Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
16,433 results · page 121 of 329
Apr 15, 2025Vulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle Financial Services Applications (component: Chatbot).CVE-2025-21573 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6
Vulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle Financial Services Applications (component: Chatbot). Supported versions that are affected are 5.1.0.0.0, 6.1.0.0.0 and 7.0.0.0.0. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Financial Services Revenue Management and Billing. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Financial Services Revenue Management and Billing accessible data as well as unauthorized access to critical data or complete access to all Oracle Financial Services Revenue Management and Billing accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Financial Services Revenue Management and Billing. CVSS 3.1 Base Score 6.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L).
- Product
- Oracle Financial Services Revenue Management and Billing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2025An input validation weakness was reported in the TpmSetup module for some legacy System x server products that could allow a local attacker with elevated privilCVE-2024-11679 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.7
An input validation weakness was reported in the TpmSetup module for some legacy System x server products that could allow a local attacker with elevated privileges to read the contents of memory.
- Product
- System x3550 M5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2025Shop Products Filter: Path Traversal: '.../...//'CVE-2025-32585 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Path Traversal: '.../...//' vulnerability in Trusty Plugins Shop Products Filter trusty-woo-products-filter allows PHP Local File Inclusion.This issue affects Shop Products Filter: from n/a through <= 1.2.
- Product
- Shop Products Filter
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Shop Products Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025Neon Product Designer: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32565 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in vertim Neon Product Designer neon-product-designer-for-woocommerce allows SQL Injection.This issue affects Neon Product Designer: from n/a through <= 2.2.0.
- Product
- Neon Product Designer
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update Neon Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025Bulk Product Sync: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31599 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in N-Media Bulk Product Sync sync-wc-google allows SQL Injection.This issue affects Bulk Product Sync: from n/a through <= 8.6.
- Product
- Bulk Product Sync
- Affected
- up to 8.6
- What to do
- Affects up to 8.6. Update Bulk Product Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025Woocommerce Products Reorder Drag Drop Multiple Sort – Sortable, Rearrange Products Vagonic: Missing AuthorizationCVE-2025-32236 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Vagonic Woocommerce Products Reorder Drag Drop Multiple Sort – Sortable, Rearrange Products Vagonic vagonic-sortable.This issue affects Woocommerce Products Reorder Drag Drop Multiple Sort – Sortable, Rearrange Products Vagonic: from n/a through <= 1.9.
- Product
- Woocommerce Products Reorder Drag Drop Multiple Sort – Sortable, Rearrange Products Vagonic
- Affected
- up to 1.9
- What to do
- Affects up to 1.9. Update Woocommerce Products Reorder Drag Drop Multiple Sort – Sortable, Rearrange Products Vagonic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025The Swatchly – WooCommerce Variation Swatches for Products (product attributes: Image swatch, Color swatches, Label swatches) plugin for WordPress is vulnerableCVE-2025-2719 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Swatchly – WooCommerce Variation Swatches for Products (product attributes: Image swatch, Color swatches, Label swatches) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_dismiss function in versions 1.2.8 to 1.4.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to 1/true on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny access to legitimate users or be used to set some values to true, such as registration.
- Affected
- 1.2.8 to 1.4.0
- What to do
- Affects 1.2.8 to 1.4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 9, 2025Smart Product Gallery Slider: Cross-Site Request Forgery (CSRF)CVE-2025-31392 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Shameem Reza Smart Product Gallery Slider smart-product-gallery-slider allows Cross Site Request Forgery.This issue affects Smart Product Gallery Slider: from n/a through <= 1.0.4.
- Product
- Smart Product Gallery Slider
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Smart Product Gallery Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025Woo Product Feed For Marketing Channels: Missing AuthorizationCVE-2025-31377 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Asaquzzaman mishu Woo Product Feed For Marketing Channels woocommerce-to-google-merchant-center allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woo Product Feed For Marketing Channels: from n/a through <= 1.9.0.
- Product
- Woo Product Feed For Marketing Channels
- Affected
- up to 1.9.0
- What to do
- Affects up to 1.9.0. Update Woo Product Feed For Marketing Channels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2025Null pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.CVE-2025-30671 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 6.5
Null pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.
- Product
- Zoom Workplace Apps for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025Null pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.CVE-2025-30670 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 6.5
Null pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.
