Latest CVE Feed
-
6.1
MEDIUMCVE-2025-1288
The WOOEXIM WordPress plugin through 5.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make an unauthenticated user vulnerable to reflected XSS via a CSRF attack.... Read more
Affected Products : wooexim- Published: May. 15, 2025
- Modified: Jun. 12, 2025
- Vuln Type: Cross-Site Request Forgery
-
6.1
MEDIUMCVE-2025-1286
The Download HTML TinyMCE Button WordPress plugin through 1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.... Read more
Affected Products : download_html_tinymce_button- Published: May. 15, 2025
- Modified: Jun. 12, 2025
- Vuln Type: Cross-Site Scripting
-
4.8
MEDIUMCVE-2024-9182
The Maspik WordPress plugin before 2.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.... Read more
Affected Products : maspik- Published: May. 15, 2025
- Modified: Jun. 12, 2025
- Vuln Type: Cross-Site Scripting
-
4.8
MEDIUMCVE-2025-1033
The Badgearoo WordPress plugin through 1.0.14 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (fo... Read more
Affected Products : badgearoo- Published: May. 15, 2025
- Modified: Jun. 12, 2025
- Vuln Type: Cross-Site Scripting
-
4.8
MEDIUMCVE-2025-0329
The AI ChatBot for WordPress WordPress plugin before 6.2.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is ... Read more
Affected Products : wpbot- Published: May. 15, 2025
- Modified: Jun. 12, 2025
- Vuln Type: Cross-Site Scripting
-
4.8
MEDIUMCVE-2024-9882
The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripti... Read more
Affected Products : salon_booking_system- Published: May. 15, 2025
- Modified: Jun. 12, 2025
- Vuln Type: Cross-Site Scripting
-
9.8
CRITICALCVE-2025-28200
Victure RX1800 EN_V1.0.0_r12_110933 was discovered to utilize a weak default password which includes the last 8 digits of the Mac address.... Read more
- Published: May. 09, 2025
- Modified: Jun. 12, 2025
- Vuln Type: Authentication
-
5.4
MEDIUMCVE-2024-9879
The Melapress File Monitor WordPress plugin before 2.1.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks... Read more
Affected Products : melapress_file_monitor- Published: May. 15, 2025
- Modified: Jun. 12, 2025
- Vuln Type: Injection
-
5.4
MEDIUMCVE-2024-9838
The Auto Affiliate Links WordPress plugin before 6.4.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks... Read more
Affected Products : auto_affiliate_links- Published: May. 15, 2025
- Modified: Jun. 12, 2025
- Vuln Type: Injection
-
4.8
MEDIUMCVE-2024-8759
The Nested Pages WordPress plugin before 3.2.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (f... Read more
Affected Products : nested_pages- Published: May. 15, 2025
- Modified: Jun. 12, 2025
- Vuln Type: Cross-Site Scripting
-
7.2
HIGHCVE-2024-9831
The Taskbuilder WordPress plugin before 3.0.9 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks... Read more
Affected Products : taskbuilder- Published: May. 15, 2025
- Modified: Jun. 12, 2025
- Vuln Type: Injection
-
5.4
MEDIUMCVE-2024-9663
The CYAN Backup WordPress plugin before 2.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (fo... Read more
Affected Products : cyan_backup- Published: May. 15, 2025
- Modified: Jun. 12, 2025
- Vuln Type: Cross-Site Scripting
-
5.4
MEDIUMCVE-2024-9662
The CYAN Backup WordPress plugin before 2.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (fo... Read more
Affected Products : cyan_backup- Published: May. 15, 2025
- Modified: Jun. 12, 2025
- Vuln Type: Cross-Site Scripting
-
5.4
MEDIUMCVE-2024-9238
The AVIF Uploader WordPress plugin before 1.1.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.... Read more
Affected Products : avif_uploader- Published: May. 15, 2025
- Modified: Jun. 12, 2025
- Vuln Type: Cross-Site Scripting
-
6.8
MEDIUMCVE-2025-28201
An issue in Victure RX1800 EN_V1.0.0_r12_110933 allows physically proximate attackers to execute arbitrary code or gain root access.... Read more
- Published: May. 09, 2025
- Modified: Jun. 12, 2025
- Vuln Type: Authentication
-
4.8
MEDIUMCVE-2024-8702
The Backup Database WordPress plugin through 4.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed ... Read more
Affected Products : backup_database- Published: May. 15, 2025
- Modified: Jun. 12, 2025
- Vuln Type: Cross-Site Scripting
-
5.9
MEDIUMCVE-2025-32407
Samsung Internet for Galaxy Watch version 5.0.9, available up until Samsung Galaxy Watch 3, does not properly validate TLS certificates, allowing for an attacker to impersonate any and all websites visited by the user. This is a critical misconfiguration ... Read more
Affected Products : internet- Published: May. 16, 2025
- Modified: Jun. 12, 2025
- Vuln Type: Misconfiguration
-
7.2
HIGHCVE-2025-4190
The CSV Mass Importer WordPress plugin through 1.2 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)... Read more
Affected Products : csv_mass_importer- Published: May. 17, 2025
- Modified: Jun. 12, 2025
- Vuln Type: Authorization
-
9.8
CRITICALCVE-2025-48187
RAGFlow through 0.18.1 allows account takeover because it is possible to conduct successful brute-force attacks against email verification codes to perform arbitrary account registration, login, and password reset. Codes are six digits and there is no rat... Read more
Affected Products : ragflow- Published: May. 17, 2025
- Modified: Jun. 12, 2025
- Vuln Type: Authentication
-
8.8
HIGHCVE-2025-47273
setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files t... Read more
- Published: May. 17, 2025
- Modified: Jun. 12, 2025
- Vuln Type: Path Traversal