Tangiblewp
Monthly
Full authentication bypass in the MyHome Core WordPress plugin (versions up to and including 4.4.5) lets unauthenticated attackers mint a valid activation token for any unconfirmed account and receive that account's auth cookie, enabling silent takeover of administrator accounts. The flaw combines a missing authorization check in the send_link() AJAX handler with weak token validation in activate(). No public exploit has been identified at time of analysis, but the CVSS 9.8 rating and trivial network exploitability against affected configurations make this a high-priority patch item.
Server-Side Request Forgery in Vehica Core WordPress plugin (versions ≤ 1.0.104) allows an authenticated subscriber-level user to induce the server into making arbitrary HTTP requests to internal or external endpoints, potentially exposing internal network topology or services not intended to be reachable from the internet. The vulnerability carries a CVSS 3.1 score of 6.0 with a scope change (S:C), indicating that exploitation can affect systems beyond the vulnerable WordPress installation itself. No public exploit code or CISA KEV listing has been identified at time of analysis.
The Listivo - Classified Ads WordPress Theme theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 2.3.67 due to insufficient. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Full authentication bypass in the MyHome Core WordPress plugin (versions up to and including 4.4.5) lets unauthenticated attackers mint a valid activation token for any unconfirmed account and receive that account's auth cookie, enabling silent takeover of administrator accounts. The flaw combines a missing authorization check in the send_link() AJAX handler with weak token validation in activate(). No public exploit has been identified at time of analysis, but the CVSS 9.8 rating and trivial network exploitability against affected configurations make this a high-priority patch item.
Server-Side Request Forgery in Vehica Core WordPress plugin (versions ≤ 1.0.104) allows an authenticated subscriber-level user to induce the server into making arbitrary HTTP requests to internal or external endpoints, potentially exposing internal network topology or services not intended to be reachable from the internet. The vulnerability carries a CVSS 3.1 score of 6.0 with a scope change (S:C), indicating that exploitation can affect systems beyond the vulnerable WordPress installation itself. No public exploit code or CISA KEV listing has been identified at time of analysis.
The Listivo - Classified Ads WordPress Theme theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 2.3.67 due to insufficient. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.