CVE-2026-24949

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeGoods PhotoMe photome allows DOM-Based XSS.This issue affects PhotoMe: from n/a through = 5.7.1...

CVE-2026-24955

CVE-2026-24955 corresponds to a Reflected XSS in Fox-Themes Whizz Plugins (WordPress) up to version 1.9. Affected component: Whizz Plugins in WordPress; vulnerability arises from improper input neutralization during web page generation, enabling reflected script execution. Impact per sources: use...

CVE-2026-24955 WordPress Whizz Plugins plugin <= 1.9 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in fox-themes Whizz Plugins whizz-plugins allows Reflected XSS.This issue affects Whizz Plugins: from n/a through = 1.9...

CVE-2026-24949

CVE-2026-24949 affects ThemeGoods PhotoMe photome WordPress theme

CVE-2026-24948 WordPress Reflector plugin <= 1.2.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in fox-themes Reflector reflector-plugins allows Reflected XSS.This issue affects Reflector: from n/a through = 1.2.2...

CVE-2026-24943

CVE-2026-24943 is a Reflected Cross-Site Scripting vulnerability in ThemeGoods Grand Conference (grandconference) for WordPress, due to improper input neutralization during web page generation. Affected: Grand Conference versions up to 5.3.4. Root cause: insufficient sanitization of user-supplied...

CVE-2025-69392

CVE-2025-69392 affects the WordPress plugin iMoney (versions up to and including 0.36). The vulnerability is a Reflected Cross-Site Scripting (XSS) due to improper neutralization of user input during web page generation. The available documents (NVD/Red Hat/Patchstack/Wordfence/CVE lists) confirm...

CVE-2025-69330

CVE-2025-69330 is a reflected Cross-Site Scripting (XSS) vulnerability affecting the WordPress Theme Prestige, version prior to 1.4.1. The issue is described as an improper neutralization of user-controlled input during web page generation, enabling reflected XSS. Public sources in the connected ...

CVE-2025-69323 WordPress Slimstat Analytics plugin <= 5.3.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in VeronaLabs Slimstat Analytics wp-slimstat allows Reflected XSS.This issue affects Slimstat Analytics: from n/a through = 5.3.2...

CVE-2025-68863

CVE-2025-68863 corresponds to a Reflected XSS in the WordPress plugin “iContact for Gravity Forms” (gravity-forms-icontact) up to version 1.3.2. The vulnerability arises from improper input neutralization during web page generation, enabling an attacker to inject scripts when a victim views a cra...

CVE-2025-68852

CVE-2025-68852 involves the WordPress Court Reservation plugin (court-reservation) with a Reflected XSS caused by improper input neutralization during web page generation. Public docs identify affected versions as Court Reservation: n/a through &lt;= 1.10.11 (NVD/Red Hat/CVE listings) and

CVE-2025-68848 WordPress amr cron manager plugin <= 2.3 - Reflecte dCross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in anmari amr cron manager amr-cron-manager allows Reflected XSS.This issue affects amr cron manager: from n/a through = 2.3...

CVE-2025-68847

CVE-2025-68847 concerns the WordPress plugin iSape (versions through 0.72). It is a Reflected Cross‑Site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. The issue permits an attacker to inject script via crafted input that is reflected in the p...

CVE-2025-67991 WordPress User Extra Fields plugin <= 16.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Reflected XSS.This issue affects User Extra Fields: from n/a through = 16.8...

CVE-2025-67984 WordPress NPS computy plugin <= 2.8.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in calliko NPS computy nps-computy allows DOM-Based XSS.This issue affects NPS computy: from n/a through = 2.8.2...

CVE-2025-67984

CVE-2025-67984 is a DOM-based XSS vulnerability in the WordPress plugin NPS computy (nps-computy) , affecting versions up through and including 2.8.2 . The connected Red Hat and CVE entries confirm the flaw is an input handling/neutralization issue during web page generation that enables cross-si...

CVE-2025-67972 WordPress Zoho ZeptoMail plugin <= 3.2.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in Zoho Mail Zoho ZeptoMail allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Zoho ZeptoMail: from n/a through 3.2.9...

CVE-2025-67971 WordPress FluentCart plugin < 1.3.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPManageNinja FluentCart fluent-cart allows Reflected XSS.This issue affects FluentCart: from n/a through 1.3.0...

CVE-2025-60183 WordPress Silencesoft RSS Reader Plugin <= 0.6 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in silence Silencesoft RSS Reader external-rss-reader allows Stored XSS.This issue affects Silencesoft RSS Reader: from n/a through = 0.6...

CVE-2025-53233 WordPress Storyform plugin <= 0.6.14 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in RylanH Storyform storyform allows Reflected XSS.This issue affects Storyform: from n/a through = 0.6.14...