Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Kaspersky Security Blog

Check Point Research

Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Dark Reading

Exploit-DB RSS Feed

The Hacker News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The Related Posts Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

CVE-2025-11926 is a stored Cross-Site Scripting (XSS) vulnerability identified in the Related Posts Lite plugin for WordPress, developed by wpdreams. The vulnerability arises from improper neutralization of input during web page generation (CWE-79), specifically due to insufficient input sanitization and output escaping in the plugin's admin settings interface. This flaw allows authenticated attackers with administrator-level permissions or higher to inject arbitrary JavaScript code into pages managed by the plugin. The malicious scripts are stored persistently and execute whenever any user accesses the infected page, potentially leading to session hijacking, privilege escalation, or defacement. Notably, this vulnerability only affects multi-site WordPress installations or single-site setups where the unfiltered_html capability has been disabled, limiting its scope. The CVSS v3.1 base score is 4.4, indicating medium severity, with the vector reflecting network attack vector, high attack complexity, high privileges required, no user interaction, and a scope change. No public exploits have been reported yet, but the vulnerability's presence in a widely used WordPress plugin necessitates attention. The lack of available patches at the time of publication further increases risk for affected sites. The vulnerability's exploitation requires administrative access, which means initial compromise or insider threat scenarios are prerequisites. However, once exploited, it can undermine the confidentiality and integrity of site data and user sessions.

Detailed information about CVE-2025-11926: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in wpdreams Related Posts

CVE-2025-11926: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in wpdreams Related Posts Lite - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-11926: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in wpdreams Related Posts Lite

The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0. This is due to missing or incorrect nonce validation on the 'theme_editor_theme' page. This makes it possible for unauthenticated attackers to achieve remote code execution via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CVE-2025-9890 is a critical security vulnerability classified as CWE-352 (Cross-Site Request Forgery) found in the mndpsingh287 Theme Editor plugin for WordPress, affecting all versions up to and including 3.0. The vulnerability stems from the plugin's failure to implement proper nonce validation on the 'theme_editor_theme' page, which is intended to protect against unauthorized actions. Nonces in WordPress are security tokens used to verify that requests originate from legitimate users. Without this protection, attackers can craft malicious requests that, when executed by an authenticated site administrator (via social engineering such as clicking a link), allow the attacker to perform unauthorized actions. In this case, the unauthorized action can lead to remote code execution (RCE), enabling the attacker to run arbitrary code on the web server hosting the WordPress site. This can result in full site compromise, data theft, defacement, or use of the server as a pivot point for further attacks. The vulnerability requires no prior authentication (AV:N), has low attack complexity (AC:L), does not require privileges (PR:N), but does require user interaction (UI:R), and affects confidentiality, integrity, and availability (C:H/I:H/A:H). Although no known exploits are currently reported in the wild, the potential impact and ease of exploitation make this a significant threat. The vulnerability was published on October 18, 2025, and is tracked under CVE-2025-9890 with a CVSS v3.1 score of 8.8, indicating high severity. The plugin is widely used in WordPress environments, which are prevalent globally, including Europe. The lack of an official patch link suggests that users should monitor vendor announcements closely and apply updates promptly once available. Until patched, administrators should implement compensating controls such as limiting administrative access, employing web application firewalls (WAFs) with CSRF protections, and educating users about phishing and social engineering risks.

Detailed information about CVE-2025-9890: CWE-352 Cross-Site Request Forgery (CSRF) in mndpsingh287 Theme Editor affecting mndpsingh287 Theme Editor. Get real-t

CVE-2025-9890: CWE-352 Cross-Site Request Forgery (CSRF) in mndpsingh287 Theme Editor - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-9890: CWE-352 Cross-Site Request Forgery (CSRF) in mndpsingh287 Theme Editor

A vulnerability has been found in Nixdorf Wincor PORT IO Driver up to 1.0.0.1. This affects the function sub_11100 in the library wnport.sys of the component IOCTL Handler. Such manipulation leads to stack-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 3.0.0.1 is able to mitigate this issue. Upgrading the affected component is recommended. The vendor was contacted beforehand and was able to provide a patch very early.

CVE-2025-5555 is a stack-based buffer overflow vulnerability identified in the Nixdorf Wincor PORT IO Driver, specifically affecting versions 1.0.0.0 and 1.0.0.1. The vulnerability resides in the IOCTL handler function sub_11100 within the wnport.sys driver library. This flaw allows an attacker with local access and low privileges to manipulate input to the IOCTL interface, causing a stack overflow. The overflow can overwrite critical control data on the stack, potentially enabling arbitrary code execution with elevated privileges or causing system crashes. The vulnerability does not require user interaction or authentication, increasing its risk profile in environments where local access is possible. The vendor was notified early and has released a patch in version 3.0.0.1 to address the issue. The CVSS 4.0 base score is 8.5, reflecting high impact on confidentiality, integrity, and availability, with low attack complexity and no need for user interaction. Although no known exploits are currently active in the wild, the public disclosure increases the risk of exploitation attempts. The affected driver is commonly used in Nixdorf Wincor hardware, which is prevalent in banking and retail sectors, especially in Europe. The vulnerability's exploitation could lead to privilege escalation, data theft, or denial of service, posing significant risks to critical infrastructure and sensitive data.

