PT-2025-54310

Name of the Vulnerable Software and Affected Versions lvaudore The Moneytizer versions through 10.0.6 Description The Moneytizer is susceptible to a DOM-Based Cross-Site Scripting issue due to improper neutralization of input during web page generation. This allows for potential execution of...

WordPress Responsive Lightbox & Gallery plugin <= 2.4.7 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Featherlight.js JavaScript Library vulnerability

Authenticated Contributor+ Stored DOM-Based Cross-Site Scripting via Featherlight.js JavaScript Library vulnerability discovered by Webbernaut in WordPress Plugin Responsive Lightbox versions = 2.4.7...

WordPress plugin The Moneytizer 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripti...

PT-2025-54309

Name of the Vulnerable Software and Affected Versions kalender.Digital Calendar.Online / Kalender.Digital versions through 1.0.11 Description The software contains a flaw related to improper input handling during web page generation, leading to a Cross-site Scripting XSS condition. Specifically,...

WordPress plugin WooCommerce Parcelas 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripti...

WordPress Happy Addons for Elementor plugin <= 3.12.2 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library vulnerability

Authenticated Contributor+ Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library vulnerability discovered by Webbernaut in WordPress Plugin Happy Addons for Elementor versions = 3.12.2...

WordPress Auto Thickbox plugin <= 3.5 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library vulnerability

Authenticated Contributor+ Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library vulnerability discovered by Webbernaut in WordPress Plugin Auto Thickbox versions = 3.5...

PT-2025-54334

Name of the Vulnerable Software and Affected Versions WooCommerce Parcelas versions through 1.3.5 Description The software contains a flaw related to improper input handling during web page generation, specifically a DOM-Based Cross-Site Scripting issue. This allows for the potential execution of...

CVE-2025-68499

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetTabs jet-tabs allows DOM-Based XSS.This issue affects JetTabs: from n/a through = 2.2.12...

CVE-2025-66103

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in revmakx WPCal.io wpcal allows DOM-Based XSS.This issue affects WPCal.io: from n/a through = 0.9.5.9...

CVE-2025-66103 WordPress WPCal.io plugin <= 0.9.5.9 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in revmakx WPCal.io wpcal allows DOM-Based XSS.This issue affects WPCal.io: from n/a through = 0.9.5.9...

EUVD-2025-205791

Malicious code in react-dom-bindings npm...

MAL-2025-192973 Malicious code in react-dom-bindings (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3c021e2818d17945e50bcb89d19d34a8750ca14078220d113dc8b4c5f0c1392 The package react-dom-bindings was found to contain malicious code. Source: ghsa-malware...

Malicious Package

Overview react-dom-bindings is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview react-server-dom-fb is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in react-dom-bindings (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3c021e2818d17945e50bcb89d19d34a8750ca14078220d113dc8b4c5f0c1392 The package react-dom-bindings was found to contain malicious code. Source: ghsa-malware...

CVE-2025-64190

CVE-2025-64190: DOM-based XSS in 8theme XStore Core (WordPress plugin) before v5.6 caused by improper neutralization of input during web page generation. Impacts confidentiality/integrity/availability as per XSS descriptions; remediation: upgrade to XStore Core 5.6 or later (no further exploit de...

EUVD-2025-205706

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows DOM-Based XSS.This issue affects Essential Addons for Elementor: from n/a through = 6.5.3...

EUVD-2025-205711

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in A WP Life Blog Filter blog-filter allows DOM-Based XSS.This issue affects Blog Filter: from n/a through = 1.7.3...

EUVD-2025-205726

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Shamalli Web Directory Free web-directory-free allows DOM-Based XSS.This issue affects Web Directory Free: from n/a through = 1.7.12...