CVE-2025-49407

CVE-2025-49407 affects the WordPress theme Houzez (favethemes)

CVE-2025-48365 WordPress Custom Comment plugin <= 2.1.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in imaprogrammer Custom Comment customcomment allows Stored XSS.This issue affects Custom Comment: from n/a through = 2.1.6...

CVE-2025-48360

CVE-2025-48360 affects the WordPress Varnish/Nginx Proxy Caching plugin (versions up to 1.8.3). The issue is an improper neutralization of input during web page generation, leading to stored XSS. Public sources in the connected data confirm this vulnerability, its association with the plugin, and...

CVE-2025-48356

CVE-2025-48356 is a Stored XSS in the WordPress Kanpress plugin (versions

CVE-2025-48356 WordPress Kanpress plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Isra Kanpress kanpress allows Stored XSS.This issue affects Kanpress: from n/a through = 1.1...

CVE-2025-48349 WordPress Video Gallery – Vimeo and YouTube Gallery plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in origincode Video Gallery – Vimeo and YouTube Gallery allows Stored XSS. This issue affects Video Gallery – Vimeo and YouTube Gallery: from n/a through 1.1.7...

CVE-2025-48323 WordPress Advance Food Menu plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Md Abunaser Khan Advance Food Menu advance-food-menu allows Stored XSS.This issue affects Advance Food Menu: from n/a through = 1.0...

CVE-2025-48323

CVE-2025-48323 is a stored XSS vulnerability in the WordPress plugin Advance Food Menu (affected: versions up to 1.0; vulnerability described as improper neutralization of input during web page generation). The issue allows injection of arbitrary web scripts/HTML via user-supplied data. Reported ...

CVE-2025-48319

CVE-2025-48319 corresponds to a stored XSS in the WordPress plugin “Mesa Mesa Reservation Widget” (versions up to 1.0.0). The root cause is improper input neutralization during web page generation, enabling attacker-supplied payloads to persist in the widget. Reported as affecting Mesa Mesa Reser...

CVE-2025-48319 WordPress Mesa Mesa Reservation Widget plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in gslauraspeck Mesa Mesa Reservation Widget allows Stored XSS. This issue affects Mesa Mesa Reservation Widget: from n/a through 1.0.0...

CVE-2025-48316

CVE-2025-48316 is a stored XSS vulnerability in the WordPress plugin “Responsive Mobile-Friendly Tooltip” (ItayXD) affecting versions up to 1.6.6. The issue arises from improper input neutralization during web page generation, enabling stored cross-site scripting. CVSSv3.1 base score is 6.5 (Atta...

CVE-2025-48313

CVE-2025-48313 affects the WordPress Tripadvisor Shortcode plugin (versions

CVE-2025-48314

CVE-2025-48314 describes a Stored XSS in the WordPress plugin Add Code To Head . Affected versions are listed as from unspecified version through 1.17. The vulnerability arises from improper input neutralization during web page generation, enabling attacker-supplied data to execute scripts in a v...

CVE-2025-39496

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WBW WooBeWoo Product Filter Pro allows SQL Injection.This issue affects WooBeWoo Product Filter Pro: from n/a before 2.9.6...

WordPress plugin Listeo-Core SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection...

WordPress plugin Yandex Site search pinger 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2025-35072

Name of the Vulnerable Software and Affected Versions: uxper Golo versions through 1.7.1 Description: The software contains a Reflected Cross-Site Scripting XSS issue due to improper neutralization of input during web page generation. Recommendations: Update uxper Golo to a version later than 1.7...

PT-2025-35046

Name of the Vulnerable Software and Affected Versions: NextGEN Gallery Search versions through 2.12 Description: The software contains a Reflected Cross-site Scripting XSS issue due to improper neutralization of input during web page generation. Recommendations: Update NextGEN Gallery Search to a...

PT-2025-35044

Name of the Vulnerable Software and Affected Versions: XmasB Quotes versions through 1.6.1 Description: The software contains a reflected cross-site scripting XSS issue due to improper neutralization of input during web page generation. Recommendations: Update to a version later than 1.6.1...

PT-2025-35004

Name of the Vulnerable Software and Affected Versions: stanton119 WordPress HTML versions through 0.51 Description: The software contains an Improper Neutralization of Input During Web Page Generation issue, which allows for Stored Cross-site Scripting XSS. Recommendations: At the moment, there i...