WordPress plugin AZ Content Finder has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-5055 · Unknown · Flx Dashboard Groups

Name of the Vulnerable Software and Affected Versions: FLX Dashboard Groups versions 0.0.0 through 0.0.7 Description: The issue is related to improper neutralization of input during web page generation, which allows for reflected cross-site scripting XSS. This means an attacker can inject malicio...

PT-2025-4984 · Kumihimo · Kumihimo

Name of the Vulnerable Software and Affected Versions: Kumihimo versions n/a through 1.0.2 Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting', which allows reflected XSS. This enables an attacker to inject malicio...

WordPress plugin GeoDigs has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...

CVE-2025-23882

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in misanthrop WP Download Codes wp-download-codes allows Reflected XSS.This issue affects WP Download Codes: from n/a through = 2.5.4...

CVE-2025-23769

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in dreamsofmatter Content Mirror content-mirror allows Reflected XSS.This issue affects Content Mirror: from n/a through = 1.2...

CVE-2025-23746

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Edem CMC MIGRATE cmc-migrate allows Reflected XSS.This issue affects CMC MIGRATE: from n/a through = 0.0.3...

CVE-2025-23674

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in andygauk Bit.ly linker bitly-linker allows Reflected XSS.This issue affects Bit.ly linker: from n/a through = 1.1...

CVE-2025-23535

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in martinziegert REAL WordPress Sidebar drag-and-drop-custom-sidebar allows Stored XSS.This issue affects REAL WordPress Sidebar: from n/a through = 0.1...

CVE-2025-23500

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in faaiq Simple Custom post type custom field simple-content-construction-kit allows Reflected XSS.This issue affects Simple Custom post type custom field: from n/a through = 1.0.3...

CVE-2025-23746

CVE-2025-23746 is a reflected Cross‑Site Scripting issue in the CMC MIGRATE plugin for WordPress (NotFound) affecting versions up to 0.0.3. The connected Red Hat entry reiterates the description and target software (CMC MIGRATE) but does not provide concrete exploitation details or a published fi...

CVE-2025-23811

CVE-2025-23811 is a reflected XSS vulnerability affecting WP2APP NotFound WP2APP, with affected range up to version 2.6.2. The connected Red Hat and RH Security notes confirm the issue as an input-neutralization failure leading to cross-site scripting. The exact root cause and vendor/product reme...

CVE-2025-23866 WordPress EU DSGVO Helper Plugin <= 1.0.6.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in E. Marten EU DSGVO Helper dsgvo allows Reflected XSS.This issue affects EU DSGVO Helper: from n/a through = 1.0.6.1...

CVE-2025-23770

CVE-2025-23770 is a reflected XSS affecting the WordPress plugin Fast Tube (notFound Fast Tube), with impact up to version 2.3.1. The CVSS 3.1 base score is 7.1 (HIGH), attack vector NETWORK, attack complexity LOW, privileges NONE, user interaction REQUIRED, and the vulnerability involves imprope...

CVE-2025-23700 WordPress yCyclista plugin <= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in yonisink yCyclista ycyclista allows Reflected XSS.This issue affects yCyclista: from n/a through = 1.2.3...

CVE-2025-23696

Technical details about CVE-2025-23696 (NotFound Staging CDN reflected XSS) are not publicly disclosed in the provided connected documents. No vendor/version/root-cause or remediation is specified here. Monitor for official updates from Red Hat/NVD for concrete details and patches.

CVE-2025-23695

CVE-2025-23695 corresponds to a Reflected XSS in the CtyGrid Hyp3rL0cal Search WordPress plugin. The vulnerability is due to improper neutralization of input during web page generation. It affects the CtyGrid Hyp3rL0cal Search WordPress Plugin versions up to 0.1.1.1 (and is tracked in RH/CVE-2025...

CVE-2025-23678 WordPress LocalGrid plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Md Imranur Rahman LocalGrid localgrid allows Reflected XSS.This issue affects LocalGrid: from n/a through = 1.0.1...

CVE-2025-23679 WordPress FP RSS Category Excluder plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Flourish Pixel FP RSS Category Excluder fp-rss-category-excluder allows Reflected XSS.This issue affects FP RSS Category Excluder: from n/a through = 1.0.0...

CVE-2025-23607

CAMOO SMS (Camoo Sarl) is affected by CVE-2025-23607: a Reflected XSS vulnerability described as Improper Neutralization of Input During Web Page Generation, affecting CAMOO SMS versions from n/a through 3.0.1. The Red Hat and ENISA ENISA entries confirm the same CVE description. No exploitation ...