CVE-2025-31747

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in milan.latinovic WP Chrono wp-chrono allows DOM-Based XSS.This issue affects WP Chrono: from n/a through = 1.5.4...

CVE-2025-31806

CVE-2025-31806 affects Webling (WordPress plugin Webling). It is a Stored XSS due to improper neutralization of input during web page generation, impacting Webling versions up to 3.9.0. Exploitation requires authentication (Administrator). Wordfence notes the vulnerability and indicates a patch i...

CVE-2025-31801

CVE-2025-31801 affects MX Time Zone Clocks (WordPress plugin). Connected data confirm a Stored XSS issue (authenticated, contributor+) due to input handling, with affected range up to 5.1.1. Publicly available exploitation details or vectors are not provided in the documents. Remediation/patch ve...

CVE-2025-31783

CVE-2025-31783 describes a Stored XSS in the Leartes TRY Exchange Rates WordPress plugin. Affected software: Leartes TRY Exchange Rates

CVE-2025-31754

CVE-2025-31754 affects DobsonDev Shortcodes (

CVE-2025-31749

CVE-2025-31749 describes an authenticated Stored Cross-Site Scripting vulnerability in the WordPress plugin HMH Footer Builder For Elementor (WPelite). Affected: HMH Footer Builder For Elementor

CVE-2025-31740 WordPress News, Magazine and Blog Elements Plugin <= 1.3 - Stored Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in aThemeArt News, Magazine and Blog Elements news-magazine-and-blog-elements allows Stored XSS.This issue affects News, Magazine and Blog Elements: from n/a through = 1.3...

CVE-2025-31730 WordPress Marketer Addons Plugin <= 1.0.1 - Stored Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in DigitalCourt Marketer Addons marketer-addons allows Stored XSS.This issue affects Marketer Addons: from n/a through = 1.0.1...

CVE-2025-30924

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in primersoftware Primer MyData for Woocommerce primer-mydata allows Reflected XSS.This issue affects Primer MyData for Woocommerce: from n/a through 4.2.4...

CVE-2025-30902

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ATL Software SRL AEC Kiosque aec-kiosque allows Reflected XSS.This issue affects AEC Kiosque: from n/a through = 1.9.3...

CVE-2025-30869

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Parakoos Image Wall image-wall allows Reflected XSS.This issue affects Image Wall: from n/a through = 3.0...

CVE-2025-30827

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Saleswonder Team: Tobias WP2LEADS wp2leads allows Reflected XSS.This issue affects WP2LEADS: from n/a through = 3.4.5...

CVE-2025-30544

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in svmidi OK Poster Group ok-poster-group allows Reflected XSS.This issue affects OK Poster Group: from n/a through = 1.1...

CVE-2025-30548

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in VarDump s.r.l. Advanced Post Search advanced-post-search allows Reflected XSS.This issue affects Advanced Post Search: from n/a through = 1.1.0...

CVE-2025-30563

CVE-2025-30563 is a Reflected XSS in the Tidekey WordPress plugin. The connected Wordfence document confirms Tidekey is affected up to version 1.1 (and from n/a through 1.1 per the entry). The initial record lists a CVSS v3.1 base score of 7.1 (HIGH) with network attack vector and user interactio...

Server-Side Request Forgery (SSRF)

Apache Druid is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper neutralization of input during web page generation, which allows a specially crafted URL in the Druid management proxy to redirect requests to an arbitrary server...

Drupal Formatter Suite Vulnerable to Cross-Site Scripting (XSS) via Link Element Attributes

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Formatter Suite allows Cross-Site Scripting XSS.This issue affects Formatter Suite: from 0.0.0 before 2.1.0...

Drupal Core Potential Cross-Site Scripting (XSS) via Error Messages

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Drupal core allows Cross-Site Scripting XSS.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3...

GHSA-5R66-VGC7-2MM3 Drupal Formatter Suite Vulnerable to Cross-Site Scripting (XSS) via Link Element Attributes

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Formatter Suite allows Cross-Site Scripting XSS.This issue affects Formatter Suite: from 0.0.0 before 2.1.0...

GHSA-36VV-Q5JV-94CJ Drupal Google Tag Cross-Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Google Tag allows Cross-Site Scripting XSS. This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8...