Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,383 results · page 21 of 68
May 16, 2025Radio Player Shoutcast & Icecast: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32306 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Radio Player Shoutcast & Icecast WordPress Plugin audio4-html5 allows Blind SQL Injection.This issue affects Radio Player Shoutcast & Icecast WordPress Plugin: from n/a through <= 4.4.6.
- Product
- Radio Player Shoutcast & Icecast
- Affected
- up to 4.4.6
- What to do
- Affects up to 4.4.6. Update Radio Player Shoutcast & Icecast to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025Responsive HTML5 Audio Player PRO With Playlist: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-32287 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Responsive HTML5 Audio Player PRO With Playlist lbg-audio2-html5 allows SQL Injection.This issue affects Responsive HTML5 Audio Player PRO With Playlist: from n/a through <= 3.5.7.
- Product
- Responsive HTML5 Audio Player PRO With Playlist
- Affected
- up to 3.5.7
- What to do
- Affects up to 3.5.7. Update Responsive HTML5 Audio Player PRO With Playlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025Multimedia Responsive Carousel with Image Video Audio Support: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31928 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Multimedia Responsive Carousel with Image Video Audio Support multimedia-carousel allows SQL Injection.This issue affects Multimedia Responsive Carousel with Image Video Audio Support: from n/a through <= 2.6.0.
- Product
- Multimedia Responsive Carousel with Image Video Audio Support
- Affected
- up to 2.6.0
- What to do
- Affects up to 2.6.0. Update Multimedia Responsive Carousel with Image Video Audio Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025Sticky Radio Player: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31926 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Sticky Radio Player lbg-audio5-html5-shoutcast_sticky allows SQL Injection.This issue affects Sticky Radio Player: from n/a through <= 3.4.
- Product
- Sticky Radio Player
- Affected
- up to 3.4
- What to do
- Affects up to 3.4. Update Sticky Radio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025CSS3 Accordions for: Missing AuthorizationCVE-2025-31923 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in QuanticaLabs CSS3 Accordions for WordPress css3_accordions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CSS3 Accordions for WordPress: from n/a through <= 3.0.
- Product
- CSS3 Accordions for
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update CSS3 Accordions for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025CSS3 Accordions for: Cross-Site Request Forgery (CSRF)CVE-2025-31922 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in QuanticaLabs CSS3 Accordions for WordPress css3_accordions allows Stored XSS.This issue affects CSS3 Accordions for WordPress: from n/a through <= 3.0.
- Product
- CSS3 Accordions for
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update CSS3 Accordions for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2025MapFig Studio: Does not have CSRF check in some placesCVE-2024-6712 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MapFig Studio WordPress plugin through 0.2.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- MapFig Studio
- Affected
- up to 0.2.1
- What to do
- Affects up to 0.2.1. Update MapFig Studio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 14, 2025Label Studio is a multi-type data labeling and annotation tool.CVE-2025-47783 · Other software · HumanSignal · reported by GitHubHigh 7.6
Label Studio is a multi-type data labeling and annotation tool. A vulnerability in versions prior to 1.18.0 allows an attacker to inject a malicious script into the context of a web page, which can lead to data theft, session hijacking, unauthorized actions on behalf of the user, and other attacks. The vulnerability is reproducible when sending a properly formatted request to the `POST /projects/upload-example/` endpoint. In the source code, the vulnerability is located at `label_studio/projects/views.py`. Version 1.18.0 contains a patch for the issue.
- Product
- label-studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2025Samsung Galaxy Buds and Galaxy Buds 2 audio devices are Bluetooth pairable by default without user input nor a way to stop this mode.CVE-2024-58101 · Other software · reported by MITREHigh 8.1
Samsung Galaxy Buds and Galaxy Buds 2 audio devices are Bluetooth pairable by default without user input nor a way to stop this mode. As a consequence, audio playback takeover or even microphone recording without user consent or notification is achieved. Note: This is considered a low severity vulnerability by the vendor.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a networkCVE-2025-26646 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8
External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network.
- Product
- .NET 8.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025Insufficient granularity of access control in Visual Studio allows an authorized attacker to disclose information locally.CVE-2025-32703 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Insufficient granularity of access control in Visual Studio allows an authorized attacker to disclose information locally.
- Product
- Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an unauthorized attacker to execute code locally.CVE-2025-32702 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an unauthorized attacker to execute code locally.
