CVE Vulnerability Catalog

CVE-2025-60229 is a vulnerability related to the deserialization of untrusted data in Themeton Lagom, allowing for object injection. This issue affects Lagom versions from n/a through 2.0.

There is an unauthenticated SQL injection vulnerability in Advanced Ads – Tracking versions below 3.0.7.

There is an unauthenticated SQL Injection vulnerability in WP eMember versions below 10.9.4.

There is an unauthenticated privilege escalation vulnerability in the registration form for WooCommerce versions <= 1.0.9.

The WP Activity Log plugin versions up to 5.6.3.1 are vulnerable to unauthenticated PHP object injection.

Versions of SMS Alert Order Notifications up to 3.9.4 contain a vulnerability that allows subscriber privilege escalation.

Fusion Builder versions up to 3.15.4 are vulnerable to PHP Object Injection, which may lead to unauthorized access or data manipulation.

There is an unauthenticated SQL injection vulnerability in JetEngine versions <= 3.8.10.1.

In JobSearch versions up to 3.2.9, there is an unauthenticated SQL Injection vulnerability that can be exploited by an attacker to execute unauthorized queries against the database.

There is an unauthenticated PHP object injection vulnerability in JetEngine versions up to 3.8.10.

SigmaForms Pro – AI Generated Forms versions up to 1.4.5 contain a vulnerability allowing unauthenticated arbitrary file uploads.

A path traversal vulnerability in the SFTP provider allows a malicious or compromised remote SFTP server to write files outside the configured local destination directory. No Airflow account is required, and the attack surface includes any deployment downloading directories from an untrusted SFTP server.

There is a vulnerability in wpForo Forum versions up to 3.1.0 related to unauthenticated broken authentication.

Thrive Apprentice versions below 10.8.10.2 are vulnerable to unauthenticated PHP object injection.

JetEngine versions below 3.8.9.1 are vulnerable to unauthenticated SQL injection.

There is an unauthenticated SQL injection vulnerability in wpDataTables versions up to 7.3.6.

JetSearch versions up to 3.5.17 are vulnerable to unauthenticated SQL injection, potentially allowing unauthorized access to data.

The Crocoblock JetEngine plugin for WordPress up to version 3.8.9.1 contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This allows an attacker to perform Blind SQL Injection.

JetEngine versions up to 3.8.9.1 are vulnerable to PHP Object Injection, which may lead to unauthorized access to data.

LoginPress Pro versions up to 6.2.2 contain a vulnerability allowing unauthenticated privilege escalation.