CVE-2025-67949

CVE-2025-67949 is a WordPress Hostiko theme

CVE-2025-67947

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in scriptsbundle AdForest Elementor adforest-elementor allows Reflected XSS.This issue affects AdForest Elementor: from n/a through = 3.0.11...

CVE-2025-67614

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in foreverpinetree TheNa thena allows Reflected XSS.This issue affects TheNa: from n/a through = 1.5.5...

CVE-2025-53240 WordPress WordPress Photo Gallery plugin <= 1.1.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in adamlabs WordPress Photo Gallery photo-gallery-portfolio allows Reflected XSS.This issue affects WordPress Photo Gallery: from n/a through = 1.1.0...

CVE-2025-50006

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jthemes xSmart xsmart allows Reflected XSS.This issue affects xSmart: from n/a through = 1.2.9.4...

CVE-2025-49249

CVE-2025-49249 refers to a reflected XSS in the WordPress theme Drone (ApusTheme Drone) affecting Drone theme versions up to and including 1.40. The issue arises from improper neutralization/handling of user-supplied input during web page generation, enabling an attacker to inject malicious scrip...

CVE-2025-49249 WordPress Drone theme <= 1.40 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ApusTheme Drone drone allows Reflected XSS.This issue affects Drone: from n/a through = 1.40...

CVE-2025-48094 WordPress Magic Slider plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LambertGroup Magic Slider magicslider allows Reflected XSS.This issue affects Magic Slider: from n/a through = 2.2...

CVE-2025-47500

CVE-2025-47500 : Stored XSS in Stackable – Page Builder Gutenberg Blocks (Stackable) for WordPress plugins up to version 3.19.5. The issue stems from improper neutralization of input during web page generation, enabling an attacker to inject malicious scripts viewed by other users. Affected produ...

CVE-2025-4763

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Aida Computer Information Technology Inc. Hotel Guest Hotspot allows Reflected XSS. This issue affects Hotel Guest Hotspot: through 22012026. NOTE: The vendor was contacted early about this...

CVE-2025-4763 XSS in Aida Computer's Hotspot

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Aida Computer Information Technology Inc. Hotel Guest Hotspot allows Reflected XSS.This issue affects Hotel Guest Hotspot: through 22012026. NOTE: The vendor was contacted early about this...

WordPress plugin tagDiv Composer cross-site scripting vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...

Aida Hotel Guest Hotspot security vulnerability

Aida Hotel Guest Hotspot is a hotel WiFi system developed by the Turkish company Aida. The version of Aida Hotel Guest Hotspot dated 22012026 and earlier contained a security vulnerability. This vulnerability was due to improper input handling, which could lead to a reflection-type cross-site...

Microsoft Copilot Studio command injection vulnerability

Microsoft Copilot Studio is an artificial intelligence chatbot developed by Microsoft Corporation. Microsoft Copilot Studio has a command injection vulnerability, which stems from improper neutralization of certain elements. Attackers can exploit this vulnerability to access sensitive information...

PT-2026-4018

Name of the Vulnerable Software and Affected Versions CleverSoft Anon versions through 2.2.10 Description A flaw exists in CleverSoft Anon anon2x that allows for Reflected Cross-site Scripting XSS. This issue is due to improper neutralization of input during web page generation. An attacker could...

WordPress Plugin Craft Cross-Site Script Vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. WordPres...

PT-2026-3986

Name of the Vulnerable Software and Affected Versions adamlabs WordPress Photo Gallery versions through 1.1.0 Description The software contains a flaw due to improper handling of user-supplied data when creating web pages, which can lead to Reflected Cross-site Scripting XSS. This allows an...

WordPress plugin flexo-posts-manager has cross-site scripting vulnerabilities

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. WordPres...

WordPress plugin xPromoter has a cross-site scripting vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. WordPres...

PT-2026-3962

Name of the Vulnerable Software and Affected Versions Stackable versions through 3.19.5 Description A flaw exists in Benjamin Intal Stackable stackable-ultimate-gutenberg-blocks that allows for Stored Cross-site Scripting XSS. This issue is due to improper neutralization of input during web page...