- Product
- Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025Improper limitation of a pathname to a restricted directory ('path traversal') in Azure allows an unauthorized attacker to elevate privileges over a network.CVE-2025-30387 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure allows an unauthorized attacker to elevate privileges over a network.
- Product
- Azure AI Document Intelligence Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2025Files or directories accessible to external parties in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.CVE-2025-21264 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.1
Files or directories accessible to external parties in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
- Product
- Microsoft Visual Studio Code CoPilot Chat Extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2025A vulnerability has been found in Gosuncn Technology Group Audio-Visual Integrated Management Platform 1.0 and classified as critical.CVE-2025-4536 · Other software · Gosuncn Technology Group · reported by VulDBMedium 6.9
A vulnerability has been found in Gosuncn Technology Group Audio-Visual Integrated Management Platform 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /sysmgr/user/listByPage. The manipulation leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Audio-Visual Integrated Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2025A vulnerability, which was classified as problematic, was found in Gosuncn Technology Group Audio-Visual Integrated Management Platform 4.0.CVE-2025-4535 · Other software · Gosuncn Technology Group · reported by VulDBMedium 6.9
A vulnerability, which was classified as problematic, was found in Gosuncn Technology Group Audio-Visual Integrated Management Platform 4.0. Affected is an unknown function of the file /config/config.properties of the component Configuration File Handler. The manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Audio-Visual Integrated Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2025In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition In btsdioCVE-2023-53145 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition In btsdio_probe, the data->work is bound with btsdio_work. It will be started in btsdio_send_frame. If the btsdio_remove runs with a unfinished work, there may be a race condition that hdev is freed but used in btsdio_work. Fix it by canceling the work before do cleanup in btsdio_remove.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 7, 2025Contentstudio: Missing AuthorizationCVE-2025-47692 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in contentstudio Contentstudio contentstudio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contentstudio: from n/a through <= 1.3.5.
- Product
- Contentstudio
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update Contentstudio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025Quran multilanguage Text & Audio: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-47524 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in karim42 Quran multilanguage Text & Audio quran-text-multilanguage allows Stored XSS.This issue affects Quran multilanguage Text & Audio: from n/a through <= 2.3.23.
- Product
- Quran multilanguage Text & Audio
- Affected
- up to 2.3.23
- What to do
- Affects up to 2.3.23. Update Quran multilanguage Text & Audio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 6, 2025Use after free in WebAudio in Google Chrome prior to 136.0.7103.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.CVE-2025-4372 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Use after free in WebAudio in Google Chrome prior to 136.0.7103.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
May 6, 2025Memory corruption while sound model registration for voice activation with audio kernel driver.CVE-2024-45581 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.6
Memory corruption while sound model registration for voice activation with audio kernel driver.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025The AWS Amplify Studio UI component property expressions in the aws-amplify/amplify-codegen-ui package lack input validation.CVE-2025-4318 · Other software · Amazon · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5Critical 9
The AWS Amplify Studio UI component property expressions in the aws-amplify/amplify-codegen-ui package lack input validation. This could potentially allow an authenticated user who has access to create or modify components to run arbitrary JavaScript code during the component rendering and build process.
- Product
- Amplify Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
May 2, 2025In the Linux kernel, the following vulnerability has been resolved: usb: gadget: u_audio: don't let userspace block driver unbind In the unbind callback for fCVE-2023-53045 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: u_audio: don't let userspace block driver unbind In the unbind callback for f_uac1 and f_uac2, a call to snd_card_free() via g_audio_cleanup() will disconnect the card and then wait for all resources to be released, which happens when the refcount falls to zero. Since userspace can keep the refcount incremented by not closing the relevant file descriptor, the call to unbind may block indefinitely. This can cause a deadlock during reboot, as evidenced by the following blocked task observed on my machine: task:reboot state:D stack:0 pid:2827 ppid:569 flags:0x0000000c Call trace: __switch_to+0xc8/0x140 __schedule+0x2f0/0x7c0 schedule+0x60/0xd0 schedule_timeout+0x180/0x1d4 wait_for_completion+0x78/0x180 snd_card_free+0x90/0xa0 g_audio_cleanup+0x2c/0x64 afunc_unbind+0x28/0x60 ... kernel_restart+0x4c/0xac __do_sys_reboot+0xcc/0x1ec __arm64_sys_reboot+0x28/0x30 invoke_syscall+0x4c/0x110 ... The issue can also be observed by opening the card with arecord and then stopping the process through the shell before unbinding: # arecord -D hw:UAC2Gadget -f S3
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 2, 2025Digigram's PYKO-OUT audio-over-IP (AoIP) web-server does not require a password by default, allowing any attacker with the target IP address to connect and compCVE-2025-3927 · Other software · Digigram · reported by cret@cert.orgCritical 9.8
Digigram's PYKO-OUT audio-over-IP (AoIP) web-server does not require a password by default, allowing any attacker with the target IP address to connect and compromise the device, potentially pivoting to connected network or hardware devices.
