26 March 2025

57 results · Clear filters · Feed

• Medium 6.4
  CVE-2025-1437

  Advanced iFrame <= 2025.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

  The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all versions up to, and including, 2025.2 due to insufficient input sanitization and output escaping on user supplied attribu…

  mdempfle Advanced iFrame Web / CMS
  Mar 26, 2025
• Medium 6.5
  CVE-2025-1310

  Jobs for WordPress <= 2.7.11 - Authenticated (Subscriber+) Arbitrary File Read

  The Jobs for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.7.11 via the 'job_postings_get_file' parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above…

  blueglassch Job Postings Web / CMS
  Mar 26, 2025
• Medium 6.4
  CVE-2024-13702

  CRM and Lead Management by vcita <= 2.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

  The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vCitaMeetingScheduler' and 'vCitaSchedulingCalendar' shortcodes in all versions up to, and including, 2.7.4 due to insufficient input sani…

  vcita CRM and Lead Management by vcita Web / CMS
  Mar 26, 2025
• Medium 5.4
  CVE-2025-2167

  Event post <= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

  The Event post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'events_list' shortcodes in all versions up to, and including, 5.9.9 due to insufficient input sanitization and output escaping on user supplied attributes. This…

  bastho Event post Web / CMS
  Mar 26, 2025
• Medium 5.5
  CVE-2024-30155

  HCL SX is susceptible to cookie with Insecure, Improper, or Missing SameSite attribute vulnerability

  HCL SX does not set the secure attribute on authorization tokens or session cookies. Attackers may potentially be able to obtain access to the cookie values via a Cross-Site-Forgery-Request (CSRF).

  HCL Software HCL SX
  Mar 26, 2025
• Medium 5.5
  CVE-2023-52972

  Huawei PCs have a vulnerability that allows low-privilege users to bypass SDDL permission checks . Successful exploitat…

  Huawei YutuFZ-5651S1 Network devices
  Mar 26, 2025
• Medium 4.8
  CVE-2024-11847

  WP SVG Upload <= 1.0.0 - Author+ Stored XSS via SVG

  The wp-svg-upload WordPress plugin through 1.0.0 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks.

  digimix/wp-svg-upload Web / CMS Packagist
  Mar 26, 2025
• Medium 6.4
  CVE-2025-1784

  Spectra – WordPress Gutenberg Blocks <= 2.19.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

  The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the uagb block in all versions up to, and including, 2.19.0 due to insufficient input sanitization and output escaping. This makes it possible for a…

  Brainstorm Force Spectra Gutenberg Blocks – Website Builder for the Block Editor Web / CMS
  Mar 26, 2025
• Medium 6.1
  CVE-2025-1490

  Smart Maintenance Mode <= 1.5.2 - Reflected Cross-Site Scripting via setstatus Parameter

  The Smart Maintenance Mode plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘setstatus’ parameter in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for un…

  brijeshk89 Smart Maintenance Mode Web / CMS
  Mar 26, 2025
• Medium 6.1
  CVE-2025-2165

  SH Email Alert <= 1.0 - Reflected Cross-Site Scripting

  The SH Email Alert plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'mid' parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated at…

  samhoamt SH Email Alert Web / CMS
  Mar 26, 2025
• Medium 6.4
  CVE-2025-2576

  Ayyash Studio <= 1.0.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

  The Ayyash Studio — The kick-start kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping. This makes it possible for au…

  themerox Ayyash Studio — The kick-start kit Web / CMS
  Mar 26, 2025
• Medium 6.4
  CVE-2025-2573

  Amazing service box Addons For WPBakery Page Builder <= 2.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

  The Amazing service box Addons For WPBakery Page Builder (formerly Visual Composer) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.0.0 due to insufficient input sanitization and o…

  zia420 Amazing service box Addons For WPBakery Page Builder (formerly Visual Composer) Web / CMS
  Mar 26, 2025
• Medium 6.5
  CVE-2024-55965

  An issue was discovered in Appsmith before 1.51. Users invited as "App Viewer" incorrectly have access to development i…

  Mar 26, 2025
• Medium 6.5
  CVE-2024-55963 Public exploit EPSS 33%

  An issue was discovered in Appsmith before 1.51. A user on Appsmith that doesn't have admin permissions can trigger the…

  Mar 26, 2025
• Medium 6.8
  CVE-2024-41643

  An issue in Arris NVG443B 9.3.0h3d36 allows a physically proximate attacker to execute arbitrary code via the cshell lo…

  Mar 26, 2025
• Medium 4.6
  CVE-2025-29322

  A cross-site scripting (XSS) vulnerability in ScriptCase before v1.0.003 - Build 3 allows attackers to execute arbitrar…

  Mar 26, 2025
• Medium 5.3
  CVE-2025-30742

  httpd.c in atophttpd 2.8.0 has an off-by-one error and resultant out-of-bounds read because a certain 1024-character re…

  pizhenwei atophttpd
  Mar 26, 2025