- Product
- Zoom Workplace Apps for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025Insecure default variable initialization in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a loss of integrity via local accessCVE-2025-27443 · Other software · Zoom Communications, Inc · reported by security@zoom.usLow 2.8
Insecure default variable initialization in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a loss of integrity via local access.
- Product
- Zoom Workplace Apps for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025Cross site scripting in some Zoom Workplace Apps may allow an unauthenticated user to conduct a loss of integrity via adjacent network access.CVE-2025-27442 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 4.6
Cross site scripting in some Zoom Workplace Apps may allow an unauthenticated user to conduct a loss of integrity via adjacent network access.
- Product
- Zoom Workplace Apps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025Cross site scripting in some Zoom Workplace Apps may allow an unauthenticated user to conduct a loss of integrity via adjacent network access.CVE-2025-27441 · Other software · Zoom Communications, Inc · reported by security@zoom.usMedium 4.6
Cross site scripting in some Zoom Workplace Apps may allow an unauthenticated user to conduct a loss of integrity via adjacent network access.
- Product
- Zoom Workplace Apps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025Multiple vulnerabilities exist in the web-based management interface of AOS-10 GW and AOS-8 Controller/Mobility Conductor.CVE-2025-27085 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 4.9
Multiple vulnerabilities exist in the web-based management interface of AOS-10 GW and AOS-8 Controller/Mobility Conductor. Successful exploitation of these vulnerabilities could allow an authenticated, remote attacker to download arbitrary files from the filesystem of an affected device.
- Product
- HPE Aruba Networking AOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025A vulnerability in the Captive Portal of an AOS-10 GW and AOS-8 Controller/Mobility Conductor could allow a remote attacker to conduct a reflected cross-site scCVE-2025-27084 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 5.4
A vulnerability in the Captive Portal of an AOS-10 GW and AOS-8 Controller/Mobility Conductor could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack. Successful exploitation could enable the attacker to execute arbitrary script code in the victim's browser within the context of the affected interface.
- Product
- HPE Aruba Networking AOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025Authenticated command injection vulnerabilities exist in the AOS-10 GW and AOS-8 Controller/Mobility Conductor web-based management interface.CVE-2025-27083 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.2
Authenticated command injection vulnerabilities exist in the AOS-10 GW and AOS-8 Controller/Mobility Conductor web-based management interface. Successful exploitation of these vulnerabilities allows an Authenticated attacker to execute arbitrary commands as a privileged user on the underlying operating system.
- Product
- HPE Aruba Networking AOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025Arbitrary File Write vulnerabilities exist in the web-based management interface of both the AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systemsCVE-2025-27082 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.2
Arbitrary File Write vulnerabilities exist in the web-based management interface of both the AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an Authenticated attacker to upload arbitrary files and execute arbitrary commands on the underlying host operating system.
- Product
- HPE Aruba Networking AOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025During an annual penetration test conducted on behalf of Axis Communications, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowedCVE-2025-0361 · Other software · Axis Communications AB · reported by product-security@axis.comMedium 4.3
During an annual penetration test conducted on behalf of Axis Communications, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowed for unauthenticated username enumeration through the VAPIX Device Configuration SSH Management API.
- Product
- AXIS OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2025Display product variations dropdown on shop page: Missing AuthorizationCVE-2025-32226 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Anzar Ahmed Display product variations dropdown on shop page display-product-variations-dropdown-on-shop-page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Display product variations dropdown on shop page: from n/a through <= 1.1.3.
- Product
- Display product variations dropdown on shop page
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Display product variations dropdown on shop page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Software installed and run as a non-privileged user may conduct improper GPU system calls to cause kernel system memory corruption.CVE-2025-25178 · Other software · Imagination Technologies · reported by 367425dc-4d06-4041-9650-c2dc6aaa27ceHigh 7.8
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause kernel system memory corruption.
- Product
- Graphics DDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2025Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages.CVE-2025-0468 · Other software · Imagination Technologies · reported by 367425dc-4d06-4041-9650-c2dc6aaa27ceHigh 7.1
Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages. Under certain circumstances this exploit could be used to corrupt data pages not allocated by the GPU driver but memory pages in use by the kernel and drivers running on the platform altering their behaviour.
