CVE-2026-4297 Welcome Software Publishing <= 0.0.31 - Authenticated (Subscriber+) Arbitrary Options Update to Privilege Escalation via 'nc.setOption' XML-RPC Method

The Welcome Software Publishing plugin for WordPress is vulnerable to Arbitrary Options Update in all versions up to and including 0.0.31. This is due to a missing capability check in the ncsetOption function, which is exposed via the nc.setOption XML-RPC method. The function authenticates the us...

EUVD-2017-18001

Malware in sbrugna...

CVE-2025-49968

CVE-2025-49968 affects WordPress XML Travel Portal Widget (XML Travel Portal Widget) with CSRF in versions n/a through 2.0. Root cause: Cross-Site Request Forgery (CSRF) in the widget. Affected product/version details are provided, but no exploit specifics are documented in the connected sources....

CVE-2025-24646 WordPress XML for Avito Plugin <= 2.5.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in icopydoc XML for Avito xml-for-avito allows Reflected XSS.This issue affects XML for Avito: from n/a through = 2.5.2...