- Product
- PYKO-OUT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddigigram.comkb.cert.org
May 1, 2025In the Linux kernel, the following vulnerability has been resolved: net: mdio: fix undefined behavior in bit shift for __mdiobus_register Shifting signed 32-bCVE-2022-49907 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: net: mdio: fix undefined behavior in bit shift for __mdiobus_register Shifting signed 32-bit value by 31 bits is undefined, so changing significant bit to unsigned. The UBSAN warning calltrace like below: UBSAN: shift-out-of-bounds in drivers/net/phy/mdio_bus.c:586:27 left shift of 1 by 31 places cannot be represented in type 'int' Call Trace: <TASK> dump_stack_lvl+0x7d/0xa5 dump_stack+0x15/0x1b ubsan_epilogue+0xe/0x4e __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c __mdiobus_register+0x49d/0x4e0 fixed_mdio_bus_init+0xd8/0x12d do_one_initcall+0x76/0x430 kernel_init_freeable+0x3b3/0x422 kernel_init+0x24/0x1e0 ret_from_fork+0x1f/0x30 </TASK>
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 1, 2025In the Linux kernel, the following vulnerability has been resolved: scsi: zfcp: Fix double free of FSF request when qdio send fails We used to use the wrong tCVE-2022-49789 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7
In the Linux kernel, the following vulnerability has been resolved: scsi: zfcp: Fix double free of FSF request when qdio send fails We used to use the wrong type of integer in 'zfcp_fsf_req_send()' to cache the FSF request ID when sending a new FSF request. This is used in case the sending fails and we need to remove the request from our internal hash table again (so we don't keep an invalid reference and use it when we free the request again). In 'zfcp_fsf_req_send()' we used to cache the ID as 'int' (signed and 32 bit wide), but the rest of the zfcp code (and the firmware specification) handles the ID as 'unsigned long'/'u64' (unsigned and 64 bit wide [s390x ELF ABI]). For one this has the obvious problem that when the ID grows past 32 bit (this can happen reasonably fast) it is truncated to 32 bit when storing it in the cache variable and so doesn't match the original ID anymore. The second less obvious problem is that even when the original ID has not yet grown past 32 bit, as soon as the 32nd bit is set in the original ID (0x80000000 = 2'147'483'648) we will have a mismatch when we cast it back to 'unsigned long'. As the cached variable is of a signed type, the compiler w
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 1, 2025In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open() snd_usbmidi_output_open(CVE-2022-49772 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open() snd_usbmidi_output_open() has a check of the NULL port with snd_BUG_ON(). snd_BUG_ON() was used as this shouldn't have happened, but in reality, the NULL port may be seen when the device gives an invalid endpoint setup at the descriptor, hence the driver skips the allocation. That is, the check itself is valid and snd_BUG_ON() should be dropped from there. Otherwise it's confusing as if it were a real bug, as recently syzbot stumbled on it.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Apr 30, 2025A buffer overflow was addressed with improved input validation.CVE-2025-30422 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.5
A buffer overflow was addressed with improved input validation. This issue is fixed in AirPlay audio SDK 2.7.1 and AirPlay video SDK 3.6.0.126. An attacker on the local network may cause an unexpected app termination.
- Product
- AirPlay audio SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2025The issue was addressed with improved memory handling.CVE-2025-24132 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.5
The issue was addressed with improved memory handling. This issue is fixed in AirPlay audio SDK 2.7.1 and AirPlay video SDK 3.6.0.126. An attacker on the local network may cause an unexpected app termination.
