PT-2025-21525 · WordPress · Pagelayer

Name of the Vulnerable Software and Affected Versions: Page Builder: Pagelayer versions prior to 1.9.0 Description: The issue concerns the Page Builder: Pagelayer WordPress plugin, where versions prior to 1.9.0 do not properly sanitise and escape some of its settings. This could allow...

PT-2025-21482 · WordPress · Ctt Expresso Para Woocommerce

Name of the Vulnerable Software and Affected Versions: CTT Expresso para WooCommerce WordPress plugin versions prior to 3.2.13 Description: The issue concerns the CTT Expresso para WooCommerce WordPress plugin, where certain settings are not properly sanitised and escaped. This could allow...

PT-2025-21426 · Unknown · Wordpress连接微博

Name of the Vulnerable Software and Affected Versions: WordPress连接微博 WordPress plugin versions 2.5.6 and earlier Description: The issue concerns a lack of CSRF check in some areas of the plugin, as well as missing sanitization and escaping. This could allow attackers to make logged-in admins add...

PT-2025-21503 · WordPress · Simple Job Board

Name of the Vulnerable Software and Affected Versions: The Simple Job Board WordPress plugin versions prior to 2.12.6 Description: The issue allows unauthenticated users to access and download uploaded resumes because the plugin does not prevent uploaded files from being listed. Recommendations:...

PT-2025-21428 · WordPress · Prisna Gwt Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Prisna GWT WordPress plugin versions prior to 1.4.14 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible even when the unfiltered html capability is disallowed,...

PT-2025-21519 · Unknown · Webtoffee-Gdpr-Cookie-Consent

Name of the Vulnerable Software and Affected Versions: webtoffee-gdpr-cookie-consent versions prior to 2.6.1 Description: The issue allows visitors to conduct Stored Cross-Site Scripting attacks due to improper sanitization and escaping of IP headers when logging them. The payload is triggered wh...

PT-2025-21485 · WordPress · The Kbucket: Your Curated Content

Name of the Vulnerable Software and Affected Versions: The KBucket: Your Curated Content in WordPress plugin versions prior to 4.1.6 Description: The issue concerns the lack of sanitization and escaping of certain settings in the plugin, which could allow high-privilege users, such as admins, to...

PT-2025-21262 · Unknown · Bluewave Checkmate

Name of the Vulnerable Software and Affected Versions: BlueWave Checkmate versions prior to 2.1 Description: The issue allows an authenticated regular user to access sensitive application secrets. This is achieved via the "/api/v1/settings" endpoint. Recommendations: For versions prior to 2.1,...

PT-2025-21489 · WordPress · Wccp-Pro

Name of the Vulnerable Software and Affected Versions: wccp-pro WordPress plugin versions prior to 15.3 Description: The issue concerns the wccp-pro WordPress plugin, which does not properly sanitise and escape some of its settings. This could allow high-privilege users, such as administrators, t...

PT-2025-21488

Name of the Vulnerable Software and Affected Versions: wccp-pro WordPress plugin versions prior to 15.3 Description: The issue concerns an open-redirect flaw via the referrer parameter, allowing the redirection of users to external sites. Recommendations: For versions prior to 15.3, update to...

Eclipse Jetty DoS Vulnerability (GHSA-889j-63jv-qhr8) - Linux

Eclipse Jetty is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:eclipse:jetty";...

PT-2025-21460

Name of the Vulnerable Software and Affected Versions: LifterLMS WordPress plugin versions prior to 8.0.1 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page. Thi...

PT-2025-21474 · WordPress · Advanced Cron Manager

Name of the Vulnerable Software and Affected Versions: The Advanced Cron Manager WordPress plugin versions prior to 2.5.7 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for...

PT-2025-21398 · Unknown · Mb Custom Post Types & Custom Taxonomies

Name of the Vulnerable Software and Affected Versions: MB Custom Post Types & Custom Taxonomies versions prior to 2.7.7 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is...

PT-2025-21265 · WordPress · Responsive Lightbox & Gallery

Name of the Vulnerable Software and Affected Versions: Responsive Lightbox & Gallery WordPress plugin versions prior to 2.5.1 Description: The issue concerns a Stored Cross-Site Scripting attack. Users with the contributor role and above can exploit this due to the plugin's failure to validate an...

PT-2025-21547 · WordPress · Cyan Backup

Name of the Vulnerable Software and Affected Versions: CYAN Backup WordPress plugin versions prior to 2.5.3 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed, fo...

PT-2025-21373 · WordPress · Allow Svg

Name of the Vulnerable Software and Affected Versions: Allow SVG WordPress plugin versions prior to 1.2.0 Description: The issue concerns the failure to sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...

PT-2025-21543 · Unknown · Free Booking Plugin

Name of the Vulnerable Software and Affected Versions: Free Booking Plugin for Hotels, Restaurants and Car Rentals versions prior to 1.3.15 Description: The issue concerns the lack of CSRF check when updating settings, which could allow attackers to make a logged-in subscriber change them via a...

PT-2025-21461 · WordPress · The Gdpr Framework By Data443

Name of the Vulnerable Software and Affected Versions: The GDPR Framework By Data443 WordPress plugin versions prior to 2.2.0 Description: The issue concerns the lack of sanitization and escaping of certain settings in the plugin, which could allow high-privilege users, such as admins, to perform...

PT-2025-21453 · WordPress · Ditty

Name of the Vulnerable Software and Affected Versions: Ditty WordPress plugin versions prior to 3.1.52 Description: The issue concerns the Ditty WordPress plugin, which does not properly sanitize and escape some of its settings. This could allow high-privilege users, such as authors, to perform...