WordPress plugin GutenBee 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2025-60138 WordPress SKT Blocks plugin <= 2.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in sonalsinha21 SKT Blocks skt-blocks allows Stored XSS.This issue affects SKT Blocks: from n/a through = 2.6...

Portábilis i-Educar 授权问题漏洞

Portábilis i-Educar is an application from Portábilis. It can easily help you with basic and technical education. An authorization issue vulnerability exists in Portábilis i-Educar 2.10 and earlier versions, which stems from improper authorization of the parameter alunoid in the file...

PT-2025-39418

Name of the Vulnerable Software and Affected Versions Flag Forge versions 2.2.0 through 2.3.0 Description Flag Forge improperly manages session invalidation. After a user logs out, they can still access protected endpoints, such as /api/profile, and CSRF tokens remain valid. This allows continued...

CVE-2025-59833 FlagForgeCTF Hint Exposure via API

Flag Forge is a Capture The Flag CTF platform. In versions from 2.1.0 to before 2.3.0, the API endpoint GET /api/problems/:id returns challenge hints in plaintext within the question object, regardless of whether the user has unlocked them via point deduction. Users can view all hints for free,...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation via the process handling incoming requests. An attacker can cause the service to become unresponsive by sending specially crafted input. Remediation Upgrade org.apache.iotdb:iotdb-core to version 2.0.5 or highe...

CVE-2025-10844

A vulnerability has been found in Portabilis i-Educar up to 2.10. Affected by this issue is some unknown functionality of the file /module/Cadastro/aluno. The manipulation of the argument is leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to t...

CVE-2025-10846

A vulnerability was determined in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /module/ComponenteCurricular/edit. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly...

CVE-2025-10846 Portabilis i-Educar edit sql injection

A vulnerability was determined in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /module/ComponenteCurricular/edit. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly...

i-Educar SQL注入漏洞

i-Educar is a free educational software from Portábilis Open Source. A SQL injection vulnerability exists in i-Educar version 2.10 and earlier, which stems from incorrect manipulation of the parameter IDs in the file /module/ComponenteCurricular/view, which could lead to a SQL injection attack...

CVE-2025-58962

Server-Side Request Forgery SSRF vulnerability in publitio Publitio publitio allows Server Side Request Forgery.This issue affects Publitio: from n/a through = 2.2.1...

CVE-2025-53459

CVE-2025-53459 is rejected by the CVE Numbering Authority and does not represent an active vulnerability entry.

CVE-2025-57929 WordPress Double the Donation Plugin <= 2.0.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in kanweidoublethedonation Double the Donation double-the-donation allows Stored XSS.This issue affects Double the Donation: from n/a through = 2.0.0...

CVE-2025-57935 WordPress Bot Block – Stop Spam Referrals in Google Analytics Plugin <= 2.6 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ricky Dawn Bot Block Stop Spam Referrals in Google Analytics allows Stored XSS. This issue affects Bot Block Stop Spam Referrals in Google Analytics: from n/a through 2.6...

CVE-2025-57969

CVE-2025-57969 affects Hide WP Toolbar (WordPress plugin) up to version 2.7. Root cause: Missing Authorization / access control misconfiguration enabling unauthorized actions. Documented CVSS v3.1 metrics: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, with Impact: integrity low, confidentiality none, avai...

CVE-2025-57969 WordPress Hide WP Toolbar Plugin <= 2.7 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Jeremy Saxey Hide WP Toolbar allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Hide WP Toolbar: from n/a through 2.7...

CVE-2025-58232 WordPress Image Editor by Pixo Plugin <= 2.3.8 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ickata Image Editor by Pixo image-editor-by-pixo allows DOM-Based XSS.This issue affects Image Editor by Pixo: from n/a through = 2.3.8...

CVE-2025-58238

PilotPress (ONTRAPORT WordPress plugin) contains a Stored XSS in versions up to and including 2.0.36. The vulnerability is triggered when an authenticated attacker injects script via input that is not properly neutralized during web page generation. Effects are as described in Wordfence vulnerabi...

CVE-2025-58245

CVE-2025-58245 is a cross-site scripting vulnerability described as DOM-based XSS in the Portfolio plugin (BestWebSoft) for WordPress. The initial document states Portfolio versions up to and including 2.58 are affected (noted as from n/a through

WordPress plugin Smart Blocks 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...