CVE-2025-49054

CVE-2025-49054 is a reflected XSS vulnerability in the WordPress plugin Time Sheets (mrdenny Time Sheets), affecting versions up to 2.1.3. The issue arises from improper input neutralization during web page generation, enabling reflected cross-site scripting. Public references indicate an advisor...

CVE-2025-49057

CVE-2025-49057: Reflected XSS in WordPress plugin WP Voting (versions n/a through 1.8). The vulnerability arises from improper input neutralization during web page generation, enabling cross-site scripting. Affected software: WP Voting

CVE-2025-49057 WordPress WP Voting Plugin <= 1.8 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ko Min WP Voting allows Reflected XSS. This issue affects WP Voting: from n/a through 1.8...

CVE-2025-49061

CVE-2025-49061 is a stored XSS vulnerability in the WordPress plugin “Porn Videos Embed” (versions n/a through 0.9.1). The issue arises from improper input neutralization during web page generation, enabling stored cross-site scripting. Affected software: Porn Videos Embed (WordPress plugin)

CVE-2025-49063 WordPress BaiduXZH Submit(百度熊掌号) plugin <= 1.4.6 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in i3geek BaiduXZH Submit百度熊掌号 i3geek-baiduxzh allows Reflected XSS.This issue affects BaiduXZH Submit百度熊掌号: from n/a through = 1.4.6...

CVE-2025-49062 WordPress WP-jScrollPane plugin <= 2.0.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in cornfeed WP-jScrollPane allows Reflected XSS. This issue affects WP-jScrollPane: from n/a through 2.0.3...

CVE-2025-49065

The CVE-2025-49065 entry concerns the WordPress Visit Counter plugin, affected versions n/a through 1.0. The vulnerability is anStored Cross-Site Scripting (XSS) caused by improper neutralization of input during web page generation in the Visit Counter feature. The connected documents confirm the...

CVE-2025-49065 WordPress Visit Counter Plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BestiaDurmiente Visit Counter visit-counter allows Stored XSS.This issue affects Visit Counter: from n/a through = 1.0...

CVE-2025-49433 WordPress Supermalink <= 1.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThanhD Supermalink supermalink allows DOM-Based XSS.This issue affects Supermalink: from n/a through = 1.1...

CVE-2025-49437 WordPress WP LOL Rotation <= 1.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in worstguy WP LOL Rotation league-of-legends-rotation allows Stored XSS.This issue affects WP LOL Rotation: from n/a through = 1.0...

CVE-2025-49433 WordPress Supermalink <= 1.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThanhD Supermalink supermalink allows DOM-Based XSS.This issue affects Supermalink: from n/a through = 1.1...

CVE-2025-49433

CVE-2025-49433 corresponds to a DOM-based XSS in WordPress plugin Supermalink (affected: versions up to 1.1; not publicly detailed in initial document). Root cause: Improper neutralization of input during web page generation. Impact is cross-site scripting with low to moderate severity per CVSS m...

CVE-2025-52720 WordPress Super Store Finder Plugin <= 7.5 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in highwarden Super Store Finder superstorefinder-wp allows SQL Injection.This issue affects Super Store Finder: from n/a through = 7.5...

CVE-2025-52730 WordPress WordPress Event Manager, Event Calendar and Booking Plugin Plugin <= 4.0.24 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in themefunction WordPress Event Manager, Event Calendar and Booking Plugin eventin-pro allows Stored XSS.This issue affects WordPress Event Manager, Event Calendar and Booking Plugin: from n/a throug...

PT-2025-33385 · Creativemindssolutions · Cm On Demand Search/Replace

Name of the Vulnerable Software and Affected Versions: CreativeMindsSolutions CM On Demand Search And Replace versions through 1.5.2 Description: The software contains an Improper Neutralization of Input During Web Page Generation issue, which allows for Stored Cross-site Scripting XSS...

PT-2025-33198 · Unknown · Thanhd Supermalink

Name of the Vulnerable Software and Affected Versions: ThanhD Supermalink versions n/a through 1.1 Description: The software contains an Improper Neutralization of Input During Web Page Generation issue, leading to a DOM-Based Cross-site Scripting condition. Recommendations: Versions prior to 1.2...

WordPress plugin SoundSt SEO Search 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A cross-site scripting...

PT-2025-33377 · Artiosmedia · Artiosmedia Rss Feed Pro

Name of the Vulnerable Software and Affected Versions: artiosmedia RSS Feed Pro versions through 1.1.8 Description: The software contains an Improper Neutralization of Input During Web Page Generation issue, which results in a Stored Cross-site Scripting condition. Recommendations: Update...

PT-2025-33371 · WordPress · Wp Rentals

Name of the Vulnerable Software and Affected Versions: WP Rentals versions through 3.13.1 Description: The software contains an Improper Neutralization of Input During Web Page Generation issue, which allows for Stored Cross-site Scripting XSS. Recommendations: Update WP Rentals to a version late...

PT-2025-33194 · Unknown · Bestiadurmiente Visit Counter

Name of the Vulnerable Software and Affected Versions: BestiaDurmiente Visit Counter versions n/a through 1.0 Description: Improper neutralization of input during web page generation allows for stored cross-site scripting XSS. Recommendations: At the moment, there is no information about a newer...