PT-2025-27807

Name of the Vulnerable Software and Affected Versions: Mediawiki - GoogleDocs4MW Extension versions 1.42.X through 1.42.6 Mediawiki - GoogleDocs4MW Extension versions 1.43.X through 1.43.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known...

CVE-2025-27361

CVE-2025-27361 concerns the WordPress plugin “Photo Express for Google” (thhake) with versions

WordPress SB Breadcrumbs plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin SB Breadcrumbs versions = 1.0...

CVE-2025-46910

Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they brow...

CVE-2025-47113 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they brow...

CVE-2025-47055

Adobe Experience Manager 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. A low-privileged attacker can inject malicious JavaScript that may execute in a victim’s browser when visiting a page containing the field. The CVE is documente...

CVE-2025-31638 WordPress Spare <= 1.7 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in themeton Spare allows Reflected XSS. This issue affects Spare: from n/a through 1.7...

WordPress Bit File Manager plugin <= 6.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Uploads vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting via SVG File Uploads vulnerability discovered by TANG Cheuk Hei siunam in WordPress Plugin Bit File Manager versions = 6.7...

WordPress Newsletter plugin < 8.8.2 - Admin+ Stored XSS via Subscription vulnerability

Admin+ Stored XSS via Subscription vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin NewsLetter versions 8.8.2...

WordPress Real Cookie Banner Pro plugin < 5.1.6 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin Real Cookie Banner Pro versions 5.1.6...

CVE-2024-23349

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Answer.This issue affects Apache Answer: through 1.2.1. XSS attack when user enters summary. A logged-in user, when modifying their own submitted question, can input malicious code in the...

CVE-2023-22461

The sanitize-svg package, a small SVG sanitizer to prevent cross-site scripting attacks, uses a deny-list-pattern to sanitize SVGs to prevent XSS. In doing so, literal...

CVE-2021-25938

In ArangoDB, versions v2.2.6.2 through v3.7.10 are vulnerable to Cross-Site Scripting XSS, since there is no validation of the .zip file name and filtering of potential abusive characters which zip files can be named to. There is no X-Frame-Options Header set, which makes it more susceptible for...

WordPress MapSVG plugin <= 8.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Mo'men Saad in WordPress Plugin MapSVG versions = 8.6.4...

WordPress Responsive Gallery Grid plugin < 2.3.15 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin Responsive Gallery Grid versions 2.3.15...

WordPress TI WooCommerce Wishlist plugin <= 2.10.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin TI WooCommerce Wishlist versions = 2.10.0...

CVE-2025-44182: Improper Neutralization of Input During Web Page Generation

Phpgurukul Vehicle Record Management System v1.0 is vulnerable to Cross Site Scripting XSS via the vehiclename, modelnumber, regnumber, vehiclesubtype, chasisnum, enginenumber' in the /admin/edit-vehicle.php component. This allows attackers to execute arbitrary code...

CVE-2025-27284 WordPress Flagged Content Plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in divspark Flagged Content flagged-content allows Reflected XSS.This issue affects Flagged Content: from n/a through = 1.0.2...

CVE-2025-27308

CVE-2025-27308 : WordPress WP Video Posts plugin is affected (versions up to 3.5.1) by a Reflected Cross-Site Scripting vulnerability caused by improper neutralization of input during web page generation. Public details consistently reference WP Video Posts in this CVE; exploitation status and fi...

WordPress DSGVO Youtube plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by zaim Patchstack Alliance in WordPress Plugin DSGVO Youtube versions = 1.5.1...