CVE-2025-49411

CVE-2025-49411 affects the WordPress iFrame Block plugin, with vulnerable versions up to 0.1.1. The issue is a stored XSS caused by improper input neutralization during web page generation, enabling script injection when pages are viewed. Affected software: iFrame Block. Root cause: improper sani...

CVE-2025-49413 WordPress Super Store Finder Plugin <= 7.6 - Reflected Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in highwarden Super Store Finder superstorefinder-wp allows Reflected XSS.This issue affects Super Store Finder: from n/a through = 7.6...

CVE-2025-49420

CVE-2025-49420 concerns the WordPress plugin * Ultra Portfolio* (WordPress plugin) with a Cross-Site Scripting (XSS) vulnerability. According to the connected Patchstack/NVD entries, the issue is an improper neutralization of input during web page generation that enables XSS, affecting Ultra Port...

CVE-2025-49893 WordPress Elizaibots plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in liseperu Elizaibots allows Stored XSS. This issue affects Elizaibots: from n/a through 1.0.2...

CVE-2025-49894 WordPress Nuss Theme <= 1.3.3 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in uxper Nuss nuss allows PHP Local File Inclusion.This issue affects Nuss: from n/a through = 1.3.3...

CVE-2025-48162

CVE-2025-48162 is a Reflected Cross-Site Scripting vulnerability in WordPress Simple Business Directory Pro

CVE-2025-48162 WordPress Simple Business Directory Pro <= 15.5.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in quantumcloud Simple Business Directory Pro simple-business-directory-pro allows Reflected XSS.This issue affects Simple Business Directory Pro: from n/a through = 15.5.1...

CVE-2025-48296 WordPress UpStore <= 1.7.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in skygroup UpStore upstore allows Reflected XSS.This issue affects UpStore: from n/a through = 1.7.0...

CVE-2025-53226 WordPress Comments Capcha Box Plugin <= 1.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in digitalzoomstudio Comments Capcha Box comments-capcha-box allows Reflected XSS.This issue affects Comments Capcha Box: from n/a through = 1.1...

CVE-2025-53559

CVE-2025-53559 : Reflected Cross-Site Scripting in the LambertGroup Universal Video Player - Addon for WPBakery Page Builder (versions

CVE-2025-54027 WordPress Support Board <= 3.8.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Schiocco Support Board allows Reflected XSS. This issue affects Support Board: from n/a through 3.8.0...

CVE-2025-54046

CVE-2025-54046 affects the WordPress Cost Calculator plugin (QuanticaLabs) for versions up to 7.4. It is a Stored Cross‑Site Scripting (XSS) vulnerability caused by improper input neutralization during web page generation. Exploitation could occur when a user with access to crafted input is able ...

WordPress plugin Jobmonster 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2025-33945 · Unknown · Imran Emu Tc Testimonials

Name of the Vulnerable Software and Affected Versions: Imran Emu TC Testimonials versions through 1.1.1 Description: Improper neutralization of input during web page generation allows for stored cross-site scripting XSS. This issue enables the injection of malicious scripts into web pages...

PT-2025-33947 · Unknown · Numixtech Page Transition

Name of the Vulnerable Software and Affected Versions: numixtech Page Transition versions n/a through 1.3 Description: The software contains an Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' issue that allows Stored XSS. Recommendations: At the moment, there is...

PT-2025-34005 · Unknown · Schiocco Support Board

Name of the Vulnerable Software and Affected Versions: Schiocco Support Board versions through 3.8.0 Description: Improper neutralization of input during web page generation allows reflected cross-site scripting XSS. Recommendations: Update Schiocco Support Board to a version later than 3.8.0...

PT-2025-33950 · Unknown · Aelora Iframe Wrapper

Name of the Vulnerable Software and Affected Versions: Aelora iframe Wrapper versions n/a through 0.1.1 Description: Aelora iframe Wrapper is susceptible to a DOM-Based Cross-Site Scripting issue due to improper neutralization of input during web page generation. Recommendations: Update Aelora...

PT-2025-33955 · Unknown · Thiudis Custom Menu

Name of the Vulnerable Software and Affected Versions: thiudis Custom Menu versions through 1.8 Description: Improper neutralization of input during web page generation allows for stored cross-site scripting XSS. Recommendations: Update thiudis Custom Menu to a version later than 1.8...

PT-2025-33979 · Unknown · Raptive Ads

Name of the Vulnerable Software and Affected Versions: Raptive Ads versions through 3.8.0 Description: Raptive Ads is susceptible to a reflected cross-site scripting XSS issue due to improper neutralization of input during web page generation. Recommendations: Update Raptive Ads to a version late...

PT-2025-33954 · WordPress · Laposta Woocommerce

Name of the Vulnerable Software and Affected Versions: Laposta WooCommerce versions through 1.9.1 Description: This issue involves improper neutralization of input during web page generation, leading to a Stored Cross-Site Scripting XSS condition. Successful exploitation could allow an attacker t...