- Product
- Graphics DDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2025Product Filter by WBW: Time-based SQL InjectionCVE-2025-2317 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Product Filter by WBW plugin for WordPress is vulnerable to time-based SQL Injection via the filtersDataBackend parameter in all versions up to, and including, 2.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Product Filter by WBW
- Affected
- up to 2.7.9
- What to do
- Affects up to 2.7.9. Update Product Filter by WBW to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 3, 2025Free Woocommerce Product Table View: Missing AuthorizationCVE-2025-31758 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in BinaryCarpenter Free Woocommerce Product Table View free-product-table-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Free Woocommerce Product Table View: from n/a through <= 1.78.
- Product
- Free Woocommerce Product Table View
- Affected
- up to 1.78
- What to do
- Affects up to 1.78. Update Free Woocommerce Product Table View to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025A vulnerability was found in codeprojects Product Management System 1.0 and classified as problematic.CVE-2025-3148 · Other software · codeprojects · reported by VulDBMedium 4.8
A vulnerability was found in codeprojects Product Management System 1.0 and classified as problematic. This issue affects some unknown processing of the component Login. The manipulation of the argument Str1 leads to buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.
- Product
- Product Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2025This vulnerability involves command injection in tcpdump within Moxa products, enabling an authenticated attacker with console access to exploit improper input CVE-2025-0676 · Other software · Moxa · reported by psirt@moxa.comHigh 8.6
This vulnerability involves command injection in tcpdump within Moxa products, enabling an authenticated attacker with console access to exploit improper input validation to inject and execute systems commands. Successful exploitation could result in privilege escalation, allowing the attacker to gain root shell access and maintain persistent control over the device, potentially disrupting network services and affecting the availability of downstream systems that rely on its connectivity.
- Product
- EDF-G1002-BP Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2025Actionwear products sync: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31619 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in marcoingraiti Actionwear products sync actionwear-products-sync allows SQL Injection.This issue affects Actionwear products sync: from n/a through <= 2.3.3.
- Product
- Actionwear products sync
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update Actionwear products sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Ni WooCommerce Product Enquiry: Missing AuthorizationCVE-2025-31580 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Anzar Ahmed Ni WooCommerce Product Enquiry ni-woocommerce-product-enquiry allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Ni WooCommerce Product Enquiry: from n/a through <= 4.1.8.
- Product
- Ni WooCommerce Product Enquiry
- Affected
- up to 4.1.8
- What to do
- Affects up to 4.1.8. Update Ni WooCommerce Product Enquiry to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Advanced WooCommerce Product Sales Reporting: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31553 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Advanced WooCommerce Product Sales Reporting webd-woocommerce-advanced-reporting-statistics allows SQL Injection.This issue affects Advanced WooCommerce Product Sales Reporting: from n/a through <= 4.1.1.
- Product
- Advanced WooCommerce Product Sales Reporting
- Affected
- up to 4.1.1
- What to do
- Affects up to 4.1.1. Update Advanced WooCommerce Product Sales Reporting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Product Table by WBW: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31086 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WBW Plugins Product Table by WBW woo-product-tables allows Reflected XSS.This issue affects Product Table by WBW: from n/a through <= 2.1.4.
- Product
- Product Table by WBW
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update Product Table by WBW to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce: Missing AuthorizationCVE-2025-30825 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in WPClever WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce wpc-smart-linked-products allows Privilege Escalation.This issue affects WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce: from n/a through <= 1.3.5.
