Missing authorization in GrandPlugins Image Sizes Controller, Create Custom Image Sizes, and Disable Image Sizes WordPress plugins allows authenticated attackers with low privileges to exploit incorrectly configured access controls, potentially modifying image size settings. The vulnerability affects all versions up to 1.0.9 and has a low EPSS score (0.05%), with no public exploit or active exploitation confirmed.
A security vulnerability in Missing Authorization vulnerability in sparklewpthemes Hello FSE Blog (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
A security vulnerability in Missing Authorization vulnerability in mahabub81 User Roles and Capabilities (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Missing authorization in WP User Profile Avatar plugin for WordPress allows authenticated low-privilege users to access or modify profile avatar data without proper permission checks. Affects versions up to 1.0.6. No public exploit or active exploitation identified.
A security vulnerability in Missing Authorization vulnerability in slui Media Hygiene (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
CVE-2025-49971 is a security vulnerability (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Cross-Site Request Forgery (CSRF) in BoldGrid Post and Page Builder for WordPress allows an attacker to trick an authenticated admin into performing unintended actions, such as modifying settings or content, without their consent. The vulnerability affects versions up to 1.27.8 and requires user interaction via a crafted link. No public exploit or active exploitation has been identified, and the EPSS score is low (0.02%).
Cross-site request forgery in WP Inventory Manager allows remote attackers to perform unauthorized actions on behalf of a logged-in administrator by tricking them into clicking a crafted link. The vulnerability has a low EPSS score and no evidence of active exploitation, limiting real-world risk despite the network-accessible attack vector.
Cross-Site Request Forgery (CSRF) in JobWP WordPress plugin up to version 2.4.0 allows an attacker to trick an authenticated admin into performing unintended actions, such as modifying plugin settings or creating unauthorized job listings. The vulnerability has a low EPSS score (0.02%) and no public exploit or active exploitation has been identified.
Cross-Site Request Forgery (CSRF) in the TM Replace Howdy WordPress plugin up to version 1.4.2 allows an attacker to trick an authenticated administrator into performing unintended actions, such as changing plugin settings, by crafting a malicious link. The vulnerability has a low EPSS score (0.02%) and no public exploit or active exploitation has been identified.
Cross-Site Request Forgery (CSRF) in the XML Travel Portal Widget plugin for WordPress allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying plugin settings. The vulnerability affects all versions up to and including 2.0. No public exploit or active exploitation has been identified, and the EPSS score is low (0.02%).
Cross-Site Request Forgery (CSRF) in Live Sports Streamthunder WordPress plugin up to version 2.1 allows an attacker to trick an authenticated admin into performing unintended actions, such as changing plugin settings or initiating unauthorized operations. The vulnerability has a low EPSS score (0.02%) and no public exploit or active exploitation has been identified.
Cross-Site Request Forgery (CSRF) in the Oganro Travel Portal Search Widget for HotelBeds APITUDE API plugin for WordPress allows an attacker to trick an authenticated administrator into performing unintended actions, such as changing plugin settings or making unauthorized API requests. The vulnerability affects all versions up to and including 1.0. No public exploit or active exploitation has been identified, and the EPSS score is low (0.02%).
Cross-Site Request Forgery in PixelBeds Channel Manager and Hotel Booking Engine plugin for WordPress allows an attacker to trick an authenticated admin into performing unintended actions, such as changing settings or making unauthorized bookings. The vulnerability affects all versions up to and including 1.0, with no public exploit or active exploitation identified at this time.
Cross-Site Request Forgery (CSRF) in ClipLink WordPress plugin up to version 1.1 allows an attacker to trick an authenticated admin into performing unintended actions, such as changing settings or deleting data, by luring them to a malicious page. No public exploit or active exploitation has been identified, and the EPSS score is low (0.02%).
An issue was discovered in GitLab EE affecting all versions starting from 17.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2, where webhook deletion audit log preserved auth credentials.
PowSyBl (Power System Blocks) is a framework to build power system oriented software. In com.powsybl:powsybl-iidm-criteria versions 6.3.0 to before 6.7.2 and com.powsybl:powsybl-contingency-api versions 5.0.0 to before 6.3.0, there is a a potential polynomial Regular Expression Denial of Service (ReDoS) vulnerability in the RegexCriterion class. This class compiles and evaluates an unvalidated, user-supplied regular expression against the identifier of an Identifiable object via Pattern.compile(regex).matcher(id).find(). If successfully exploited, a malicious actor can cause significant CPU exhaustion through repeated or recursive filter(...) calls - especially if performed over large network models or filtering operations. This issue has been patched in com.powsybl:powsybl-iidm-criteria 6.7.2.
A security vulnerability in RISC Zero (CVSS 2.7). Remediation should follow standard vulnerability management procedures.
A vulnerability has been identified in Keycloak that could lead to unauthorized information disclosure. While it requires an already authenticated user, the /admin/serverinfo endpoint can inadvertently provide sensitive environment information.
A vulnerability, which was classified as problematic, has been found in PHPGurukul Bus Pass Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/admin-profile.php of the component Profile Page. The manipulation of the argument profile name leads to cross site scripting. The attack may be launched remotely.
Stored cross-site scripting in PHPGurukul COVID19 Testing Management System 1.0 allows authenticated attackers with low privileges to inject arbitrary JavaScript via the 'remark' parameter in /test-details.php. Public exploit code exists, but no active exploitation has been reported and EPSS score is low (0.04%).
Stored cross-site scripting (XSS) in PHPGurukul Notice Board System 1.0 allows an authenticated admin to inject arbitrary JavaScript via the Title or Description fields in the Add Notice functionality. The attack is remotely exploitable with high privileges (admin) and requires user interaction. A public exploit exists, but no active exploitation has been reported.