PT-2025-14986 · WordPress · Tableon – Wordpress Posts Table Filterable

Name of the Vulnerable Software and Affected Versions: TableOn – WordPress Posts Table Filterable versions 1.0.4 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. This can lead to...

LB-LINK BL-AC2100 命令注入漏洞

LB-LINK BL-AC2100 is a wireless Wi-Fi 6 router from China Bilink LB-LINK. A security vulnerability exists in LB-LINK BL-AC2100 V1.0.4 and earlier versions, which stems from improper handling of the enable parameter and could lead to remote code execution...

WordPress plugin Smart Icons For WordPress 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

LB-LINK BL-AC2100 命令注入漏洞

LB-LINK BL-AC2100 is a wireless Wi-Fi 6 router from China Bilink LB-LINK. A command injection vulnerability exists in LB-LINK BL-AC2100 V1.0.4 and earlier versions, which stems from improper handling of the time1 and time2 parameters, and could lead to remote code execution...

CVE-2025-31771 WordPress Team Members for Elementor Page Builder plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Sultan Nasir Uddin Team Members for Elementor Page Builder allows Stored XSS. This issue affects Team Members for Elementor Page Builder: from n/a through 1.0.4...

CVE-2025-31748 WordPress Opal Portfolio Plugin <= 1.0.4 - Stored Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpopal Opal Portfolio opal-portfolios allows Stored XSS.This issue affects Opal Portfolio: from n/a through = 1.0.4...

Drupal Ignition Cross-Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Ignition Error Pages allows Cross-Site Scripting XSS. This issue affects Ignition Error Pages: from 0.0.0 before 1.0.4...

WordPress plugin Opal Portfolio 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...

WordPress plugin Team Members for Elementor Page Builder 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in...

CVE-2025-31679

CVE-2025-31679 refers to a Cross-Site Scripting (XSS) vulnerability in Drupal Ignition Error Pages. The issue arises from improper input neutralization in the Ignition Error Pages module, affecting versions 0.0.0 through 1.0.3. Affected software is Drupal Ignition Error Pages (module), with a fix...

CVE-2025-31614

CVE-2025-31614 is a stored XSS vulnerability in the Terms Before Download WordPress plugin. Affected is Terms Before Download versions from n/a up to 1.0.4, per the CVE entry. The issue arises from improper neutralization of input during web page generation. CVSS v3.1 base score is 6.5 (Medium) w...

CVE-2025-31614 WordPress Terms Before Download plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in hiroprot Terms Before Download terms-before-download allows Stored XSS.This issue affects Terms Before Download: from n/a through = 1.0.5...

Drupal Ignition Error Pages 跨站脚本漏洞

Drupal Ignition Error Pages is a module of the Drupal community that provides custom error pages e.g. 404, 500, etc. to improve the user experience. A cross-site scripting vulnerability exists in Drupal Ignition Error Pages versions prior to 1.0.4, which stems from improper input neutralization a...

CVE-2025-30524

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in origincode Product Catalog displayproduct allows SQL Injection.This issue affects Product Catalog: from n/a through = 1.0.4...

CVE-2025-31031 WordPress Job Colors for WP Job Manager plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Astoundify Job Colors for WP Job Manager wp-job-manager-colors allows Stored XSS.This issue affects Job Colors for WP Job Manager: from n/a through = 1.0.4...

WordPress Job Colors for WP Job Manager plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Psai in WordPress Plugin Job Colors for WP Job Manager versions = 1.0.4...

WordPress Christmas Panda plugin <= 1.0.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nabil Irawan in WordPress Plugin Christmas Panda versions = 1.0.4...

CVE-2025-30842 WordPress Christmas Panda plugin <= 1.0.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in pixolette Christmas Panda christmas-panda allows Cross Site Request Forgery.This issue affects Christmas Panda: from n/a through = 1.0.4...

CVE-2025-30842

CVE-2025-30842 is a CSRF vulnerability in the Christmas Panda WordPress plugin, affecting Christmas Panda versions up to 1.0.4. Connected docs indicate the issue has a patched status (retired/mitigated in later releases); details on exploit vectors or fixes beyond this patch status are not provid...

CVE-2025-30524

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in origincode Product Catalog displayproduct allows SQL Injection.This issue affects Product Catalog: from n/a through = 1.0.4...