- Product
- WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025In the Linux kernel, the following vulnerability has been resolved: net_sched: Prevent creation of classes with TC_H_ROOT The function qdisc_tree_reduce_backlCVE-2025-21971 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: net_sched: Prevent creation of classes with TC_H_ROOT The function qdisc_tree_reduce_backlog() uses TC_H_ROOT as a termination condition when traversing up the qdisc tree to update parent backlog counters. However, if a class is created with classid TC_H_ROOT, the traversal terminates prematurely at this class instead of reaching the actual root qdisc, causing parent statistics to be incorrectly maintained. In case of DRR, this could lead to a crash as reported by Mingi Cho. Prevent the creation of any Qdisc class with classid TC_H_ROOT (0xFFFFFFFF) across all qdisc types, as suggested by Jamal.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Apr 1, 2025In the Linux kernel, the following vulnerability has been resolved: acpi: typec: ucsi: Introduce a ->poll_cci method For the ACPI backend of UCSI the UCSI "reCVE-2025-21902 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: acpi: typec: ucsi: Introduce a ->poll_cci method For the ACPI backend of UCSI the UCSI "registers" are just a memory copy of the register values in an opregion. The ACPI implementation in the BIOS ensures that the opregion contents are synced to the embedded controller and it ensures that the registers (in particular CCI) are synced back to the opregion on notifications. While there is an ACPI call that syncs the actual registers to the opregion there is rarely a need to do this and on some ACPI implementations it actually breaks in various interesting ways. The only reason to force a sync from the embedded controller is to poll CCI while notifications are disabled. Only the ucsi core knows if this is the case and guessing based on the current command is suboptimal, i.e. leading to the following spurious assertion splat: WARNING: CPU: 3 PID: 76 at drivers/usb/typec/ucsi/ucsi.c:1388 ucsi_reset_ppm+0x1b4/0x1c0 [typec_ucsi] CPU: 3 UID: 0 PID: 76 Comm: kworker/3:0 Not tainted 6.12.11-200.fc41.x86_64 #1 Hardware name: LENOVO 21D0/LNVNB161216, BIOS J6CN45WW 03/17/2023 Workqueue: events_long ucsi_init_work [typec_ucsi
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Apr 1, 2025Bulk Product Sync: Cross-Site Request Forgery (CSRF)CVE-2025-31852 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in N-Media Bulk Product Sync sync-wc-google allows Cross Site Request Forgery.This issue affects Bulk Product Sync: from n/a through <= 8.6.
- Product
- Bulk Product Sync
- Affected
- up to 8.6
- What to do
- Affects up to 8.6. Update Bulk Product Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Product Notices for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-31807 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in CloudRedux Product Notices for WooCommerce product-notices-for-woocommerce allows Cross Site Request Forgery.This issue affects Product Notices for WooCommerce: from n/a through <= 1.3.4.
- Product
- Product Notices for WooCommerce
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update Product Notices for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Ship Per Product: Missing AuthorizationCVE-2025-31773 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in cedcommerce Ship Per Product ship-per-product allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Ship Per Product: from n/a through <= 2.1.0.
- Product
- Ship Per Product
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update Ship Per Product to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Free Woocommerce Product Table View: Missing AuthorizationCVE-2025-31757 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in BinaryCarpenter Free Woocommerce Product Table View free-product-table-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Free Woocommerce Product Table View: from n/a through <= 1.78.
- Product
- Free Woocommerce Product Table View
- Affected
- up to 1.78
- What to do
- Affects up to 1.78. Update Free Woocommerce Product Table View to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025In the Linux kernel, the following vulnerability has been resolved: keys: Fix UAF in key_put() Once a key's reference count has been reduced to 0, the garbageCVE-2025-21893 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: keys: Fix UAF in key_put() Once a key's reference count has been reduced to 0, the garbage collector thread may destroy it at any time and so key_put() is not allowed to touch the key after that point. The most key_put() is normally allowed to do is to touch key_gc_work as that's a static global variable. However, in an effort to speed up the reclamation of quota, this is now done in key_put() once the key's usage is reduced to 0 - but now the code is looking at the key after the deadline, which is forbidden. Fix this by using a flag to indicate that a key can be gc'd now rather than looking at the key's refcount in the garbage collector.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Mar 31, 2025Zulip server provides an open-source team chat that helps teams stay productive and focused.CVE-2025-27149 · Other software · zulip · reported by GitHubMedium 4.6
Zulip server provides an open-source team chat that helps teams stay productive and focused. Prior to 10.0, the data export to organization administrators feature in Zulip leaks private data. The collection of user-agent types identifying specific integrations or HTTP libraries (E.g., ZulipGitlabWebhook, okhttp, or PycURL) that have been used to access any organization on the server was incorrectly included in all three export types, regardless of if they were used to access the exported organization or not. The "public data" and "with consent" exports metadata including the titles of some topics in private channels which the administrator otherwise did not have access to, and none of the users consented to exporting and metadata for which users were in a group DM together. This vulnerability is fixed in 10.0.
