CVE-2025-26897

CVE-2025-26897 concerns a Cross-Site Scripting (DOM-based) vulnerability in the WordPress plugin List Related Attachments (vulnerable through 2.1.6). The issue stems from improper input neutralization during web page generation, enabling DOM‑based XSS when processing related attachments. Accordin...

CVE-2025-26893

CVE-2025-26893 (Easy Charts, WordPress) : A DOM-based XSS in Easy Charts up to version 1.2.3. Root cause: improper neutralization of input during web page generation. Impact: authenticated attackers could inject script via the affected chart rendering path. Remediation: upgrade to the patched ver...

CVE-2025-26893 WordPress Easy Charts plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Kiran Potphode Easy Charts easy-charts allows DOM-Based XSS.This issue affects Easy Charts: from n/a through = 1.2.3...

CVE-2025-26878

CVE-2025-26878 is an authenticated (Contributor+) stored DOM-based XSS vulnerability in Autoship Cloud for WooCommerce Subscription Products, affecting versions up to 2.8.0.1. Technical details confirm a cross-site scripting issue triggered via input during web page generation. The connected docu...

CVE-2025-26878 WordPress Autoship Cloud for WooCommerce Subscription Products plugin <= 2.8.0.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in patternsinthecloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud allows DOM-Based XSS.This issue affects Autoship Cloud for WooCommerce Subscription Products: from n/a through...

CVE-2025-27145

copyparty, a portable file server, has a DOM-based cross-site scripting vulnerability in versions prior to 1.16.15. The vulnerability is considered low-risk. By handing someone a maliciously-named file, and then tricking them into dragging the file into copyparty's Web-UI, an attacker could execu...

CVE-2025-27145 copyparty renders unsanitized filenames as HTML when user uploads empty files

copyparty, a portable file server, has a DOM-based cross-site scripting vulnerability in versions prior to 1.16.15. The vulnerability is considered low-risk. By handing someone a maliciously-named file, and then tricking them into dragging the file into copyparty's Web-UI, an attacker could execu...

CVE-2025-27145 copyparty renders unsanitized filenames as HTML when user uploads empty files

copyparty, a portable file server, has a DOM-based cross-site scripting vulnerability in versions prior to 1.16.15. The vulnerability is considered low-risk. By handing someone a maliciously-named file, and then tricking them into dragging the file into copyparty's Web-UI, an attacker could execu...

PT-2025-7841 · Unknown · Baden List Related Attachments

Name of the Vulnerable Software and Affected Versions: Baden List Related Attachments versions n/a through 2.1.6 Description: The issue is related to improper neutralization of input during web page generation, which leads to a Cross-site Scripting XSS vulnerability, specifically DOM-Based XSS...

PT-2025-7848 · WordPress · Ar For Wordpress

Name of the Vulnerable Software and Affected Versions: AR For WordPress versions n/a through 7.7 Description: The issue affects the webandprint AR For WordPress plugin, allowing for DOM-Based XSS due to improper neutralization of input during web page generation. This can lead to Cross-site...

WordPress plugin WP Responsive Auto Fit Text 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A cross-site scripting...

WordPress plugin Easy Charts 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2025-26973

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WarfarePlugins Social Warfare social-warfare allows DOM-Based XSS.This issue affects Social Warfare: from n/a through = 4.5.5...

CVE-2025-27331

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Sébastien Dumont WooCommerce Display Products by Tags woocommerce-display-products-by-tags allows DOM-Based XSS.This issue affects WooCommerce Display Products by Tags: from n/a through = 1.0.0...

CVE-2025-27329

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in inlinkz EZ InLinkz linkup inlinkz-scripter allows DOM-Based XSS.This issue affects EZ InLinkz linkup: from n/a through = 0.18...

CVE-2025-27325

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Bruce Video.js HLS Player videojs-hls-player allows DOM-Based XSS.This issue affects Video.js HLS Player: from n/a through = 1.0.2...

CVE-2025-27327

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Winlin Live Streaming Video Player – by SRS Player srs-player allows DOM-Based XSS.This issue affects Live Streaming Video Player – by SRS Player: from n/a through = 1.0.18...

CVE-2025-27330

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PlayerJS PlayerJS playerjs allows DOM-Based XSS.This issue affects PlayerJS: from n/a through = 2.23...

CVE-2025-27320

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Pankaj Mondal Profile Widget Ninja profile-widget-ninja allows DOM-Based XSS.This issue affects Profile Widget Ninja: from n/a through = 4.3...

CVE-2025-27323

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jon Bishop WP About Author wp-about-author allows DOM-Based XSS.This issue affects WP About Author: from n/a through = 1.5...