A remote code execution vulnerability in IDF (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
A security vulnerability in for WordPress is vulnerable to Full Path Disclosure in all (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
Sensitive information exposure in the Crawlomatic Multisite Scraper Post Generator WordPress plugin through version 2.6.8.2 allows unauthenticated remote attackers to retrieve embedded sensitive data via transmitted responses, due to insertion of sensitive information into sent data. No authentication or user interaction is required, but only low-impact confidentiality is compromised. No active exploitation or public exploit is known at time of analysis (EPSS 0.07%).
Sensitive data exposure in KI Live Video Conferences WordPress plugin up to version 5.5.15 allows unauthenticated remote attackers to retrieve embedded sensitive data. The vulnerability has a low EPSS score (0.07%) and no public exploit or active exploitation has been identified.
Missing authorization in the WordPress plugin Interactive Regional Map of Florida up to version 1.0 allows unauthenticated attackers to modify plugin settings or data due to broken access controls. The vulnerability has a low EPSS score (0.06%) and no public exploit or active exploitation has been identified.
Missing authorization in Job Board Manager WordPress plugin up to version 2.1.60 allows unauthenticated attackers to exploit incorrectly configured access controls, potentially modifying data without authentication. No public exploit or active exploitation has been identified, and EPSS score is low (0.06%).
A remote code execution vulnerability (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
Missing authorization in WP-CRM System up to version 3.4.2 allows unauthenticated attackers to access functionality not properly constrained by ACLs, potentially leading to unauthorized data access or modification. No public exploit or active exploitation has been identified, and EPSS score is low (0.06%).
Missing authorization in Verge3D WordPress plugin up to version 4.9.4 allows unauthenticated attackers to exploit incorrectly configured access controls, leading to low confidentiality impact. No public exploit or active exploitation identified; EPSS score is low (0.06%).
A security vulnerability in Missing Authorization vulnerability in bobbingwide oik (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
A security vulnerability in raychat Raychat allows Accessing Functionality Not Properly Constrained by ACLs (CVSS 5.3) that allows accessing functionality not properly constrained. Remediation should follow standard vulnerability management procedures.
Missing authorization in Payment QR WooCommerce plugin for WordPress allows unauthenticated attackers to modify payment QR settings without proper access control. Affects versions up to 1.1.6. No public exploit or active exploitation identified, and EPSS score is low (0.06%).
A security vulnerability in Missing Authorization vulnerability in taskbuilder Taskbuilder (CVSS 5.3) that allows accessing functionality not properly constrained. Remediation should follow standard vulnerability management procedures.
Missing authorization in the OS Diagnosis Generator WordPress plugin up to version 1.4.16 allows unauthenticated remote attackers to access and modify plugin functionality that is not properly constrained by access controls, leading to low-impact integrity compromise.
A remote code execution vulnerability (CVSS 5.3) that allows accessing functionality not properly constrained. Remediation should follow standard vulnerability management procedures.
Missing authorization in WP AutoKeyword 1.0 allows unauthenticated attackers to exploit incorrectly configured access controls, potentially modifying settings or data without proper permissions. No public exploit or active exploitation has been identified, and EPSS score is low (0.06%).
A security vulnerability in Missing Authorization vulnerability in viralloops Viral Loops WP Integration (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
Missing authorization in bbPress API plugin for WordPress allows unauthenticated attackers to access sensitive data. The plugin versions up to 1.0.14 fail to properly enforce access controls on API endpoints, leading to potential information disclosure. No public exploit or active exploitation has been identified at this time.
A security vulnerability in Missing Authorization vulnerability in whassan KI Live Video Conferences (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
Missing authorization in QuickCab WordPress plugin up to version 1.3.3 allows unauthenticated attackers to modify settings or access restricted functionality. The vulnerability has a low EPSS score (0.06%) and no public exploit or active exploitation has been reported.
Stored Cross-Site Scripting (XSS) vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious JavaScript payload in software that will run in the victim's browser. Exploiting this vulnerability requires authenticating to the device and executing certain commands that can be executed with view permission.
Code injection vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious payload in software that will run in the victim's browser. Exploiting this vulnerability requires authenticating to the device and executing certain commands that can be executed only with permissions higher than the view permission.
A remote code execution vulnerability in IDF (CVSS 5.1). Remediation should follow standard vulnerability management procedures.
The wallet has an authentication bypass vulnerability that allows access to specific pages.
A security vulnerability in add-ons (CVSS 5.0). Remediation should follow standard vulnerability management procedures.
A flaw was found in Samba. The smbd service daemon does not pick up group membership changes when re-authenticating an expired SMB session. This issue can expose file shares until clients disconnect and then connect again.
