Chained Quiz Plugin <= 1.3.2.9 - Server Side Request Forgery (SSRF) vulnerability
Server Side Request Forgery SSRF vulnerability discovered by Marek Mikita in WordPress Plugin Chained Quiz versions = 1.3.2.9...
WordPress Ultimate Coming Soon & Maintenance plugin <= 1.0.9 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Marek Mikita in WordPress Plugin Ultimate Coming Soon & Maintenance versions = 1.0.9...