Security Advisory OSM Map Widget Stored XSS(CVE20258619)
WordPress OSM Map Widget for Elementor plugin <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button URL vulnerability
Community Advisory Stored XSS in Events Addon(CVE20258150)
WordPress Events Addon for Elementor plugin <= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typewriter and Countdown Widgets vulnerability
Community Advisory RingCentral Two Factor Bypass(CVE20257955)
WordPress RingCentral Communications plugin 1.5-1.6.8 - Missing Server‑Side Verification to Authentication Bypass via ringcentral_admin_login_2fa_verify Function
Hong Kong Cybersecurity Advisory Stored XSS Risk(CVE20258603)
WordPress Unlimited Elements For Elementor plugin <= 1.5.148 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Public Advisory CSRF Enables Command Injection(CVE20257812)
WordPress Video Share VOD – Turnkey Video Site Builder Script plugin <= 2.7.6 - Cross-Site Request Forgery to Command Injection vulnerability
Community Alert Simple Download Monitor SQL Injection(CVE20258977)
WordPress Simple Download Monitor plugin <= 3.9.33 – Authenticated (Contributor+) SQL Injection via order parameter in Log Export functionality vulnerability
Hong Kong Security Advisory WooCommerce Stored XSS(CVE20258073)
WordPress Dynamic AJAX Product Filters for WooCommerce plugin <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via name Parameter vulnerability
Xagio SEO Backup Files Expose Sensitive Data(CVE202413807)
WordPress Xagio SEO plugin <= 7.1.0.5 - Unauthenticated Sensitive Information Exposure via Unprotected Back-Up Files vulnerability
Hong Kong Advisory Ajax Search Lite Exposure(CVE20257956)
WordPress Ajax Search Lite plugin <= 4.13.1 - Missing Authorization to Unauthenticated Basic Information Exposure via ASL_Query in AJAX Search Handler vulnerability
Beaver Builder Reflected Cross Site Scripting Vulnerability(CVE20258897)
WordPress Beaver Builder Plugin (Lite Version) plugin <= 2.9.2.1 - Reflected Cross-Site Scripting vulnerability