WordPress Quick Featured Images plugin <= 13.7.3 - Authenticated (Editor+) SQL Injection via delete_orphaned vulnerability

Authenticated Editor+ SQL Injection via deleteorphaned vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Quick Featured Images versions = 13.7.3...

CVE-2025-11980

The Quick Featured Images plugin for WordPress is vulnerable to SQL Injection via the 'deleteorphaned' function in all versions up to, and including, 13.7.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2025-11980 Quick Featured Images <= 13.7.3 - Authenticated (Editor+) SQL Injection via delete_orphaned

The Quick Featured Images plugin for WordPress is vulnerable to SQL Injection via the 'deleteorphaned' function in all versions up to, and including, 13.7.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2025-11980

CVE-2025-11980 affects the WordPress Quick Featured Images plugin prior to 13.7.4. The vulnerability is an SQL Injection in the delete_orphaned function due to insufficient escaping and unsafe SQL construction. Exploitation requires Editor+ privileges and user interaction (an author-level user mu...

PT-2025-5286 · Apple · Macos Sonoma +3

Name of the Vulnerable Software and Affected Versions: macOS Ventura versions prior to 13.7.3 macOS Sequoia versions prior to 15.3 macOS Sonoma versions prior to 14.7.3 Description: A downgrade issue was addressed with additional code-signing restrictions. This issue may allow an app to access...

macOS 13.x < 13.7.3 Multiple Vulnerabilities (122070)

The remote host is running a version of macOS / Mac OS X that is 13.x prior to 13.7.3. It is, therefore, affected by multiple vulnerabilities: - An out-of-bounds write was addressed with improved input validation. This issue is fixed in macOS Ventura 13.7.3, macOS Sonoma 14.7.3, visionOS 2.3, iOS...

Malicious code in by-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 020adf63230fbcb34dc4642692ba5c5a7b6df10d3210f7f53717db56ba4e98dd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...