WordPress MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin <= 5.9.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin MP3 Audio Player for Music, Radio & Podcast by Sonaar versions = 5.9.4...

WordPress eaSYNC plugin <= 1.3.19 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mika in WordPress Plugin eaSYNC versions = 1.3.19...

WordPress News Element Elementor Blog Magazine plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Gab in WordPress Plugin News Element Elementor Blog Magazine versions = 1.0.8...

WordPress Motors plugin <= 1.4.71 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by LVT-tholv2k in WordPress Plugin Motors versions = 1.4.71...

WordPress Chamber Dashboard Business Directory plugin <= 3.3.11 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by theviper17 in WordPress Plugin Chamber Dashboard Business Directory versions = 3.3.11...

WordPress Real Estate Manager plugin <= 7.3 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by LVT-tholv2k in WordPress Plugin Real Estate Manager versions = 7.3...

WordPress Sidebar Manager Light plugin <= 1.18 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by SOPROBRO in WordPress Plugin Sidebar Manager Light versions = 1.18...

PT-2025-14979 · Piotnet · Piotnet Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Piotnet Addons For Elementor versions 2.4.34 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacke...

WordPress Countdown & Clock plugin <= 2.8.9.1 - Unauthenticated Limited Local File Inclusion vulnerability

Unauthenticated Limited Local File Inclusion vulnerability discovered by mikemyers in WordPress Plugin Countdown & Clock versions = 2.8.9.1...

WordPress Uncanny Automator plugin <= 6.3.0.2 - Missing Authorization to Privilege Escalation vulnerability

Missing Authorization to Privilege Escalation vulnerability discovered by mikemyers in WordPress Plugin Uncanny Automator versions = 6.3.0.2...

WordPress Search engine keywords highlighter plugin <= 0.1.3 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by johska in WordPress Plugin Search engine keywords highlighter versions = 0.1.3...

WordPress Booking Calendar and Notification plugin <= 4.0.3 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Pham Van Tam Patchstack Alliance in WordPress Plugin Booking Calendar and Notification versions = 4.0.3...

WordPress Team Builder plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Abdi Pranata in WordPress Plugin Team Builder versions = 1.3...

WordPress Testimonial Slider plugin <= 2.0.13 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by LVT-tholv2k in WordPress Plugin Testimonial Slider versions = 2.0.13...

WordPress LuckyWP Table of Contents plugin <= 2.1.10 - Cross-Site Request Forgery to Reflected Cross-Site Scripting vulnerability

Cross-Site Request Forgery to Reflected Cross-Site Scripting vulnerability discovered by mikemyers in WordPress Plugin LuckyWP Table of Contents versions = 2.1.10...

@514labs/design-system-base (>=0.4.13, <=0.4.69), @514labs/event-capture (>=0.4.13, <=0.4.69) +9 more potentially affected by CVE-2025-30218 via next (14.2.25)

next NPM version 14.2.25 is affected by a known vulnerability. The following packages have a transitive dependency on next and may be impacted: - @514labs/design-system-base =0.4.13, =0.4.13, =0.1.0, =1.0.8, =0.1.99, =2.1.28, =3.0.5, =3.0.6 - upcloud 1.1.4 Source cves: CVE-2025-30218 Source...

WordPress Residential Address Detection plugin <= 2.5.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mika in WordPress Plugin Residential Address Detection versions = 2.5.4...

WordPress Advanced Typekit plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by SOPROBRO in WordPress Plugin Advanced Typekit versions = 1.0.1...

WordPress Awesome Logos plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Le Ngoc Anh in WordPress Plugin Awesome Logos versions = 1.2...

WordPress Tiger Theme <= 2.0 is vulnerable to Cross Site Scripting (XSS)

Software Tiger Type Theme Vulnerable versions = 2.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2025-31407 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 7418cf31bc7a Credits Mika Required privilege Subscriber Published 2...