CVE Feed

Administrator SQL Injection in Frontend Admin by DynamiApps <= 3.29.13 versions.

Subscriber PHP Object Injection in Dynamic User Directory <= 2.4 versions.

Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions.

Administrator SQL Injection in Leyka <= 3.32.3 versions.

Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web <= 1.8.47 versions.

Subscriber SQL Injection in Qode Tours <= 3.1.3.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web <= 1.2.63 versions.

Unauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 versions.

Unauthenticated Broken Access Control in DK <= 3.2.1 versions.

Unauthenticated Broken Access Control in Grand News <= 3.4 versions.

Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Reflected XSS.This issue affects Tutor LMS: from n/a through 4.1.0.

Unauthenticated Cross Site Scripting (XSS) in FV Player 8 <= 8.1.8 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Inisev Social Share Icons & Social Share Buttons ultimate-social-media-plus allows Reflected XSS.This issue affects Social Share Icons & Social Share Buttons: from n/a through 3.7.5.

Improper Control of Generation of Code ('Code Injection') vulnerability in Royal Plugins SiteVault – Backup, Restore, Migration &amp; Cloning sitevault-backup-restore-migration allows Remote Code Inclusion.This issue affects SiteVault – Backup, Restore, Migration &amp; Cloning: from n/a through 1.5.19.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TieLabs Jannah jannah allows Reflected XSS.This issue affects Jannah: from n/a before 7.6.8.

Subscriber SQL Injection in Events Manager <= 7.4.6 versions.

Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate <= 1.1.7.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Qode Music <= 2.1.8.2 versions.

Unauthenticated Sensitive Data Exposure in Web Plura Backup &amp; Restore Manager <= 0.2.25 versions.

Unauthenticated Sensitive Data Exposure in Swish Migrate and Backup <= 1.4.0 versions.

Subscriber Broken Access Control in Jetpack VideoPress <= 3.6 versions.

Subscriber Arbitrary File Deletion in PeepSo <= 9.0.5.4 versions.

Unauthenticated Cross Site Scripting (XSS) in Jotform &#8211; AI Chatbot <= 3.8.2 versions.

Missing Authorization vulnerability in pubjet Pubjet | پاب‌جت pubjet allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pubjet | پاب‌جت: from n/a through 5.4.8.

Subscriber Broken Access Control in Wordable <= 8.2.10 versions.

Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.5.3 versions.

Subscriber Broken Access Control in WPSection <= 1.5.1 versions.

Unauthenticated Remote Code Execution (RCE) in Everest Backup <= 2.3.13 versions.

Subscriber Privilege Escalation in AIWU <= 1.5.9 versions.

Unauthenticated Cross Site Scripting (XSS) in Additional Order Filters for WooCommerce <= 1.24 versions.

Unauthenticated Cross Site Scripting (XSS) in WP File Download <= 6.3.6 versions.

Server-Side Request Forgery (SSRF) vulnerability in Builderius.io Builderius allows Server Side Request Forgery. This issue affects Builderius: from 1.4 through 1.4-beta.

Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP run_query safety gate that allows prompt-injected agents or untrusted MCP clients to bypass read-only mode by submitting side-effecting SELECT statements. Attackers can run statements like SELECT setval, nextval, or PostgreSQL query_to_xml with embedded DELETE to modify data without approval prompts.

slide-maker through 5.8.0 contains a path traversal vulnerability in generate_images_openai.py that allows attackers to write image files outside the output directory via manifest-supplied filenames. Attackers can influence deck source material so the image prompt manifest contains ../ or symlinked filenames, creating directories and overwriting existing files at arbitrary paths.

Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attackers can create webhooks with public hostnames that resolve or DNS-rebind to loopback or internal addresses, causing blind POST requests to internal HTTPS services.

Subscriber Bypass Vulnerability in MicroPayments <= 3.2.9 versions.

Unauthenticated Bypass Vulnerability in Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway <= 1.7.2 versions.

Missing Authorization vulnerability in VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce woo-alidropship allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce: from n/a through 2.2.4.