2025

An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in defaul

The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to missing authorization in versions

The CryptX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `cryptx` shortcode in all

The Trail Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions u

The Thai Lottery Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `thailottery` shortcod

The Cool Tag Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cool_tag_cloud' s

The User Generator and Importer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and i

The Projectopia – WordPress Project Management plugin for WordPress is vulnerable to unauthorized modification of data d

The My auctions allegro plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including,

The ARK Related Posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 2.19. This is due to m

The WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress is vulnerable to

The Nouri.sh Newsletter plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF

The My auctions allegro plugin for WordPress is vulnerable to SQL Injection via the ‘auction_id’ parameter in all versio

The Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification plu

The Torod – The smart shipping and delivery portal for e-shops and retailers plugin for WordPress is vulnerable to Cross

The Payaza plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on

The Live CSS Preview plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability

The Weekly Planner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions

The Voidek Employee Portal plugin for WordPress is vulnerable to unauthorized access due to a missing capability check o

The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. This affects KDE Connect

In the KDE Connect information-exchange protocol before 2025-04-18, a packet can be crafted to temporarily change the di

The Easy Jump Links Menus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `h_tags` parameter i

The WP-SOS-Donate Donation Sidebar Plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVE

The Twitscription plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the admin.php PATH_INFO in al

The Jabbernotification plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the admin.php PATH_INFO

The dream gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including,

The Feedback Modal for Website plugin for WordPress is vulnerable to unauthorized access of data due to a missing capabi

The CoSign Single Signon plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SEL

The Quantic Social Image Hover plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, a

The ContentStudio plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including,

The Takeads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.0.13. Thi

The Sermon Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `sermon-views` shortcode in

The PDF Catalog for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pdfcatalog' A

The Image Optimizer by wps.sk plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, an

The Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents plugin for WordPres

The ContentStudio plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in th

The Webcake – Landing Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a miss

The Omnipress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up

The Auto Thumbnailer plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in

The Featured Image via URL plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validat

The EPROLO Dropshipping plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabil

The Hide Categories Or Products On Shop Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in all ver

The FitVids for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all ve

The Time Sheets plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2

In CKSource CKFinder before 2.5.0.1 for ASP.NET, authenticated users could download any file from the server if the corr

In KDE Connect before 1.33.0 on Android, malicious device IDs (sent via broadcast UDP) could cause an application crash.

In KDE Connect before 1.33.0 on Android, a packet can be crafted that causes two paired devices to unpair. Specifically,

The KDE Connect verification-code protocol before 2025-04-18 uses only 8 characters and therefore allows brute-force att

The SSP Debug plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including,

The Norby AI plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.