CVE-2025-39600

CVE-2025-39600 is a CSRF vulnerability in the CRM Perks Integration for WooCommerce and QuickBooks. Affected: CRM Perks Integration plugin (WordPress) from versions up to and including 1.3.1. Root cause: Cross-Site Request Forgery without sufficient CSRF protection. Impact (per provided data): no...

CVE-2025-39600 WordPress Integration for WooCommerce and QuickBooks plugin <= 1.3.1 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in CRM Perks Integration for WooCommerce and QuickBooks wp-woocommerce-quickbooks allows Cross Site Request Forgery.This issue affects Integration for WooCommerce and QuickBooks: from n/a through = 1.3.1...

WordPress plugin WP Remote Thumbnail 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

PT-2025-15411 · WordPress · Advanced Advertising System

Name of the Vulnerable Software and Affected Versions: Advanced Advertising System plugin for WordPress versions up to and including 1.3.1 Description: The issue arises from insufficient validation of the redirect URL provided through the redir parameter. This allows unauthenticated attackers to...

CVE-2025-32196

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in blazethemes News Kit Elementor Addons news-kit-elementor-addons allows Stored XSS.This issue affects News Kit Elementor Addons: from n/a through = 1.4.2...

Exploit for Cross-site Scripting in Flatpress

CVE-2025-29602 - Stored cross site scriptingXSS vulnerabilit...

WordPress Twice Commerce plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Twice Commerce versions = 1.3.1...

CVE-2024-13060

A vulnerability in AnythingLLM Docker version 1.3.1 allows users with 'Default' permission to access other users' profile pictures by changing the 'id' parameter in the user cookie. This issue is present in versions prior to 1.3.1...

kubeslice 安全漏洞

kubeslice is a kubeslice open source application that enables multi-cloud, multi-cluster service connectivity. A security vulnerability exists in kubeslice version 1.3.1, which stems from improper privileges and could allow an attacker to obtain a token for a service account and elevate privilege...

CVE-2024-53350

Insecure permissions in kubeslice v1.3.1 allow attackers to gain access to the service account's token, leading to escalation of privileges...

CVE-2024-13060

A vulnerability in AnythingLLM Docker version 1.3.1 allows users with 'Default' permission to access other users' profile pictures by changing the 'id' parameter in the user cookie. This issue is present in versions prior to 1.3.1...

AnythingLLM 安全漏洞

AnythingLLM is an all-in-one AI application from Mintplex Open Source. A security vulnerability exists in AnythingLLM version 1.3.1, which originates from a user with Default privileges can access another user's profile picture by changing the id parameter in the user's cookie...

Envoy Gateway 安全漏洞

Envoy Gateway is an Envoy Proxy open source that uses the Envoy proxy as a gateway for standalone or Kubernetes-based applications. A security vulnerability exists in Envoy Gateway versions prior to 1.2.7 and 1.3.1 that stems from the default Envoy Proxy access logging configuration being...

WordPress plugin Simple Certain Time to Show Content 安全漏洞

WordPress and the WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

CVE-2025-1068

There is an untrusted search path vulnerability in Esri ArcGIS AllSource 1.2 and 1.3 that may allow a low privileged attacker with write privileges to the local file system to introduce a malicious executable to the filesystem. When the victim performs a specific action using ArcGIS AllSource, th...

CVE-2025-27317 WordPress RAYS Grid Plugin <= 1.3.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in IT-RAYS RAYS Grid rays-grid allows Cross Site Request Forgery.This issue affects RAYS Grid: from n/a through = 1.3.1...

FlatPress 安全漏洞

FlatPress is a Php-based blog builder without database support from the FlatPress community. A security vulnerability exists in FlatPress version 1.3.1, which stems from an improperly cleaned and escaped TextArea field input in the Add Entry feature. An authenticated attacker can inject malicious...

WordPress YaySMTP plugin <= 1.3.1 - Unauthenticated Stored Cross-Site Scripting via Email Logs vulnerability

Unauthenticated Stored Cross-Site Scripting via Email Logs vulnerability discovered by Cristian Bejan cbejan in WordPress Plugin SMTP for SendGrid – YaySMTP versions = 1.3.1...

CVE-2025-0918

The SMTP for SendGrid – YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...

PT-2025-7477

Name of the Vulnerable Software and Affected Versions The SMTP for SendGrid – YaySMTP plugin for WordPress versions up to, and including, 1.3.1 Description The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows unauthenticated...