CVE-2025-26745

CVE-2025-26745 : In RS Elements Elementor Addon for WordPress, an Stored XSS exists due to improper neutralization during web page generation. Affected: RS Elements Elementor Addon from n/a through 1.1.5. Root cause and impact are stated; exploitation status is not detailed in the provided docume...

CVE-2025-32650

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Ability, Inc Accessibility Suite online-accessibility allows SQL Injection.This issue affects Accessibility Suite: from n/a through = 4.18...

CVE-2025-31028

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Huseyin Berberoglu WP Hide Categories wp-hide-categories allows Reflected XSS.This issue affects WP Hide Categories: from n/a through = 1.0...

CVE-2025-32517

CVE-2025-32517 is a Reflected Cross-Site Scripting (XSS) in the SCAND MultiMailer WordPress plugin. Affected versions are up to 1.0.3 (per initial details). CVSS v3.1 metrics show a base score of 7.1 (HIGH), with AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The Connected documents indicate the vulnerabil...

CVE-2025-32687

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Magnigenie Review Stars Count For WooCommerce review-stars-count-for-woocommerce allows SQL Injection.This issue affects Review Stars Count For WooCommerce: from n/a through = 2.0...

CVE-2025-32128

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in aaronfrey Nearby Locations nearby-locations allows SQL Injection.This issue affects Nearby Locations: from n/a through = 1.1.1...

CVE-2025-32230

CVE-2025-32230 is a Tutor LMS HTML Injection (Basic XSS) vulnerability. The Wordfence vulnerability entry confirms it affects Tutor LMS versions up to 3.4.0 and notes the issue stems from improper neutralization of script-related HTML tags, enabling potential HTML injection. The vulnerability is ...

CVE-2024-38865 Livestatus command injection in RestAPI

Improper neutralization of livestatus command delimiters in a specific endpoint within RestAPI of Checkmk prior to 2.2.0p39, 2.3.0p25, and 2.1.0p51 EOL allows arbitrary livestatus command execution. Exploitation requires the attacker to have a contact group assigned to their user account and for ...

CVE-2024-38865

CVE-2024-38865 affects Checkmk RestAPI: an improper neutralization of livestatus command delimiters in a specific endpoint allows arbitrary livestatus command execution. Affected versions are prior to 2.2.0p39, 2.3.0p25, and 2.1.0p51 (EOL). Exploitation requires the attacker to belong to a contac...

CVE-2025-31394

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Kailey trepmal More Mime Type Filters more-mime-type-filters allows Stored XSS.This issue affects More Mime Type Filters: from n/a through = 0.3...

CVE-2025-31020 WordPress Simple Spoiler plugin <= 1.4 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Webliberty Simple Spoiler simple-spoiler allows Stored XSS.This issue affects Simple Spoiler: from n/a through = 1.4...

Security update for azure-cli-core

This update for azure-cli-core fixes the following issues: CVE-2025-24049: Fixed improper neutralization of special elements used in a command allows an unauthorized attacker to elevate privileges locally bsc1239460 Patch Instructions: To install this SUSE update use the SUSE recommended...

CVE-2025-32020

CVE-2025-32020 affects the crud-query-parser library. The vulnerability arises from improper neutralization of the order/sort parameter in the TypeORM adapter when ordering is enabled and a property filter is not configured, enabling SQL injection. Impacted environments are those using the TypeOR...

K000150744: PostgreSQL vulnerability CVE-2025-1094

Security Advisory Description Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral, PQescapeIdentifier, PQescapeString, and PQescapeStringConn allows a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL injection requir...

CVE-2025-31898

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in dustinscarberry MediaView mediaview allows Reflected XSS.This issue affects MediaView: from n/a through = 1.1.2...

CVE-2025-32169

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Suresh Prasad Showeblogin Social showeblogin-facebook-page-like-box allows DOM-Based XSS.This issue affects Showeblogin Social: from n/a through = 7.0...

CVE-2025-32127

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in onOffice GmbH onOffice for WP-Websites onoffice-for-wp-websites allows SQL Injection.This issue affects onOffice for WP-Websites: from n/a through = 5.7...

CVE-2025-32191

CVE-2025-32191 affects News Element Elementor Blog Magazine (WordPress plugin), with versions up to 1.0.7. The connected document confirms a Stored Cross-Site Scripting (authenticated: Contributor+ required) vulnerability in how input is handled and surfaced in web page content. The core issue is...

CVE-2025-32189 WordPress BWD Elementor Addons plugin <= 4.4.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Best WP Developer BWD Elementor Addons bwd-elementor-addons allows DOM-Based XSS.This issue affects BWD Elementor Addons: from n/a through = 4.4.2...

CVE-2025-32170

CVE-2025-32170 concerns the Motors – Car Dealership & Classified Listings WordPress plugin. The Connected Wordfence entry identifies an Authenticated Local File Inclusion (LFI) vulnerability affecting Motors versions up to 1.4.71, with patching applied in 1.4.71. The CVE description in the Initia...