- Product
- AirPlay audio SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2025Audiobookshelf is a self-hosted audiobook and podcast server.CVE-2025-46338 · Other software · advplyr · reported by GitHubMedium 6.9
Audiobookshelf is a self-hosted audiobook and podcast server. Prior to version 2.21.0, an improper input handling vulnerability in the `/api/upload` endpoint allows an attacker to perform a reflected cross-site scripting (XSS) attack by submitting malicious payloads in the `libraryId` field. The unsanitized input is reflected in the server’s error message, enabling arbitrary JavaScript execution in a victim's browser. This issue has been patched in version 2.21.0.
- Product
- audiobookshelf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2025Advanced Accordion Gutenberg Block: Stored Cross-Site ScriptingCVE-2025-2543 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Advanced Accordion Gutenberg Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 5.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
- Product
- Advanced Accordion Gutenberg Block
- Affected
- up to 5.0.2
- What to do
- Affects up to 5.0.2. Update Advanced Accordion Gutenberg Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 19, 2025CLEVER - HTML5 Radio Player With History - Shoutcast and Icecast - Elementor Widget Addon: Arbitrary file readCVE-2025-3103 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The CLEVER - HTML5 Radio Player With History - Shoutcast and Icecast - Elementor Widget Addon plugin for WordPress is vulnerable to arbitrary file read due to insufficient file path validation in the 'history.php' file in all versions up to, and including, 2.4. This makes it possible for unauthenticated attackers to read arbitrary files on the affected site's server, which may contain sensitive information including database credentials. The vulnerability was partially patched in version 2.4.
- Product
- CLEVER - HTML5 Radio Player With History - Shoutcast and Icecast - Elementor Widget Addon
- Affected
- up to 2.4
- What to do
- Affects up to 2.4. Update CLEVER - HTML5 Radio Player With History - Shoutcast and Icecast - Elementor Widget Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Apr 18, 2025LA-Studio Element Kit for Elementor: Stored Cross-Site ScriptingCVE-2025-3106 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Table of Contents widget in all versions up to, and including, 1.4.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- LA-Studio Element Kit for Elementor
- Affected
- up to 1.4.9
- What to do
- Affects up to 1.4.9. Update LA-Studio Element Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 17, 2025Pydio Core <= 8.2.5 is vulnerable to Cross Site Scripting (XSS) via the New URL Bookmark feature.CVE-2024-40124 · Other software · Pydio · reported by MITREMedium 5.4
Pydio Core <= 8.2.5 is vulnerable to Cross Site Scripting (XSS) via the New URL Bookmark feature.
- Product
- Pydio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.compydio.com
Apr 17, 2025A stored cross-site scripting (XSS) vulnerability exists with radio button type custom fields in Liferay Portal 7.2.0 through 7.4.3.129, and Liferay DXP 2024.Q4CVE-2025-3760 · Other software · Liferay · reported by security@liferay.comMedium 4.8
A stored cross-site scripting (XSS) vulnerability exists with radio button type custom fields in Liferay Portal 7.2.0 through 7.4.3.129, and Liferay DXP 2024.Q4.1 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.9, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, 7.3 GA through update 36, and 7.2 GA through fix pack 20 allows remote authenticated attackers to inject malicious JavaScript into a page.
- Product
- Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2025In the Linux kernel, the following vulnerability has been resolved: drm: xlnx: zynqmp_dpsub: Add NULL check in zynqmp_audio_init devm_kasprintf() calls can reCVE-2025-22099 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: drm: xlnx: zynqmp_dpsub: Add NULL check in zynqmp_audio_init devm_kasprintf() calls can return null pointers on failure. But some return values were not checked in zynqmp_audio_init(). Add NULL check in zynqmp_audio_init(), avoid referencing null pointers in the subsequent code.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Apr 16, 2025Html5 Audio Player: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-39524 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in bPlugins Html5 Audio Player html5-audio-player allows Stored XSS.This issue affects Html5 Audio Player: from n/a through <= 2.2.28.
- Product
- Html5 Audio Player
- Affected
- up to 2.2.28
- What to do
- Affects up to 2.2.28. Update Html5 Audio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2025Improper access control in Visual Studio Code allows an authorized attacker to elevate privileges locally.CVE-2025-32726 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.8
Improper access control in Visual Studio Code allows an authorized attacker to elevate privileges locally.
