CVE-2025-49054 WordPress Time Sheets plugin <= 2.1.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in mrdenny Time Sheets allows Reflected XSS. This issue affects Time Sheets: from n/a through 2.1.3...

CVE-2025-49058

CVE-2025-49058 is a reflected XSS in the WordPress plugin SoundSt SEO Search (versions up to and including 1.2.3). The vulnerability arises from improper input neutralization during web page generation, enabling an attacker to inject script via user-supplied input that is reflected back to the pa...

CVE-2025-49057 WordPress WP Voting Plugin <= 1.8 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ko Min WP Voting allows Reflected XSS. This issue affects WP Voting: from n/a through 1.8...

CVE-2025-49063 WordPress BaiduXZH Submit(百度熊掌号) plugin <= 1.4.6 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in i3geek BaiduXZH Submit百度熊掌号 i3geek-baiduxzh allows Reflected XSS.This issue affects BaiduXZH Submit百度熊掌号: from n/a through = 1.4.6...

CVE-2025-49062 WordPress WP-jScrollPane plugin <= 2.0.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in cornfeed WP-jScrollPane allows Reflected XSS. This issue affects WP-jScrollPane: from n/a through 2.0.3...

CVE-2025-49065

The CVE-2025-49065 entry concerns the WordPress Visit Counter plugin, affected versions n/a through 1.0. The vulnerability is anStored Cross-Site Scripting (XSS) caused by improper neutralization of input during web page generation in the Visit Counter feature. The connected documents confirm the...

CVE-2025-49065 WordPress Visit Counter Plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BestiaDurmiente Visit Counter visit-counter allows Stored XSS.This issue affects Visit Counter: from n/a through = 1.0...

CVE-2025-49437 WordPress WP LOL Rotation <= 1.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in worstguy WP LOL Rotation league-of-legends-rotation allows Stored XSS.This issue affects WP LOL Rotation: from n/a through = 1.0...

CVE-2025-49433 WordPress Supermalink <= 1.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThanhD Supermalink supermalink allows DOM-Based XSS.This issue affects Supermalink: from n/a through = 1.1...

CVE-2025-49433

CVE-2025-49433 corresponds to a DOM-based XSS in WordPress plugin Supermalink (affected: versions up to 1.1; not publicly detailed in initial document). Root cause: Improper neutralization of input during web page generation. Impact is cross-site scripting with low to moderate severity per CVSS m...

CVE-2025-50040 WordPress CF7 Spreadsheets Plugin <= 2.3.2 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in moshensky CF7 Spreadsheets cf7-spreadsheets allows Stored XSS.This issue affects CF7 Spreadsheets: from n/a through = 2.3.2...

CVE-2025-52720 WordPress Super Store Finder Plugin <= 7.5 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in highwarden Super Store Finder superstorefinder-wp allows SQL Injection.This issue affects Super Store Finder: from n/a through = 7.5...

PT-2025-33385 · Creativemindssolutions · Cm On Demand Search/Replace

Name of the Vulnerable Software and Affected Versions: CreativeMindsSolutions CM On Demand Search And Replace versions through 1.5.2 Description: The software contains an Improper Neutralization of Input During Web Page Generation issue, which allows for Stored Cross-site Scripting XSS...

WordPress plugin Integration for Contact Form 7 and Constant Contact 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

PT-2025-33193 · Unknown · Webilop User Language Switch

Name of the Vulnerable Software and Affected Versions: Webilop User Language Switch versions through 1.6.10 Description: The software contains an improper neutralization of input during web page generation, which results in a reflected cross-site scripting XSS issue. Recommendations: Update to a...

PT-2025-33199 · WordPress · Worstguy Wp Lol Rotation

Name of the Vulnerable Software and Affected Versions: worstguy WP LOL Rotation versions n/a through 1.0 Description: The software contains an Improper Neutralization of Input During Web Page Generation issue, leading to a Stored Cross-Site Scripting XSS condition. Recommendations: At the moment,...

PT-2025-33371 · WordPress · Wp Rentals

Name of the Vulnerable Software and Affected Versions: WP Rentals versions through 3.13.1 Description: The software contains an Improper Neutralization of Input During Web Page Generation issue, which allows for Stored Cross-site Scripting XSS. Recommendations: Update WP Rentals to a version late...

PT-2025-33194 · Unknown · Bestiadurmiente Visit Counter

Name of the Vulnerable Software and Affected Versions: BestiaDurmiente Visit Counter versions n/a through 1.0 Description: Improper neutralization of input during web page generation allows for stored cross-site scripting XSS. Recommendations: At the moment, there is no information about a newer...

WordPress plugin Hide Text Shortcode 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

PT-2025-33158 · Unknown · Zoomit Foodmenu

Name of the Vulnerable Software and Affected Versions: ZoomIt FoodMenu versions n/a through 1.20 Description: ZoomIt FoodMenu is susceptible to a reflected cross-site scripting XSS issue due to improper neutralization of input during web page generation. Recommendations: Versions prior to 1.21 ar...