CVE-2025-54706 WordPress Magical Posts Display Plugin plugin <= 1.2.52 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Noor Alam Magical Posts Display magical-posts-display allows DOM-Based XSS.This issue affects Magical Posts Display: from n/a through = 1.2.52...

CVE-2025-54704

CVE-2025-54704 is a DOM-based XSS vulnerability in the WordPress plugin Easy Elementor Addons (versions up to 2.2.6). The root cause is improper neutralization of user input during web page generation, enabling DOM-based cross-site scripting. Public sources confirm affected software as Easy Eleme...

CVE-2025-54699 WordPress Masteriyo - LMS Plugin plugin <= 1.18.3 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in masteriyo Masteriyo - LMS learning-management-system allows Stored XSS.This issue affects Masteriyo - LMS: from n/a through = 1.18.3...

CVE-2025-54688 WordPress JetEngine Plugin plugin <= 3.7.1.2 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetEngine allows Stored XSS. This issue affects JetEngine: from n/a through 3.7.1.2...

CVE-2025-54688

CVE-2025-54688 is a stored XSS in the WordPress plugin JetEngine (versions ≤ 3.7.1.2) caused by improper neutralization of input during web page generation. The vulnerability is reported as an authenticated Stored XSS, meaning an attacker with appropriate access could inject scripts that are late...

CVE-2025-54687 WordPress JetTabs Plugin plugin <= 2.2.9.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetTabs jet-tabs allows DOM-Based XSS.This issue affects JetTabs: from n/a through = 2.2.9.1...

CVE-2025-54680 WordPress Blogger Buzz Theme theme <= 1.2.6 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Sparkle Themes Blogger Buzz allows Stored XSS. This issue affects Blogger Buzz: from n/a through 1.2.6...

CVE-2025-54676 WordPress Online Booking & Scheduling Calendar for by vcita Plugin plugin <= 4.5.3 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Stored XSS.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n...

CVE-2025-28999 WordPress WooCommerce Shop Page Builder <= 2.27.7 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ZoomIt WooCommerce Shop Page Builder allows Reflected XSS. This issue affects WooCommerce Shop Page Builder: from n/a through 2.27.7...

CVE-2025-31007

CVE-2025-31007 is a Reflected XSS in the Billplz Addon for Contact Form 7 (WordPress). The vulnerability arises from improper input neutralization during web page generation, allowing arbitrary script execution when a user is tricked into submitting crafted input. Affected software: Billplz Addon...

CVE-2025-47610 WordPress WooCommerce Fortnox Integration <= 4.5.6 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Wetail WooCommerce Fortnox Integration woocommerce-fortnox-integration allows Stored XSS.This issue affects WooCommerce Fortnox Integration: from n/a through = 4.5.6...

CVE-2025-49037 WordPress Authentication and xmlrpc log writer plugin <= 1.2.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Federico Rota Authentication and xmlrpc log writer authentication-and-xmlrpc-log-writer allows Reflected XSS.This issue affects Authentication and xmlrpc log writer: from n/a through = 1.2.2...

CVE-2025-49048 WordPress Inspectlet – User Session Recording and Heatmaps plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in inspectlet Inspectlet User Session Recording and Heatmaps inspectlet-heatmaps-and-user-session-recording allows Stored XSS.This issue affects Inspectlet User Session Recording and Heatmaps: from n/...

CVE-2025-49053

CVE-2025-49053 concerns the WordPress plugin WP Airdrop Manager . The vulnerability is a Stored XSS caused by improper input neutralization during web page generation, affecting versions up to and including 1.0.5 . Exploitation could occur via crafted input stored by the plugin. Mitigation per th...

CVE-2025-49054

CVE-2025-49054 is a reflected XSS vulnerability in the WordPress plugin Time Sheets (mrdenny Time Sheets), affecting versions up to 2.1.3. The issue arises from improper input neutralization during web page generation, enabling reflected cross-site scripting. Public references indicate an advisor...

CVE-2025-49057 WordPress WP Voting Plugin <= 1.8 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ko Min WP Voting allows Reflected XSS. This issue affects WP Voting: from n/a through 1.8...

CVE-2025-49063 WordPress BaiduXZH Submit(百度熊掌号) plugin <= 1.4.6 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in i3geek BaiduXZH Submit百度熊掌号 i3geek-baiduxzh allows Reflected XSS.This issue affects BaiduXZH Submit百度熊掌号: from n/a through = 1.4.6...

CVE-2025-49062 WordPress WP-jScrollPane plugin <= 2.0.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in cornfeed WP-jScrollPane allows Reflected XSS. This issue affects WP-jScrollPane: from n/a through 2.0.3...

CVE-2025-49065

The CVE-2025-49065 entry concerns the WordPress Visit Counter plugin, affected versions n/a through 1.0. The vulnerability is anStored Cross-Site Scripting (XSS) caused by improper neutralization of input during web page generation in the Visit Counter feature. The connected documents confirm the...

CVE-2025-49065 WordPress Visit Counter Plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BestiaDurmiente Visit Counter visit-counter allows Stored XSS.This issue affects Visit Counter: from n/a through = 1.0...