The Simple History plugin for WordPress is vulnerable to sensitive data exposure via Detective Mode due to improper sanitization within the append_debug_info_to_context() function in versions prior to 5.8.1. When Detective Mode is enabled, the plugin’s logger captures the entire contents of $_POST (and sometimes raw request bodies or $_GET) without redacting any password‐related keys. As a result, whenever a user submits a login form, whether via native wp_login or a third‐party login widget, their actual password is written in clear text into the logs. An authenticated attacker or any user whose actions generate a login event will have their password recorded; an administrator (or anyone with database read access) can then read those logs and retrieve every captured password.
The WP Online Users Stats plugin for WordPress is vulnerable to time-based SQL Injection via the ‘table_name’ parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Server-Side Request Forgery (SSRF) in Nexa Blocks WordPress plugin up to version 1.1.0 allows authenticated attackers with low privileges to make the server send crafted requests to internal or external resources. This can lead to limited information disclosure or limited impact on internal systems. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Server-Side Request Forgery (SSRF) in SocialMark WordPress plugin up to version 2.0.7 allows authenticated attackers with low privileges to make the server send crafted requests to internal or external resources, potentially leading to limited information disclosure or low-impact manipulation of internal services. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored Cross-Site Scripting (XSS) vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious JavaScript payload in software that will run in the victim's browser. Exploiting this vulnerability requires authenticating to the device and executing certain commands that can only be executed with permissions higher than the view permission.
A security vulnerability in SystemUI (CVSS 4.8) that allows access. Remediation should follow standard vulnerability management procedures.
Open redirect vulnerability in Newspack Newsletters plugin for WordPress allows phishing attacks. An unauthenticated attacker can craft a URL that redirects users to an external malicious site, exploiting the plugin's redirection functionality. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
An open redirect vulnerability in the WP Gravity Forms Constant Contact Plugin up to version 1.1.0 allows phishing attacks by redirecting users to untrusted sites. The vulnerability requires user interaction and has a low CVSS score of 4.7, with no evidence of active exploitation or public exploit code.
Open redirect vulnerability in WP Gravity Forms Salesforce plugin for WordPress allows phishing attacks. An unauthenticated attacker can craft a URL that redirects users to an external malicious site, exploiting the plugin's redirect functionality. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
CVE-2025-48904 is a security vulnerability (CVSS 4.4). Remediation should follow standard vulnerability management procedures.
A security vulnerability in A vulnerability (CVSS 3.8). Risk factors: public PoC available.
Authenticated low-privilege users can bypass access controls in Slack Notifications by dorzki 2.0.7 and earlier, potentially disrupting notification delivery. Exploitation requires an authenticated session with low privileges and has no direct confidentiality or integrity impact. No public exploit code or active exploitation has been identified at time of analysis.
A security vulnerability in Cozmoslabs Profile Builder allows Phishing (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
IBM Verify Identity Access Digital Credentials 24.06 could allow an authenticated user to crash the service with a specially crafted POST request.
A security vulnerability in all (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Broken access control in Post Grid Master 3.4.13 and earlier allows authenticated attackers with low privileges to modify unauthorized settings. The vulnerability is due to missing authorization checks, enabling exploitation of incorrectly configured access control security levels. No public exploit or active exploitation has been identified, and the EPSS score is low (0.06%).
Authenticated code injection in Team Showcase WordPress plugin allows attackers with contributor-level access or higher to execute arbitrary shortcodes, leading to limited information disclosure. The vulnerability is patched in version 25.05.13, and no active exploitation has been reported.
Missing authorization in Crawlomatic Multisite Scraper Post Generator allows authenticated attackers with low privileges to exploit incorrectly configured access controls, potentially modifying data. The vulnerability affects versions up to 2.6.8.2. No public exploit or active exploitation has been identified, and EPSS score is low (0.06%).
Missing authorization in Product Feed for WooCommerce up to version 2.2.8 allows authenticated attackers with low privileges to exploit incorrectly configured access controls, potentially modifying product feed settings. No public exploit or active exploitation has been identified, and the EPSS score is low (0.06%).
A security vulnerability in Missing Authorization vulnerability in sergiotrinity Trinity Audio (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
A security vulnerability in Missing Authorization vulnerability in cmoreira Team Showcase (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
A security vulnerability in Missing Authorization vulnerability in cmoreira Testimonials Showcase (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Missing authorization in WordLift plugin for WordPress allows authenticated attackers with low privileges to exploit incorrectly configured access controls, potentially modifying data. The vulnerability affects versions up to 3.54.4 and has a low EPSS score (0.06%), with no public exploit or active exploitation confirmed.
A security vulnerability in Missing Authorization vulnerability in eleopard Behance Portfolio Manager (CVSS 4.3). Remediation should follow standard vulnerability management procedures.