CVE-2025-41053 Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataAddonlayouts' and 'dataAddonlayoutsexcept' parameters in /apprain/developer/addons/update/commonresource...

CVE-2025-41052

CVE-2025-41052 affects appRain CMF 4.0.5. A stored authenticated XSS exists due to insufficient validation of user input in the /apprain/developer/addons/update/canvasjs endpoint, triggered via data[Addon][layouts] and data[Addon][layouts_except]. Consequences described include cookie-based crede...

CVE-2025-41051 Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataAddonlayouts' and 'dataAddonlayoutsexcept' parameters in /apprain/developer/addons/update/bootstrap...

CVE-2025-41049 Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataAddonlayouts' and 'dataAddonlayoutsexcept' parameters in /apprain/developer/addons/update/appform...

CVE-2025-41049 Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataAddonlayouts' and 'dataAddonlayoutsexcept' parameters in /apprain/developer/addons/update/appform...

CVE-2025-41048 Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataAddonlayouts' and 'dataAddonlayoutsexcept' parameters in /apprain/developer/addons/update/admin...

CVE-2025-41048

CVE-2025-41048 affects appRain CMF v4.0.5. A stored authenticated XSS exists due to insufficient validation of input in the parameters data[Addon][layouts] and data[Addon][layouts_except] at /apprain/developer/addons/update/admin. Reported details consistently identify the vulnerability as stored...

CVE-2025-41048 Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataAddonlayouts' and 'dataAddonlayoutsexcept' parameters in /apprain/developer/addons/update/admin...

CVE-2025-41047

CVE-2025-41047 affects appRain CMF 4.0.5 and is a stored authenticated XSS caused by insufficient validation of input in the /apprain/developer/addons/update/ace endpoint, specifically data[Addon][layouts] and data[Addon][layouts_except]. Multiple connected records corroborate the vulnerability a...

CVE-2025-41046 Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataAddonlayouts' and 'dataAddonlayoutsexcept' parameters in /apprain/developer/addons/update/960grid...

CVE-2025-41046

CVE-2025-41046 : Multiple sources confirm a stored authenticated XSS in appRain CMF 4.0.5 via improper validation on input data[Addon][layouts] and data[Addon][layouts_except] at /apprain/developer/addons/update/960grid. Impact described across CNVD/NVD/RH/SNYK variants includes potential cookie-...

PT-2025-35923

Name of the Vulnerable Software and Affected Versions: appRain CMF version 4.0.5 Description: A stored authenticated Cross-Site Scripting XSS issue exists due to insufficient validation of user-supplied data. The vulnerability is triggered through the dataAddonlayouts and dataAddonlayouts except...

PT-2025-35921

Name of the Vulnerable Software and Affected Versions: appRain CMF version 4.0.5 Description: A stored authenticated cross-site scripting XSS issue exists due to insufficient validation of user-supplied data. The vulnerability is triggered through the dataAddonlayouts and dataAddonlayouts except...

PT-2025-35917

Name of the Vulnerable Software and Affected Versions: appRain CMF version 4.0.5 Description: A stored authenticated Cross-Site Scripting XSS issue exists due to insufficient validation of user-supplied data. The vulnerability is triggered through the dataAddonlayouts and dataAddonlayouts except...

WordPress Events Addon for Elementor plugin cross-site scripting vulnerability

WordPress Events Addon for Elementor plugin is a plugin designed for Elementor page builder, mainly for creating event websites. The WordPress Events Addon for Elementor plugin suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and...

CVE-2025-8150

The Events Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Typewriter and Countdown widgets in all versions up to, and including, 2.2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2025-8150

The Events Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Typewriter and Countdown widgets in all versions up to, and including, 2.2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2025-8150

The CVE concerns the WordPress plugin “Events Addon for Elementor.” Affected component: Typewriter and Countdown widgets. Root cause: insufficient input sanitization and output escaping of user-supplied attributes, enabling Stored Cross-Site Scripting. Affected versions: all up to and including 2...

WordPress plugin Events Addon for Elementor 跨站脚本漏洞

WordPress Events Addon for Elementor plugin is a plugin designed for Elementor page builder, mainly for creating event websites. The WordPress Events Addon for Elementor plugin suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and...

PT-2025-35194

Name of the Vulnerable Software and Affected Versions: Events Addon for Elementor plugin for WordPress versions prior to 2.2.9 Description: The Events Addon for Elementor plugin for WordPress is susceptible to Stored Cross-Site Scripting through the Typewriter and Countdown widgets. Insufficient...