CVE-2025-5123

CVE-2025-5123 : The WordPress plugin “Contact Us Page – Contact People” is vulnerable to stored XSS via the style parameter in all versions up to 3.7.4. The issue arises from insufficient input sanitization and output escaping, enabling authenticated attackers with Contributor-level access and hi...

CVE-2025-5123 Contact Us Page – Contact People <= 3.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via style Parameter

The Contact Us Page – Contact People plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ parameter in all versions up to, and including, 3.7.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-4586 IRM Newsroom <= 1.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'irmcalendarview' Shortcode

The IRM Newsroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'irmcalendarview' shortcode in all versions up to, and including, 1.2.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-4586

CVE-2025-4586 affects the WordPress plugin IRM Newsroom (WordPress) up to version 1.2.17; the vulnerability is a stored XSS via the irmcalendarview shortcode due to insufficient input sanitization and output escaping. Exploitation requires an authenticated attacker with contributor-level access o...

CVE-2025-4586 IRM Newsroom <= 1.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'irmcalendarview' Shortcode

The IRM Newsroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'irmcalendarview' shortcode in all versions up to, and including, 1.2.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-5841 ACF Onyx Poll <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter

The ACF Onyx Poll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access a...

CVE-2025-5841

The CVE-2025-5841 entry documents a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress ACF Onyx Poll plugin, affecting versions up to and including 1.1.9. The root cause is insufficient input sanitization and output escaping in the class parameter, enabling authenticated attackers w...

CVE-2025-5950 IndieBlocks <= 0.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via kind Parameter

The IndieBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘kind’ parameter in all versions up to, and including, 0.13.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2025-4584 IRM Newsroom <= 1.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'irmeventlist' Shortcode

The IRM Newsroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'irmeventlist' shortcode in all versions up to, and including, 1.2.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

CVE-2025-4584 IRM Newsroom <= 1.2.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'irmeventlist' Shortcode

The IRM Newsroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'irmeventlist' shortcode in all versions up to, and including, 1.2.17 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

CVE-2025-4584

The CVE-2025-4584 affects the WordPress IRM Newsroom plugin up to version 1.2.17, where an authenticated Contributor+ can exploit the irmeventlist shortcode to perform Stored XSS due to insufficient input sanitization and output escaping. Public references indicate patched status varies; PatchSta...

GHSA-6R3C-XF4W-JXJM Spring Framework vulnerable to a reflected file download (RFD)

Description In Spring Framework, versions 6.0.x as of 6.0.5, versions 6.1.x and 6.2.x, an application is vulnerable to a reflected file download RFD attack when it sets a “Content-Disposition” header with a non-ASCII charset, where the filename attribute is derived from user-supplied input...

PT-2025-25372 · WordPress · Contact Us Page – Contact People

Name of the Vulnerable Software and Affected Versions: Contact Us Page – Contact People plugin for WordPress versions up to, and including, 3.7.4 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping via the style parameter. Th...

PT-2025-25369 · WordPress · Irm Newsroom

Name of the Vulnerable Software and Affected Versions: IRM Newsroom plugin for WordPress versions 1.2.17 and earlier Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'irmeventlist' shortcode due to insufficient input sanitization and output escaping on user-suppli...

PT-2025-29188 · Advantech · Advantech Iview

Name of the Vulnerable Software and Affected Versions: Advantech iView affected versions not specified Description: A vulnerability exists in Advantech iView that allows for SQL injection and remote code execution. The issue is located in the NetworkServlet.archiveTrap function and requires an...

PT-2025-25380 · WordPress · Telegram For Wp

Name of the Vulnerable Software and Affected Versions: Telegram for WP plugin for WordPress versions up to, and including, 1.6.1 Description: The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This allows authenticate...

The vulnerability of the SSLVPN microprogramming software for network interfaces from SonicWall SMA 100 allows a intruder to execute arbitrary commands.

The vulnerability of the SSLVPN microprogramming software for network interfaces from SonicWall SMA 100 relates to the lack of measures taken to neutralize specific elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

PT-2025-25399 · WordPress · Auto Attachments

Name of the Vulnerable Software and Affected Versions: Auto Attachments plugin for WordPress versions up to, and including, 1.8.5 Description: The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This allows authenticat...

PT-2025-25370 · WordPress · Irm Newsroom

Name of the Vulnerable Software and Affected Versions: IRM Newsroom plugin for WordPress versions up to, and including, 1.2.17 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'irmflat' shortcode due to insufficient input sanitization and output escaping on...

PT-2025-25381 · WordPress · Indieblocks

Name of the Vulnerable Software and Affected Versions: IndieBlocks plugin for WordPress versions up to, and including, 0.13.2 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated attackers with...