EUVD-2025-19685

Malicious code in bioql PyPI...

EUVD-2024-50074

Malicious code in bioql PyPI...

EUVD-2024-17619

Malicious code in bioql PyPI...

EUVD-2025-4546

Malicious code in bioql PyPI...

EUVD-2024-27905

Malicious code in bioql PyPI...

EUVD-2025-19711

Malicious code in bioql PyPI...

EUVD-2025-15257

Malicious code in bioql PyPI...

EUVD-2024-26997

Malicious code in bioql PyPI...

EUVD-2024-51570

Malicious code in bioql PyPI...

CVE-2025-6831 User Registration <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via urcr_restrict Shortcode

The User Registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's urcrrestrict shortcode in all versions up to, and including, 4.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-6997 ThemeREX Addons <= 2.35.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via trx_addons_get_svg_from_file Function

The ThemeREX Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.35.1.1 due to insufficient input sanitization and output escaping. The plugin’s SVG rendering routine calls the trxaddonsgetsvgfromfile function on an...

CVE-2025-7340

The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the tempfileupload function in all versions up to, and including, 2.2.1. This makes it possible for...

CVE-2025-48345

CVE-2025-48345 : Reflected XSS in the WordPress plugin Contact Form 7 Editor Button (versions ≤ 1.0.0). Root cause is improper input neutralization during web page generation, enabling a reflected payload to run in a victim’s browser. Affected software is the Contact Form 7 Editor Button plugin f...

CVE-2025-28963 WordPress URL Shortener plugin <= 3.0.7 - Server Side Request Forgery (SSRF) Vulnerability

Server-Side Request Forgery SSRF vulnerability in Md Yeasin Ul Haider URL Shortener allows Server Side Request Forgery. This issue affects URL Shortener: from n/a through 3.0.7...

CVE-2025-27358 WordPress Frontend File Manager plugin <= 23.6 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in N-Media Frontend File Manager nmedia-user-file-uploader allows Code Injection.This issue affects Frontend File Manager: from n/a through = 23.6...

CVE-2025-24764 WordPress (Simply) Guest Author Name plugin <= 4.36 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in A. Jones Simply Guest Author Name allows DOM-Based XSS. This issue affects Simply Guest Author Name: from n/a through 4.36...

CVE-2025-6687 Magic Buttons for Elementor <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via magic-button Shortcode

The Magic Buttons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's magic-button shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on the 'icon' user supplied attributes. This makes it...

CVE-2025-53295

CVE-2025-53295 concerns iCount Payment Gateway &lt;= 2.0.6 with a Missing Authorization issue allowing access to constrained functionality. The provided data shows CVSS v3.1 base score 5.3 (Medium) and an unauthenticated/unauthorized access risk. Patch guidance appears in Patchstack: iCount Payme...

CVE-2025-53197 WordPress Cookiebot plugin <= 4.5.8 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in cookiebot Cookiebot allows Cross Site Request Forgery. This issue affects Cookiebot: from n/a through 4.5.8...

CVE-2025-49448

CVE-2025-49448 concerns FW Food Menu (WordPress plugin) versions up to 6.0.0 and describes an unauthenticated path traversal vulnerability. The issue is reported as an ability to traverse restricted directories, enabling potential arbitrary file deletion (as highlighted by Patchstack referencing ...