PT-2025-21340 · Wamr +1 · Wamr +1

Name of the Vulnerable Software and Affected Versions: WAMR versions up to and including 2.2.0 WAMR built with libc-uvwasi on Windows Description: The issue is related to a symlink following vulnerability in the WebAssembly Micro Runtime WAMR. On WAMR running in Windows, creating a symlink pointi...

PT-2025-21444 · WordPress · Ip Based Login

Name of the Vulnerable Software and Affected Versions: IP Based Login WordPress plugin versions prior to 2.4.1 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example in...

PT-2025-21534 · WordPress · Z-Downloads

Name of the Vulnerable Software and Affected Versions: Z-Downloads WordPress plugin versions prior to 1.11.6 Description: The issue arises from the plugin's failure to properly sanitise and escape certain parameters when they are displayed on the page. This oversight could allow unauthenticated...

PT-2025-21541 · WordPress · Team

Name of the Vulnerable Software and Affected Versions: Team WordPress plugin versions prior to 4.4.2 Description: The issue allows high privilege users, such as administrators, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed, f...

PT-2025-21395 · WordPress · Jetpack +1

Name of the Vulnerable Software and Affected Versions: Jetpack WordPress plugin versions prior to 13.8 Jetpack Boost WordPress plugin versions prior to 3.4.8 Description: The issue concerns the use of regexes in the Site Accelerator features of the Jetpack and Jetpack Boost WordPress plugins when...

PT-2025-21372

Name of the Vulnerable Software and Affected Versions: LogDash Activity Log WordPress plugin versions prior to 1.1.4 Description: The issue concerns a SQL injection vulnerability. It occurs because the plugin does not properly escape the username when performing SQL requests, specifically when...

PT-2025-21562 · WordPress · Plugin Oficial Wordpress

Name of the Vulnerable Software and Affected Versions: Plugin Oficial WordPress plugin through 1.7.3 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some settings are not properly sanitised and escaped, a...

PT-2025-21548 · WordPress · Ekc Tournament Manager

Name of the Vulnerable Software and Affected Versions: EKC Tournament Manager WordPress plugin versions prior to 2.2.2 Description: The issue is related to the lack of a CSRF check when updating settings in the EKC Tournament Manager WordPress plugin. This could allow attackers to make a logged-i...

PT-2025-21538 · WordPress · Maspik

Name of the Vulnerable Software and Affected Versions: Maspik WordPress plugin versions prior to 2.1.3 Description: The issue concerns the Maspik WordPress plugin, where certain settings are not properly sanitized and escaped. This could allow high-privilege users, such as administrators, to...

PT-2025-21440 · WordPress · Mailpoet

Name of the Vulnerable Software and Affected Versions: MailPoet WordPress plugin versions prior to 5.5.2 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed, for...

WordPress SureTriggers Plugin < 1.0.83 Privilege Escalation Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:suretriggers:suretriggers"; if description...

Mozilla Thunderbird ESR Security Update (mfsa_2025-34) - Windows

Mozilla Thunderbird ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2025-21442 · WordPress · Buddyboss Platform

Name of the Vulnerable Software and Affected Versions: buddyboss-platform versions prior to 2.7.60 Description: The issue is related to improper access controls in the buddyboss-platform WordPress plugin, allowing a logged-in user to view comments on private posts. Recommendations: For versions...

PT-2025-21452 · WordPress · Aweber Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: AWeber WordPress plugin versions 7.3.20 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed, for...

PT-2025-21393 · WordPress · Happyforms

Name of the Vulnerable Software and Affected Versions: Happyforms versions prior to 1.26.3 Description: The issue concerns the Happyforms plugin for WordPress, where certain settings are not properly sanitized and escaped. This could allow high-privilege users, such as administrators, to perform...

PT-2025-21352 · Automattic · Automattic Tours

Name of the Vulnerable Software and Affected Versions: Automattic Tours versions n/a through 1.0.0 Description: The issue is related to a Missing Authorization vulnerability. This means that there is a lack of proper authorization checks, potentially allowing unauthorized access to certain featur...

PT-2025-21462 · WordPress · Memberspace

Name of the Vulnerable Software and Affected Versions: MemberSpace WordPress plugin versions prior to 2.1.14 Description: The issue arises from the plugin's failure to sanitise and escape a parameter before outputting it back in the page. This leads to a Reflected Cross-Site Scripting issue that...

PT-2025-21523 · WordPress · Everest Forms

Name of the Vulnerable Software and Affected Versions: Everest Forms versions prior to 3.0.3.1 Description: The issue concerns the Everest Forms WordPress plugin, where it fails to properly sanitize and escape some of its settings. This could allow high-privilege users, such as administrators, to...

PT-2025-21348

Name of the Vulnerable Software and Affected Versions: Vyper versions up to and including 0.4.2rc1 Description: The issue concerns the slice builtin in Vyper, which can elide side effects when the output length is 0 and the source bytestring is a builtin, such as msg.data or .code. This occurs...

PT-2025-21439 · WordPress · Mobile Contact Bar

Name of the Vulnerable Software and Affected Versions: Mobile Contact Bar WordPress plugin versions prior to 3.0.5 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some settings are not properly sanitised...