CVE-2025-32551

CVE-2025-32551 (Connector to CiviCRM with CiviMcRestFace) is a Reflected Cross-Site Scripting vulnerability disclosed by Wordfence. Affected product: Connector to CiviCRM with CiviMcRestFace. Vulnerable component: Web page generation input handling within the plugin. Root cause: improper neutrali...

CVE-2025-32534 WordPress Workbox Video from Vimeo & Youtube Plugin Plugin <= 3.2.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Workbox Workbox Video from Vimeo & Youtube allows Reflected XSS. This issue affects Workbox Video from Vimeo & Youtube: from n/a through 3.2.2...

CVE-2025-32538

CVE-2025-32538 is a Reflected XSS in the WordPress plugin Easy Post Duplicator (affected: &lt;=1.0.1). Root cause: improper input neutralization during web page generation. CVSS v3.1 base score 7.1 (HIGH) per Patchstack metrics, with network access, low integrity/availability impact, and user int...

CVE-2025-0125 PAN-OS: Improper Neutralization of Input in the Management Web Interface

An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables a malicious authenticated read-write administrator to impersonate another legitimate authenticated PAN-OS administrator. The attacker must have network access to the...

WordPress Plugin Tournamatch Cross-site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress plugin Mobile Smart has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

WordPress plugin WooCommerce Sales MIS Report has a cross-site scripting vulnerability.

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability exis...

WordPress plugin Automatic Ban IP Cross-site Scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress plugin Easy Post Duplicator has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-16043

Name of the Vulnerable Software and Affected Versions: WP Hide Categories versions prior to 1.0 Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting', which allows Reflected XSS. This problem enables attackers to...

PT-2025-16090

Name of the Vulnerable Software and Affected Versions: KaizenCoders Automatic Ban IP versions 1.0.0 through 1.0.7 Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting'. This allows for Reflected XSS. Recommendations:...

PT-2025-16067

Name of the Vulnerable Software and Affected Versions: Magnigenie RestroPress versions 3.1.8.4 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Reflected Cross-site Scripting XSS. This enables attackers to inject...

PT-2025-16046 · Unknown · Oppso Unit Converter

Name of the Vulnerable Software and Affected Versions: Oppso Unit Converter versions n/a through 1.1.1 Description: The issue is related to improper neutralization of input during web page generation, which allows for Reflected Cross-site Scripting XSS. This enables attackers to inject malicious...

PT-2025-16082 · Unknown · Twispay Credit Card Payments

Name of the Vulnerable Software and Affected Versions: Twispay Credit Card Payments versions 2.1.2 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Reflected Cross-site Scripting XSS. This means that an attacker can...

CVE-2025-0125: Improper Neutralization of Script in Attributes in a Web Page

An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables a malicious authenticated read-write administrator to impersonate another legitimate authenticated PAN-OS administrator. The attacker must have network access to the...

CVE-2025-32211

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Broadstreet Broadstreet Ads broadstreet allows Stored XSS.This issue affects Broadstreet Ads: from n/a through = 1.52.1...

CVE-2025-3469

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/fields/HTMLMultiSelectField.Php. This issue affects MediaWiki: before 1.39.12, 1.42.6,...

CVE-2025-3469

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/fields/HTMLMultiSelectField.Php. This issue affects MediaWiki: before 1.39.12, 1.42.6,...

CVE-2025-22855

An improper neutralization of input during web page generation 'Cross-site Scripting' CWE-79 vulnerability in Fortinet FortiClient before 7.4.1 may allow the EMS administrator to send messages containing javascript code...

CVE-2025-32199

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in eyale-vc Contact Form Builder by vcita contact-form-with-a-meeting-scheduler-by-vcita allows DOM-Based XSS.This issue affects Contact Form Builder by vcita: from n/a through = 4.10.2...