PT-2025-25667 · WordPress · Suhas Surse Wp Employee Attendance System

Name of the Vulnerable Software and Affected Versions: Suhas Surse WP Employee Attendance System versions 3.5 and earlier Description: The issue is related to an SQL Injection vulnerability, specifically Improper Neutralization of Special Elements used in an SQL Command. This allows for Blind SQL...

PT-2025-25686 · Unknown · Wp Job Portal

Name of the Vulnerable Software and Affected Versions: WP Job Portal versions n/a through 2.3.2 Description: The issue is related to an SQL Injection vulnerability, specifically an Improper Neutralization of Special Elements used in an SQL Command. This allows for Blind SQL Injection, which can b...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes. The following security bugs were fixed: CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching bsc1242006. CVE-2024-35840: mptcp: use OPTIONMPTCPMPJSYNACK in subflowfinishconnect bsc122459...

WordPress WP Dummy Content Generator plugin <= 3.4.6 - Arbitrary User Deletion vulnerability

Arbitrary User Deletion vulnerability discovered by Mika in WordPress Plugin WP Dummy Content Generator versions = 3.4.6...

CVE-2025-5282

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the deletepackage function in all versions up to, and including, 6.5.1. This makes it possible for unauthenticated attackers to...

CVE-2025-5939

The Telegram for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions...

CVE-2025-6064

The WP URL Shortener plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing or incorrect nonce validation on the 'urlshortenersettings' page. This makes it possible for unauthenticated attackers to update settings and...

CVE-2025-6064

CVE-2025-6064 affects the WP URL Shortener WordPress plugin (versions ≤ 1.2). Root cause: missing/incorrect nonce validation on the url_shortener_settings page enabling CSRF. Exploitation: unauthenticated attackers could forge requests to update settings and inject scripts if a site admin is tric...

PT-2025-25481 · WordPress · Url Shortener

Name of the Vulnerable Software and Affected Versions: WP URL Shortener plugin for WordPress versions up to, and including, 1.2 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the 'url shortener settings' page. This allows...

CVE-2025-5282 WP Travel Engine <= 6.5.1 - Missing Authorization to Unauthenticated Arbitrary Post Deletion

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the deletepackage function in all versions up to, and including, 6.5.1. This makes it possible for unauthenticated attackers to...

CVE-2025-5282 WP Travel Engine <= 6.5.1 - Missing Authorization to Unauthenticated Arbitrary Post Deletion

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the deletepackage function in all versions up to, and including, 6.5.1. This makes it possible for unauthenticated attackers to...

CVE-2025-5282

CVE-2025-5282 : WP Travel Engine – Tour Booking Plugin (WordPress) versions up to and including 6.5.1 are vulnerable due to a missing capability check in delete_package(), allowing unauthenticated attackers to delete arbitrary posts. The issue is confirmed in multiple sources (NVD entry, Red Hat ...

CVE-2025-5939

The Telegram for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions...

CVE-2025-5928 WP Sliding Login/Dashboard Panel <= 2.1.1 - Cross-Site Request Forgery to Settings Update

The WP Sliding Login/Dashboard Panel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing or incorrect nonce validation on the wpslidingpaneluseroptions function. This makes it possible for unauthenticated attackers t...

CVE-2025-5939 Telegram for WP <= 1.6.1 - Authenticated (Admin+) Stored Cross-Site Scripting

The Telegram for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions...

CVE-2025-5939

The Telegram for WP WordPress plugin is affected by a Stored Cross-Site Scripting (XSS) vulnerability in admin settings, present in all versions up to and including 1.6.1. The issue stems from insufficient input sanitization and output escaping, enabling an attacker with administrator-level permi...

WordPress WP Event Manager Improper Filename Control Vulnerability

WordPress WP Event Manager is an event management plugin designed specifically for WordPress that allows users to create, manage and promote various types of events including conferences, seminars, exhibitions, parties and more. A filename miscontrol vulnerability exists in WordPress WP Event...

PT-2025-25380 · WordPress · Telegram For Wp

Name of the Vulnerable Software and Affected Versions: Telegram for WP plugin for WordPress versions up to, and including, 1.6.1 Description: The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This allows authenticate...

PT-2025-25382 · WordPress · Wp Travel Engine

Name of the Vulnerable Software and Affected Versions: The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress versions up to, and including, 6.5.1 Description: The issue is related to a missing capability check on the delete package function, allowing...

CVE-2025-47477

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in revmakx Backup and Staging by WP Time Capsule wp-time-capsule allows Reflected XSS.This issue affects Backup and Staging by WP Time Capsule: from n/a through = 1.22.23...