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2025Uncontrolled search path element in Visual Studio Tools for Applications and SQL Server Management Studio allows an authorized attacker to elevate privileges loCVE-2025-29803 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.3
Uncontrolled search path element in Visual Studio Tools for Applications and SQL Server Management Studio allows an authorized attacker to elevate privileges locally.
- Product
- SQL Server Management Studio 20.2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2025Accordion: Deserialization of Untrusted DataCVE-2025-32143 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in PickPlugins Accordion accordions allows Object Injection.This issue affects Accordion: from n/a through <= 2.3.11.
- Product
- Accordion
- Affected
- up to 2.3.11
- What to do
- Affects up to 2.3.11. Update Accordion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025Codescar Radio Widget: Cross-Site Request Forgery (CSRF)CVE-2025-32500 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Sudavar Codescar Radio Widget codescar-radio-widget allows Stored XSS.This issue affects Codescar Radio Widget: from n/a through <= 0.4.2.
- Product
- Codescar Radio Widget
- Affected
- up to 0.4.2
- What to do
- Affects up to 0.4.2. Update Codescar Radio Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025WS Audio Player: Cross-Site Request Forgery (CSRF)CVE-2025-31400 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in icyleaf WS Audio Player ws-audio-player allows Stored XSS.This issue affects WS Audio Player: from n/a through <= 1.1.8.
- Product
- WS Audio Player
- Affected
- up to 1.1.8
- What to do
- Affects up to 1.1.8. Update WS Audio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could potentially lead to unauthorized access which could result in thCVE-2025-2442 · Other software · Schneider Electric · reported by cybersecurity@se.comMedium 5.4
CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could potentially lead to unauthorized access which could result in the loss of confidentially, integrity and availability when a malicious user, having physical access, sets the radio to the factory default mode.
- Product
- Trio Q Licensed Data Radio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Apr 9, 2025CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could lead to loss of confidentiality when a malicious user, having phCVE-2025-2441 · Other software · Schneider Electric · reported by cybersecurity@se.comMedium 4.1
CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could lead to loss of confidentiality when a malicious user, having physical access, sets the radio in factory default mode where the product does not correctly initialize all data.
- Product
- Trio Q Licensed Data Radio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Apr 9, 2025CWE-922: Insecure Storage of Sensitive Information vulnerability exists that could potentially lead to unauthorized access of confidential data when a maliciousCVE-2025-2440 · Other software · Schneider Electric · reported by cybersecurity@se.comMedium 4.1
CWE-922: Insecure Storage of Sensitive Information vulnerability exists that could potentially lead to unauthorized access of confidential data when a malicious user, having physical access and advanced information on the file system, sets the radio in factory default mode.
- Product
- Trio Q Licensed Data Radio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Apr 8, 2025Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally.CVE-2025-29804 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.3
Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally.
- Product
- Microsoft Visual Studio 2022 version 17.10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally.CVE-2025-29802 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.3
Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally.
- Product
- Microsoft Visual Studio 2022 version 17.10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025ZoomSounds - WordPress Wave Audio Player with Playlist: Arbitrary File ReadCVE-2025-3431 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 6.91 via the 'dzsap_download' action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- ZoomSounds - WordPress Wave Audio Player with Playlist
- Affected
- up to 6.91
- What to do
- Affects up to 6.91. Update ZoomSounds - WordPress Wave Audio Player with Playlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Apr 8, 2025Out-of-bounds read in parsing audio data in libsavsac.so prior to SMR Apr-2025 Release 1 allows local attackers to read out-of-bounds memory.CVE-2025-20944 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.2
Out-of-bounds read in parsing audio data in libsavsac.so prior to SMR Apr-2025 Release 1 allows local attackers to read out-of-bounds memory.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Apr 5, 2025ZoomSounds - WordPress Wave Audio Player with Playlist: Unauthorized modification of data that can lead to a denial of serviceCVE-2024-13776 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'dzsap_delete_notice' AJAX action in all versions up to, and including, 6.91. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to 'seen' on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values to true such as registration. There are several other functions also vulnerable to missing authorization.
- Product
- ZoomSounds - WordPress Wave Audio Player with Playlist
- Affected
- up to 6.91
- What to do
- Affects up to 6.91. Update ZoomSounds - WordPress Wave Audio Player with Playlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.