Detailed information about CVE-2025-5555: Stack-based Buffer Overflow in Nixdorf Wincor PORT IO Driver affecting Nixdorf Wincor PORT IO Driver. Get real-time up

CVE-2025-5555: Stack-based Buffer Overflow in Nixdorf Wincor PORT IO Driver - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-5555: Stack-based Buffer Overflow in Nixdorf Wincor PORT IO Driver

The PowerBI Embed Reports plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 1.2.0. This is due to missing capability checks and authentication verification on the 'testUser' endpoint accessible via the mo_epbr_admin_observer() function hooked on 'init'. This makes it possible for unauthenticated attackers to access sensitive Azure AD user information including personal identifiable information (PII) such as displayName, mail, phones, department, or detailed OAuth error data including Azure AD Application/Client IDs, error codes, trace IDs, and correlation IDs.

CVE-2025-10750 identifies a sensitive information disclosure vulnerability in the PowerBI Embed Reports plugin for WordPress, maintained by cyberlord92. The vulnerability exists in all versions up to and including 1.2.0 and stems from the absence of proper capability checks and authentication verification on the 'testUser' endpoint. This endpoint is accessible via the mo_epbr_admin_observer() function, which is hooked into WordPress's 'init' action, allowing it to be triggered early in the request lifecycle without requiring user authentication. As a result, unauthenticated attackers can query this endpoint and retrieve sensitive Azure Active Directory (Azure AD) user information. The data exposed includes personally identifiable information (PII) such as displayName, email addresses, phone numbers, department names, and detailed OAuth error information including Azure AD Application/Client IDs, error codes, trace IDs, and correlation IDs. These details can be leveraged for further attacks, including social engineering, targeted phishing, or lateral movement within an organization's network. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The CVSS v3.1 base score is 5.3, indicating a medium severity with an attack vector of network (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and impact limited to confidentiality (C:L) without affecting integrity or availability. No patches or fixes are currently linked, and no known exploits have been reported in the wild. The vulnerability highlights a critical security oversight in access control implementation within the plugin's codebase.

Detailed information about CVE-2025-10750: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in cyberlord92 PowerBI Embed Reports affecting cyb

CVE-2025-10750: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in cyberlord92 PowerBI Embed Reports - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-10750: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in cyberlord92 PowerBI Embed Reports

The Kognetiks Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 2.3.5. This makes it possible for unauthenticated attackers to upload limited safe files and erase conversations.

The vulnerability identified as CVE-2025-11256 affects the Kognetiks Chatbot plugin for WordPress, versions up to and including 2.3.5. It stems from improper authorization (CWE-285) due to missing capability checks on multiple plugin functions. This flaw enables unauthenticated attackers to perform unauthorized actions, specifically uploading limited safe files and deleting chatbot conversation data. The attack vector is network-based, requiring no privileges or user interaction, which increases the risk of exploitation. However, the impact is limited to integrity, as confidentiality and availability are not affected. The vulnerability does not currently have publicly available patches, and no known exploits have been reported in the wild. The plugin’s role in managing chatbot conversations means that attackers could manipulate or erase user interaction data, potentially disrupting business processes or customer service records. The lack of authentication checks indicates a design oversight in access control implementation within the plugin. Organizations using this plugin should be aware of the risk of data tampering and take proactive measures to monitor and restrict unauthorized access. The CVSS 3.1 base score of 5.3 reflects a medium severity level, balancing the ease of exploitation with the limited scope of impact. Given the widespread use of WordPress and chatbot plugins in Europe, this vulnerability could affect many sites if left unmitigated.

Detailed information about CVE-2025-11256: CWE-285 Improper Authorization in kognetiks Kognetiks Chatbot affecting kognetiks Kognetiks Chatbot. Get real-time up

Geographic Threat Map

Global Threat Distribution

Threat Levels

Recent Threats

CVE-2025-11926: CWE-79 Improper Neutralization of Input Duri...

CVE-2025-9890: CWE-352 Cross-Site Request Forgery (CSRF) in ...

CVE-2025-5555: Stack-based Buffer Overflow in Nixdorf Wincor...

CVE-2025-10750: CWE-200 Exposure of Sensitive Information to...

CVE-2025-11256: CWE-285 Improper Authorization in kognetiks ...

Country Risk Levels

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility