EUVD-2025-197963

The Meta Display Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Meta Display Block in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

EUVD-2025-197955

The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'veucustomcss' parameter in all versions up to, and including, 9.112.1. This is due to insufficient input sanitization and output escaping on the user-supplied Custom CSS value. This makes i...

CVE-2025-12823

The CSV to SortTable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'csv' shortcode in all versions up to, and including, 4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...

CVE-2025-12078

The CVE-2025-12078 entry applies to the WordPress plugin “ArtiBot Free Chat Bot for WebSites.” It describes a Reflected Cross-Site Scripting vulnerability via PostMessage in all versions up to and including 1.1.7, caused by insufficient input sanitization and output escaping. The impact is that u...

CVE-2025-12078 ArtiBot Free Chat Bot for WebSites <= 1.1.7 - Reflected Cross-Site Scripting via PostMessage

The ArtiBot Free Chat Bot for WebSites plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2025-12078 ArtiBot Free Chat Bot for WebSites <= 1.1.7 - Reflected Cross-Site Scripting via PostMessage

The ArtiBot Free Chat Bot for WebSites plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2025-8609 RTMKit Addons <= 1.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion Repeater Block Attribute

The RTMKit Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Accordion Block's attributes in all versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...

EUVD-2025-197946

The CSV to SortTable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'csv' shortcode in all versions up to, and including, 4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...

WordPress plugin VK All in One Expansion Unit 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There ar...

PT-2025-47337

Name of the Vulnerable Software and Affected Versions Hospital Management System version 4 Description The Hospital Management System version 4 is susceptible to a SQL Injection issue within the admin-panel1.php file, specifically in the doctor deletion functionality. The application does not...

PT-2025-47248

Name of the Vulnerable Software and Affected Versions VK All in One Expansion Unit plugin for WordPress versions prior to 9.112.1 Description The software is susceptible to Stored Cross-Site Scripting through the veu custom css parameter. Insufficient input sanitization and output escaping on the...

PT-2025-47298

Name of the Vulnerable Software and Affected Versions WinPlus version 24.11.27 Description A SQL injection issue exists in WinPlus version 24.11.27. This allows an attacker to recover, create, update, and delete databases. The issue is triggered by sending a POST request to the...

PT-2025-47288

Name of the Vulnerable Software and Affected Versions Checkout Files Upload for WooCommerce plugin for WordPress versions up to and including 2.2.1 Description The plugin is susceptible to Stored Cross-Site Scripting through file uploads. Insufficient input sanitization and output escaping allow...

CVE-2025-55056

Multiple CWE-79 Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting'...

PT-2025-47196

Name of the Vulnerable Software and Affected Versions PHPGurukul Complaint Management System version 2.0 Description The software is susceptible to a Cross Site Scripting XSS issue. This flaw is located in the between-date-userreport.php script and affects the fromdate and todate parameters...

PT-2025-47189

Name of the Vulnerable Software and Affected Versions PHPGurukul Complaint Management System version 2.0 Description The PHPGurukul Complaint Management System is affected by a Cross Site Scripting XSS issue. This issue occurs through the search parameter in the 'user-search.php' file. Successful...

PT-2025-47011

Name of the Vulnerable Software and Affected Versions Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution versions prior to 4.1 Description A flaw exists in Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution. Manipulation of the Search argument in an unknown...

PT-2025-46968

Name of the Vulnerable Software and Affected Versions PHPGurukul Student Record System version 3.20 Description The Student Record System contains multiple parameters in the ‘register.php’ file that are susceptible to SQL injection. The following parameters are affected: c-full, fname, mname,...

Astro development server error page is vulnerable to reflected Cross-site Scripting

Summary A Reflected Cross-Site Scripting XSS vulnerability exists in Astro's development server error pages when the trailingSlash configuration option is used. An attacker can inject arbitrary JavaScript code that executes in the victim's browser context by crafting a malicious URL. While this...

CVE-2025-11560

The Team Members Showcase WordPress plugin before 3.5.0 does not sanitize and escape a parameter before outputting it back in the page, leading to reflected cross-site scripting, which could be used against high-privilege users such as admins...