- Product
- zulip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025Coverity versions prior to 2024.9.0 are vulnerable to stored cross-site scripting (XSS) in various administrative interfaces.CVE-2024-12021 · Other software · Black Duck · reported by disclosure@synopsys.comHigh 8.5
Coverity versions prior to 2024.9.0 are vulnerable to stored cross-site scripting (XSS) in various administrative interfaces. The impact of exploitation may result in the compromise of local accounts managed by the Coverity platform as well as other standard impacts resulting from cross-site scripting.
- Product
- Coverity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.blackduck.com
Mar 31, 2025JetProductGallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31412 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetProductGallery jet-woo-product-gallery allows DOM-Based XSS.This issue affects JetProductGallery: from n/a through <= 2.1.22.
- Product
- JetProductGallery
- Affected
- up to 2.1.22
- What to do
- Affects up to 2.1.22. Update JetProductGallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2025IBM InfoSphere Information Server 11.7 could disclose sensitive user credentials from log files during new installation of the product.CVE-2024-7577 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.4
IBM InfoSphere Information Server 11.7 could disclose sensitive user credentials from log files during new installation of the product.
- Product
- InfoSphere Information Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2025janryWang products depath v1.0.6 and cool-path v1.1.2 were discovered to contain a prototype pollution via the set() method at setIn (lib/index.js:90).CVE-2024-38985 · Other software · Janrywang · reported by MITRECritical 9.8
janryWang products depath v1.0.6 and cool-path v1.1.2 were discovered to contain a prototype pollution via the set() method at setIn (lib/index.js:90). This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
- Product
- Depath
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Mar 28, 2025Unauthorised access to the call forwarding service system in MeetMe products in versions prior to 2024-09 allows an attacker to identify multiple users and perfCVE-2025-2911 · Other software · Fermax · reported by cve-coordination@incibe.esMedium 5.3
Unauthorised access to the call forwarding service system in MeetMe products in versions prior to 2024-09 allows an attacker to identify multiple users and perform brute force attacks via extensions.
- Product
- MeetMe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2025The exposure of credentials in the call forwarding configuration module in MeetMe products in versions prior to 2024-09 allows an attacker to gain access to somCVE-2025-2908 · Other software · Fermax · reported by cve-coordination@incibe.esHigh 8.5
The exposure of credentials in the call forwarding configuration module in MeetMe products in versions prior to 2024-09 allows an attacker to gain access to some important assets via configuration files.
- Product
- MeetMe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2025Product Table For WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22638 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in acowebs Product Table For WooCommerce product-table-for-woocommerce allows Stored XSS.This issue affects Product Table For WooCommerce: from n/a through <= 1.2.3.
- Product
- Product Table For WooCommerce
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Product Table For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Export Order, Product, Customer & Coupon for WooCommerce to Google Sheets: Missing AuthorizationCVE-2025-22667 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Creative Werk Designs Export Order, Product, Customer & Coupon for WooCommerce to Google Sheets wpsyncsheets-woocommerce.This issue affects Export Order, Product, Customer & Coupon for WooCommerce to Google Sheets: from n/a through <= 1.8.2.
- Product
- Export Order, Product, Customer & Coupon for WooCommerce to Google Sheets
- Affected
- up to 1.8.2
- What to do
- Affects up to 1.8.2. Update Export Order, Product, Customer & Coupon for WooCommerce to Google Sheets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Product Author for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2025-30872 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Nitin Prakash Product Author for WooCommerce wc-product-author allows Cross Site Request Forgery.This issue affects Product Author for WooCommerce: from n/a through <= 1.0.7.
- Product
- Product Author for WooCommerce
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update Product Author for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Terms & Conditions Per Product: Missing AuthorizationCVE-2025-30866 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Giannis Kipouros Terms & Conditions Per Product terms-and-conditions-per-product allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Terms & Conditions Per Product: from n/a through <= 1.2.15.
- Product
- Terms & Conditions Per Product
- Affected
- up to 1.2.15
- What to do
- Affects up to 1.2.15. Update Terms & Conditions Per Product to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025A code execution vulnerability exists in the Xiaomi shop applicationproduct.CVE-2024-45354 · Computers, phones & browsers · Xiaomi · reported by security@xiaomi.comMedium 4.3
A code execution vulnerability exists in the Xiaomi shop applicationproduct. The vulnerability is caused by improper input validation and can be exploited by attackers to execute malicious code.
- Product
- Xiaomi shop application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.