PT-2025-17147 · Unknown · Contestswp

Name of the Vulnerable Software and Affected Versions: Run Contests, Raffles, and Giveaways with ContestsWP versions n/a through 2.0.6 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Reflected...

CVE-2025-22373

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in SicommNet BASEC on SaaS allows Reflected XSS, XSS Through HTTP Query Strings, Rendering of Arbitrary HTML and alternation of CSS Styles This issue affects BASEC: from 14 Dec 2021...

CVE-2025-26982

CVE-2025-26982 corresponds to a DOM-based XSS in the DSGVO Youtube WordPress plugin (DSGVO Youtube) prior to or up to version 1.5.1. The issue arises from improper input neutralization during web page generation, enabling DOM-based Cross-Site Scripting. The vulnerability affects DSGVO Youtube 1.5...

CVE-2025-26745

CVE-2025-26745 : In RS Elements Elementor Addon for WordPress, an Stored XSS exists due to improper neutralization during web page generation. Affected: RS Elements Elementor Addon from n/a through 1.1.5. Root cause and impact are stated; exploitation status is not detailed in the provided docume...

CVE-2025-32650

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Ability, Inc Accessibility Suite online-accessibility allows SQL Injection.This issue affects Accessibility Suite: from n/a through = 4.18...

CVE-2025-31028

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Huseyin Berberoglu WP Hide Categories wp-hide-categories allows Reflected XSS.This issue affects WP Hide Categories: from n/a through = 1.0...

CVE-2025-32517

CVE-2025-32517 is a Reflected Cross-Site Scripting (XSS) in the SCAND MultiMailer WordPress plugin. Affected versions are up to 1.0.3 (per initial details). CVSS v3.1 metrics show a base score of 7.1 (HIGH), with AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The Connected documents indicate the vulnerabil...

CVE-2025-32687

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Magnigenie Review Stars Count For WooCommerce review-stars-count-for-woocommerce allows SQL Injection.This issue affects Review Stars Count For WooCommerce: from n/a through = 2.0...

CVE-2025-32128

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in aaronfrey Nearby Locations nearby-locations allows SQL Injection.This issue affects Nearby Locations: from n/a through = 1.1.1...

CVE-2025-32230

CVE-2025-32230 is a Tutor LMS HTML Injection (Basic XSS) vulnerability. The Wordfence vulnerability entry confirms it affects Tutor LMS versions up to 3.4.0 and notes the issue stems from improper neutralization of script-related HTML tags, enabling potential HTML injection. The vulnerability is ...

CVE-2024-38865 Livestatus command injection in RestAPI

Improper neutralization of livestatus command delimiters in a specific endpoint within RestAPI of Checkmk prior to 2.2.0p39, 2.3.0p25, and 2.1.0p51 EOL allows arbitrary livestatus command execution. Exploitation requires the attacker to have a contact group assigned to their user account and for ...

CVE-2024-38865

CVE-2024-38865 affects Checkmk RestAPI: an improper neutralization of livestatus command delimiters in a specific endpoint allows arbitrary livestatus command execution. Affected versions are prior to 2.2.0p39, 2.3.0p25, and 2.1.0p51 (EOL). Exploitation requires the attacker to belong to a contac...

CVE-2025-31394

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Kailey trepmal More Mime Type Filters more-mime-type-filters allows Stored XSS.This issue affects More Mime Type Filters: from n/a through = 0.3...

CVE-2025-31020 WordPress Simple Spoiler plugin <= 1.4 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Webliberty Simple Spoiler simple-spoiler allows Stored XSS.This issue affects Simple Spoiler: from n/a through = 1.4...

Security update for azure-cli-core

This update for azure-cli-core fixes the following issues: CVE-2025-24049: Fixed improper neutralization of special elements used in a command allows an unauthorized attacker to elevate privileges locally bsc1239460 Patch Instructions: To install this SUSE update use the SUSE recommended...

CVE-2025-32020

CVE-2025-32020 affects the crud-query-parser library. The vulnerability arises from improper neutralization of the order/sort parameter in the TypeORM adapter when ordering is enabled and a property filter is not configured, enabling SQL injection. Impacted environments are those using the TypeOR...

K000150744: PostgreSQL vulnerability CVE-2025-1094

Security Advisory Description Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral, PQescapeIdentifier, PQescapeString, and PQescapeStringConn allows a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL injection requir...

CVE-2025-31898

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in dustinscarberry MediaView mediaview allows Reflected XSS.This issue affects MediaView: from n/a through = 1.1.2...

CVE-2025-32169

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Suresh Prasad Showeblogin Social showeblogin-facebook-page-like-box allows DOM-Based XSS.This issue affects Showeblogin Social: from n/a through = 7.0...

CVE-2025-32127

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in onOffice GmbH onOffice for WP-Websites onoffice-for-wp-websites allows SQL Injection.This issue affects onOffice for WP-Websites: from n/a through = 5.7...