PT-2025-44284

Name of the Vulnerable Software and Affected Versions Jenkins Eggplant Runner Plugin versions 0.0.1.301.v963cffe8ddb 8 and earlier Description The Jenkins Eggplant Runner Plugin versions 0.0.1.301.v963cffe8ddb 8 and earlier configures the Java system property jdk.http.auth.tunneling.disabledSchem...

PT-2025-44286

Name of the Vulnerable Software and Affected Versions Jenkins Themis Plugin versions 1.4.1 and earlier Description A flaw exists in the Jenkins Themis Plugin where a missing permission check allows attackers possessing Overall/Read permission to establish a connection to a HTTP server specified b...

PT-2025-44298

Name of the Vulnerable Software and Affected Versions Jenkins Publish to Bitbucket Plugin versions 0.4 and earlier Description A cross-site request forgery CSRF flaw exists in the Jenkins Publish to Bitbucket Plugin. This issue allows attackers to connect to a URL specified by the attacker,...

PT-2025-43599

Name of the Vulnerable Software and Affected Versions VNPAY Payment gateway plugin for WordPress versions up to and including 1.0.0 Description The VNPAY Payment gateway plugin for WordPress is susceptible to Reflected Cross-Site Scripting due to inadequate input sanitization and output escaping...

PT-2025-43587

Name of the Vulnerable Software and Affected Versions RapidResult plugin for WordPress versions up to and including 1.2 Description The RapidResult plugin for WordPress is susceptible to SQL Injection due to insufficient escaping of user-supplied input and inadequate preparation of existing SQL...

WordPress Classified Pro plugin Unauthorized Plugin Installation Vulnerability

WordPress Classified Pro plugin is a plugin for quickly creating a classified ad section on a WordPress website, supporting different scenarios of listings management such as automotive, second-hand trading, etc., and providing features such as searching, ad space configuration, and text...

EUVD-2013-2077

Malware in sbrugna...

EUVD-2022-52747

Malicious code in bioql PyPI...

EUVD-2022-31932

Malicious code in bioql PyPI...

CVE-2025-10173: Missing Authorization

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to unauthorized access due to an incorrect capability check on the postsave function in all versions up to, and including, 4.8.3. This makes it possible for authenticated...

CVE-2025-7827

The Ni WooCommerce Customer Product Report plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the niwoocpraction function in all versions up to, and including, 1.2.4. This makes it possible for authenticated attackers, with Subscriber-leve...

CVE-2024-12605: Cross-Site Request Forgery (CSRF)

The AI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT GPT-4o 128K plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5. This is due to missing or incorrect nonce validatio...

PT-2024-39714 · WordPress · Myparcel

Name of the Vulnerable Software and Affected Versions: MyParcel plugin for WordPress versions up to, and including, 4.24.1 Description: The MyParcel plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add query arg without appropriate escaping on the URL. This...

PT-2024-17243 · WordPress · Newsmanapp

Name of the Vulnerable Software and Affected Versions: NewsmanApp plugin for WordPress versions up to, and including, 2.7.6 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'newsman subscribe widget' shortcode due to insufficient input sanitization and output...

PT-2024-34787 · WordPress · Amazon Associate Filter

Name of the Vulnerable Software and Affected Versions: Amazon Associate Filter versions 0.4 and earlier Description: A Cross-Site Request Forgery CSRF vulnerability allows Stored XSS attacks. This issue affects the Amazon Associate Filter plugin for WordPress. Remediation is crucial to safeguard...

PT-2024-16771 · WordPress · 404 Error Monitor

Name of the Vulnerable Software and Affected Versions: 404 Error Monitor plugin for WordPress versions up to, and including, 1.1 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the updatePluginSettings function. This allows...

CVE-2024-9434: Cross-Site Request Forgery (CSRF)

The WPGlobus Translate Options plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0. This is due to missing or incorrect nonce validation on the ontranslateoptionspage function. This makes it possible for unauthenticated attackers to inject...

CVE-2024-8434: Missing Authorization

The Easy Mega Menu Plugin for WordPress – ThemeHunk plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions hooked via AJAX in all versions up to, and including, 1.0.9. This makes it possible for authenticated attackers, with subscriber-lev...

PT-2024-39066 · WordPress · Prisna Gwt – Google Website Translator

Name of the Vulnerable Software and Affected Versions: Prisna GWT – Google Website Translator plugin for WordPress versions up to, and including, 1.4.11 Description: The Prisna GWT – Google Website Translator plugin for WordPress is vulnerable to PHP Object Injection via deserialization of...

WordPress Plugin "Forminator" vulnerable to cross-site scripting

Overview WordPress Plugin "Forminator" provided by WPMU DEV assists building web forms. When accessing the page including the web form created with Forminator, some information from the URL may be embedded to the web form. This feature processes the embedded information improperly, leading to...