CVE-2025-54013

CVE-2025-54013: Stored XSS in Welcart e-Commerce (WordPress) due to improper input neutralization during web page generation. Affected: Welcart e-Commerce up to version 2.11.16. Exploitation details not provided in the sources. Remediation: update to a version later than 2.11.16 (per patch inform...

BIT-GITLAB-2025-6948 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 17.11 before 17.11.6, 18.0 before 18.0.4, and 18.1 before 18.1.2 that, under certain conditions, could have allowed a successful attacker to execute actions on behalf of users by injecting malicious content...

WordPress plugin Bold Page Builder 跨站脚本漏洞

WordPress Bold Page Builder is a free and open source page builder plugin that allows users to quickly create custom page layouts through a drag and drop interface without writing code. WordPress Bold Page Builder suffers from a cross-site scripting vulnerability that originates from improper inp...

WordPress plugin YayExtra SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection...

WordPress plugin Easy Elementor Addons 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress plugin JetSearch 跨站脚本漏洞

WordPress JetSearch is an AJAX-based search plugin for WordPress , designed for Elementor editor , providing a fast , flexible and beautiful search experience . WordPress JetSearch suffers from a cross-site scripting vulnerability that stems from improper input neutralization, which can be...

WordPress plugin JetElements For Elementor 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress plugin Infility Global 跨站脚本漏洞

WordPress is a set of blogging platform developed using the PHP language, the platform supports personal blog sites on PHP and MySQL servers, WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in the WordPress plugin Infility Global, which stems from improper...

org.jboss.hal:hal-console: Wildfly HAL Console Cross-Site Scripting

A flaw was found in the HAL Console in the Wildfly component, which does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output used as a web page that is served to other users. The attacker must be authenticated as a user that belongs to management groups...

org.jboss.hal:hal-console: Wildfly HAL Console Cross-Site Scripting

A flaw was found in the HAL Console in the Wildfly component, which does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output used as a web page that is served to other users. The attacker must be authenticated as a user that belongs to management groups...

WordPress Halpes Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in WordPress Halpes, which stems from improper input neutralization and can be exploited by an attacker to tamper with web conte...

CVE-2025-6948 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 17.11 before 17.11.6, 18.0 before 18.0.4, and 18.1 before 18.1.2 that, under certain conditions, could have allowed a successful attacker to execute actions on behalf of users by injecting malicious content...

CVE-2025-6948

Summary: CVE-2025-6948 affects GitLab CE/EE releases prior to 17.11.6, 18.0.4, and 18.1.2. The issue is due to improper handling of input that, under certain conditions, could allow an attacker to execute actions on behalf of users by injecting malicious content (a cross-site scripting scenario)....

CVE-2025-53488

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - WikiHiero Extension allows Stored XSS.This issue affects Mediawiki - WikiHiero Extension: from 1.43.X before 1.43.2...

CVE-2025-53488 Stored XSS in WikiHiero

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - WikiHiero Extension allows Stored XSS.This issue affects Mediawiki - WikiHiero Extension: from 1.43.X before 1.43.2...

Wikimedia Mediawiki - MediaSearch Extension 安全漏洞

Wikimedia Mediawiki - MediaSearch Extension is a Wikimedia Foundation extension for search. A security vulnerability exists in Wikimedia Mediawiki - MediaSearch Extension versions prior to 1.39.13 and prior to 1.43.2, which stems from improper input neutralization and could lead to a stored...

Wikimedia Mediawiki - WikiHiero Extension 安全漏洞

Wikimedia Mediawiki - WikiHiero Extension is a Wikimedia Foundation extension for displaying and editing ancient Egyptian hieroglyphics. A security vulnerability exists in Wikimedia Mediawiki - WikiHiero Extension versions prior to 1.43.2, which stems from improper input neutralization and could...

Wikimedia Mediawiki - Quiz Extension 安全漏洞

Wikimedia Mediawiki - Quiz Extension is a quiz tool extension from the Wikimedia Foundation. A security vulnerability exists in Wikimedia Mediawiki - Quiz Extension versions prior to 1.39.13, prior to 1.42.7, and prior to 1.43.2, which stems from improper input neutralization and could lead to...

Wikimedia Mediawiki - FlaggedRevs Extension 安全漏洞

Wikimedia Mediawiki - FlaggedRevs Extension is a Wikimedia Foundation extension for flagging and reviewing revisions. A security vulnerability exists in Wikimedia Mediawiki - FlaggedRevs Extension versions prior to 1.43.2, which stems from improper input neutralization and could lead to a...

WordPress plugin Halpes 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in WordPress Halpes, which stems from improper input neutralization and can be exploited by an attacker to tamper with web conte...