WordPress Video.js HLS Player plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by theviper17 in WordPress Plugin Video.js HLS Player versions = 1.0.2...

WordPress Table of Contents Block plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Peter Thaleikis in WordPress Plugin Table of Contents Block versions = 1.0.2...

WordPress Archive Page plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by muhammad yudha in WordPress Plugin Archive Page versions = 1.0.2...

CVE-2025-27325

CVE-2025-27325 concerns the Video.js HLS Player WordPress plugin (Video.js HLS Player) with DOM-based XSS due to improper input neutralization. Affected versions are from n/a through 1.0.2. The CVSS 3.1 base score is 6.5 (Network, Low Privileges, User Interaction Required, Scope Changed; Confiden...

CVE-2025-27305 WordPress Table of Contents Block plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Achal Jain Table of Contents Block table-of-contents allows Stored XSS.This issue affects Table of Contents Block: from n/a through = 1.0.2...

LB-LINK AC1900 命令注入漏洞

The LB-LINK AC1900 is a wireless router from China Bilink LB-LINK. A command injection vulnerability exists in the LB-LINK AC1900 version 1.0.2, which originates from the file /goform/parameter cmd that can lead to operating system command injection...

PT-2025-7735 · Unknown · Achal Jain Table Of Contents Block

Name of the Vulnerable Software and Affected Versions: Achal Jain Table of Contents Block versions 1.0.2 and earlier Description: The issue is related to improper neutralization of input during web page generation, which leads to a Cross-site Scripting XSS vulnerability. Specifically, it is a...

WordPress plugin Video.js HLS Player 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerabili...

PT-2025-7747 · Unknown · Video.Js Hls Player

Name of the Vulnerable Software and Affected Versions: Video.js HLS Player versions 1.0.2 and earlier Description: The issue is related to improper neutralization of input during web page generation, which leads to a Cross-site Scripting XSS vulnerability. Specifically, it is a DOM-Based XSS...

LB-LINK AC1900 命令注入漏洞

LB-LINK AC1900 is a wireless router from China Bilink LB-LINK. A command injection vulnerability exists in the LB-LINK AC1900 version 1.0.2, which originates from the parameter mac/enable in the file /goform/setblacklist that can lead to OS command injection...

WordPress plugin Table of Contents Block 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in PHP. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in WordPress plugin Table o...

Malicious code in main-branch-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8be08fa3cd592a6d15f6524eac04c1935a0fa11215c4143121b34e3a0de18e15 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress Simple catalogue plugin <= 1.0.2 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Hassan Khan Yusufzai - Splint3r7 in WordPress Plugin Simple catalogue versions = 1.0.2...

CVE-2025-25152

CVE-2025-25152 describes a CSRF to Stored XSS vulnerability in WordPress plugin Smart DoFollow (affected versions from n/a through 1.0.2). Base CVSS v3.1 score 7.1 ( HIGH ) with network attack vector, user interaction required. Root cause is CSRF enabling stored XSS. Connected documents indicate ...

PT-2025-5960 · Lukaszwiecek · Smart Dofollow

Name of the Vulnerable Software and Affected Versions: LukaszWiecek Smart DoFollow versions 1.0.2 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

WordPress plugin Smart DoFollow 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

CVE-2025-22764

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in vipul Jariwala WP Post Corrector wp-post-corrector allows Reflected XSS.This issue affects WP Post Corrector: from n/a through = 1.0.2...

CVE-2024-32810

Missing Authorization vulnerability in ShortPixel ShortPixel Critical CSS.This issue affects ShortPixel Critical CSS: from n/a through 1.0.2...

CVE-2024-50490

Missing Authorization vulnerability in lowcage PegaPoll pegapoll allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects PegaPoll: from n/a through = 1.0.2...

CVE-2024-49327

Unrestricted Upload of File with Dangerous Type vulnerability in bepitulaz Woostagram Connect woostagram-connect allows Upload a Web Shell to a Web Server.This issue affects Woostagram Connect: from n/a through = 1.0.2...