Latest CVE Feed
-
8.8
HIGHCVE-2025-13536
The Blubrry PowerPress plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 11.15.2. This is due to the plugin validating file extensions but not halting execution when... Read more
Affected Products : powerpress- Published: Nov. 27, 2025
- Modified: Nov. 27, 2025
- Vuln Type: Authentication
-
5.3
MEDIUMCVE-2025-13441
The Hide Category by User Role for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.3.1. This is due to a missing capability check on the admin_init hook that executes wp_cache_flush(). This m... Read more
Affected Products :- Published: Nov. 27, 2025
- Modified: Nov. 27, 2025
- Vuln Type: Authorization
-
5.3
MEDIUMCVE-2025-13157
The QODE Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.7 via the 'qode_wishlist_for_woocommerce_wishlist_table_item_callback' function due to missing validation on... Read more
Affected Products :- Published: Nov. 27, 2025
- Modified: Nov. 27, 2025
- Vuln Type: Authorization
-
6.1
MEDIUMCVE-2025-13525
The WP Directory Kit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'order_by' parameter in all versions up to, and including, 1.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unaut... Read more
Affected Products : wp_directory_kit- Published: Nov. 27, 2025
- Modified: Nov. 27, 2025
- Vuln Type: Cross-Site Scripting
-
4.3
MEDIUMCVE-2025-13143
The Poll, Survey & Quiz Maker Plugin by Opinion Stage plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 19.12.0. This is due to missing or insufficient nonce validation on the disconnect_account_action ... Read more
Affected Products : poll\,_survey_\&_quiz_maker- Published: Nov. 27, 2025
- Modified: Nov. 27, 2025
- Vuln Type: Cross-Site Request Forgery
-
4.4
MEDIUMCVE-2025-12185
The StaffList plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, ... Read more
Affected Products : stafflist- Published: Nov. 27, 2025
- Modified: Nov. 27, 2025
- Vuln Type: Cross-Site Scripting
-
6.1
MEDIUMCVE-2025-12123
The Customer Reviews Collector for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'email-text' parameter in all versions up to, and including, 4.6.1 due to insufficient input sanitization and output escaping. This... Read more
Affected Products :- Published: Nov. 27, 2025
- Modified: Nov. 27, 2025
- Vuln Type: Cross-Site Scripting
-
7.5
HIGHCVE-2025-7820
The SKT PayPal for WooCommerce plugin for WordPress is vulnerable to Payment Bypass in all versions up to, and including, 1.4. This is due to the plugin only enforcing client side controls instead of server-side controls when processing payments. This mak... Read more
Affected Products :- Published: Nov. 27, 2025
- Modified: Nov. 27, 2025
- Vuln Type: Authentication
-
5.5
MEDIUMCVE-2025-3784
Cleartext Storage of Sensitive Information Vulnerability in GX Works2 all versions allows an attacker to disclose credential information stored in plaintext from project files. As a result, the attacker may be able to open project files protected by user ... Read more
Affected Products : gx_works2- Published: Nov. 27, 2025
- Modified: Nov. 27, 2025
- Vuln Type: Information Disclosure
-
8.8
HIGHCVE-2025-13680
The Tiger theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 101.2.1. This is due to the plugin allowing a user to update the user role through the $user->set_role() function. This makes it possible for authent... Read more
Affected Products :- Published: Nov. 27, 2025
- Modified: Nov. 27, 2025
- Vuln Type: Authorization
-
9.8
CRITICALCVE-2025-13675
The Tiger theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 101.2.1. This is due to the 'paypal-submit.php' file not restricting what user roles a user can register with. This makes it possible for unauthentic... Read more
Affected Products :- Published: Nov. 27, 2025
- Modified: Nov. 27, 2025
- Vuln Type: Authentication
-
9.8
CRITICALCVE-2025-13540
The Tiare Membership plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2. This is due to the 'tiare_membership_init_rest_api_register' function not restricting what user roles a user can register with. This... Read more
Affected Products :- Published: Nov. 27, 2025
- Modified: Nov. 27, 2025
- Vuln Type: Authentication
-
9.8
CRITICALCVE-2025-13539
The FindAll Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.4. This is due to the plugin not properly logging in a user with the data that was previously verified through the 'findall_member... Read more
Affected Products :- Published: Nov. 27, 2025
- Modified: Nov. 27, 2025
- Vuln Type: Authentication
-
9.8
CRITICALCVE-2025-13538
The FindAll Listing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.5. This is due to the 'findall_listing_user_registration_additional_params' function not restricting what user roles a user can regist... Read more
Affected Products :- Published: Nov. 27, 2025
- Modified: Nov. 27, 2025
- Vuln Type: Authentication
-
7.7
HIGHCVE-2025-12758
Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength() function that does not take into account Unicode variation selectors (\uFE0F, \uFE0E) appearing in a se... Read more
Affected Products :- Published: Nov. 27, 2025
- Modified: Nov. 27, 2025
- Vuln Type: Denial of Service
-
6.4
MEDIUMCVE-2025-12151
The Simple Folio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'portfolio_name' parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authen... Read more
Affected Products :- Published: Nov. 27, 2025
- Modified: Nov. 27, 2025
- Vuln Type: Cross-Site Scripting
-
7.7
HIGHCVE-2025-10089
Uncontrolled Search Path Element Vulnerability in Setting and Operation Application for Lighting Control System MILCO.S Setting Application all versions, MILCO.S Setting Application (IR) all versions, MILCO.S Easy Setting Application (IR) all versions, an... Read more
Affected Products :- Published: Nov. 18, 2025
- Modified: Nov. 27, 2025
- Vuln Type: Misconfiguration
-
7.5
HIGHCVE-2025-66314
Improper Privilege Management vulnerability in ZTE ElasticNet UME R32 on Linux allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects ElasticNet UME R32: ElasticNet_UME_R32_V16.23.20.04.... Read more
Affected Products :- Published: Nov. 27, 2025
- Modified: Nov. 27, 2025
- Vuln Type: Authorization
-
9.3
CRITICALCVE-2025-34351
Anyscale Ray 2.52.0 contains an insecure default configuration in which token-based authentication for Ray management interfaces (including the dashboard and Jobs API) is disabled unless explicitly enabled by setting RAY_AUTH_MODE=token. In the default un... Read more
Affected Products :- Published: Nov. 27, 2025
- Modified: Nov. 27, 2025
- Vuln Type: Authentication
-
4.8
MEDIUMCVE-2025-13762
Improper Input Validation vulnerability in CyberArk CyberArk Secure Web Sessions Extension on Chrome, Edge allows Denial of Service when trying to starting new SWS sessions.This issue affects CyberArk Secure Web Sessions Extension: before 2.2.30305.... Read more
Affected Products :- Published: Nov. 27, 2025
- Modified: Nov. 27, 2025
- Vuln Type: Denial of Service