WordPress plugin Blogger Image Import has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...

WordPress plugin Horizontal Line Shortcode Cross-site Script Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

PT-2025-4978

Name of the Vulnerable Software and Affected Versions Captchelfie – Captcha by Selfie versions 1.0.7 and earlier Description The issue is related to improper neutralization of input during web page generation, which allows reflected Cross-site Scripting XSS. This means an attacker can inject...

PT-2025-4934

Name of the Vulnerable Software and Affected Versions LH Login Page versions prior to 2.14 Description The issue is related to improper neutralization of input during web page generation, which allows for reflected Cross-site Scripting XSS. This means that an attacker can inject malicious scripts...

PT-2025-4874

Name of the Vulnerable Software and Affected Versions Altima Lookbook Free for WooCommerce versions 1.1.0 and earlier Description The issue is related to improper neutralization of input during web page generation, which allows for reflected Cross-site Scripting XSS. This means that an attacker c...

PT-2025-5207

Name of the Vulnerable Software and Affected Versions Google Org Chart versions n/a through 1.0.1 Description The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting', which allows stored XSS. This means that an attacker can inject...

PT-2025-5212

Name of the Vulnerable Software and Affected Versions WpF Ultimate Carousel versions 1.0.11 and earlier Description The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker can inject malicio...

PT-2025-5221

Name of the Vulnerable Software and Affected Versions arul PDF.js Shortcode versions n/a through 1.0 Description The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker can inject malicious...

PT-2025-5164

Name of the Vulnerable Software and Affected Versions Scott Reilly Post-to-Post Links versions n/a through 4.2 Description The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting', which allows Stored XSS. This means that an attacke...

PT-2025-5170

Name of the Vulnerable Software and Affected Versions Scott Allan Wallick Blog Summary versions 0.1.2 β and earlier Description The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that an attacker can...

PT-2025-5125

Name of the Vulnerable Software and Affected Versions Strx Magic Floating Sidebar Maker versions 1.4.1 and earlier Description The issue is related to improper neutralization of input during web page generation, which allows for stored Cross-site Scripting XSS. This means that an attacker can...

PT-2025-5144

Name of the Vulnerable Software and Affected Versions Alessandro Staniscia Simple Vertical Timeline versions n/a through 0.1 Description The issue is related to improper neutralization of input during web page generation, which allows for DOM-Based XSS. This means that an attacker could potential...

PT-2025-5175 · Unknown · Progress Tracker

Name of the Vulnerable Software and Affected Versions: Progress Tracker versions 0.9.3 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for DOM-Based XSS. This means that an attacker could potentially inject malicious scrip...

WordPress plugin “Apply with LinkedIn buttons” has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2025-22795

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in digitaldonkey Multilang Contact Form multilang-contact-form allows Reflected XSS.This issue affects Multilang Contact Form: from n/a through = 1.5...

CVE-2025-22766

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Masoud Amini Zarinpal Paid Download zarinpal-paid-downloads allows Reflected XSS.This issue affects Zarinpal Paid Download: from n/a through = 2.3...

CVE-2025-22761

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Olaf Lederer Ajax Contact Form fws-ajax-contact-form allows Stored XSS.This issue affects Ajax Contact Form: from n/a through = 1.4.1...

CVE-2025-22752

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WesternDeal GSheetConnector for Forminator Forms gsheetconnector-forminator allows Reflected XSS.This issue affects GSheetConnector for Forminator Forms: from n/a through = 1.0.12...

CVE-2025-22734

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Data443 Risk Mitigation, Inc. Posts Footer Manager intelly-posts-footer-manager allows Stored XSS.This issue affects Posts Footer Manager: from n/a through = 2.1.0...

CVE-2025-22747

CVE-2025-22747 is a Stored XSS vulnerability in the Foundation Columns plugin for WordPress (Foundation Columns: from n/a through 0.8). The issue is caused by improper neutralization of input during web page generation. Connected sources indicate this CVE has not been patched yet (patch status: U...