The vulnerability of the built-in server boa (/boafrm/formWsc) of the TOTOLINK X2000R router’s microprogramming software allows a hacker to execute arbitrary code.

The vulnerability of the built-in server boa /boafrm/formWsc of the TOTOLINK X2000R router microprogramming system is related to the lack of measures to sanitize input data during the processing of the peerRptPin parameter. Exploiting this vulnerability allows a remote attacker to execute arbitra...

PT-2025-24046 · WordPress · Stageshow

Name of the Vulnerable Software and Affected Versions: StageShow plugin for WordPress versions up to, and including, 10.0.3 Description: The issue is related to Stored Cross-Site Scripting via the anchor parameter due to insufficient input sanitization and output escaping. This allows authenticat...

PT-2025-24074 · WordPress · Domain For Sale

Name of the Vulnerable Software and Affected Versions: The Domain For Sale plugin for WordPress versions up to, and including, 3.0.10 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated attackers wi...

PT-2025-24038 · WordPress · Freemind Viewer

Name of the Vulnerable Software and Affected Versions: Freemind Viewer plugin for WordPress versions up to and including 1.0 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the 'freemind' shortcode. This allows authenticated...

Detecting and Mitigating SQL Injection Vulnerabilities in Web Applications

SQL injection SQLi remains a critical vulnerability in web applications, enabling attackers to manipulate databases through malicious inputs. Despite advancements in mitigation techniques, the evolving complexity of web applications and attack strategies continues to pose significant risks. This...

PT-2025-24040 · WordPress · Runners Log

Name of the Vulnerable Software and Affected Versions: Runners Log plugin for WordPress versions up to, and including, 3.9.2 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'runnerslog' shortcode due to insufficient input sanitization and output escaping on...

PT-2025-24045 · WordPress · Developer Formatter

Name of the Vulnerable Software and Affected Versions: Developer Formatter plugin for WordPress versions up to, and including, 2015.0.2.1 Description: The issue is related to Stored Cross-Site Scripting via the Custom CSS, caused by insufficient input sanitization and output escaping. This allows...

PT-2025-24044 · WordPress · Paged Gallery

Name of the Vulnerable Software and Affected Versions: Paged Gallery plugin for WordPress versions up to and including 0.7 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the gallery shortcode. This allows authenticated attacke...

PT-2025-24039 · WordPress · Bns Featured Category

Name of the Vulnerable Software and Affected Versions: BNS Featured Category plugin for WordPress versions up to, and including, 2.8.2 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'bnsfc' shortcode due to insufficient input sanitization and output escaping on...

CVE-2025-4671

The Profile Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's usermeta and compare shortcodes in all versions up to, and including, 3.13.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-5340

The Music Player for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘albumbuyurl’ parameter in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-4205

The Popup Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘popupID' parameter in all versions up to, and including, 1.20.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

CVE-2025-5341

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id' and 'data-size’ parameters in all versions up to, and including, 1.44.1 due to insufficient input sanitization and output escaping. This makes it...

CVE-2025-5341

CVE-2025-5341 affects the WordPress plugin Forminator Forms – Contact Form, Payment Form & Custom Form Builder. The vulnerability is a Stored Cross‑Site Scripting (XSS) caused by insufficient input sanitization and output escaping in the plugin’s handling of the id and data-size parameters, explo...

CVE-2025-4392

The Shared Files – Frontend File Upload Form & Secure File Sharing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via html File uploads in all versions up to, and including, 1.7.48 due to insufficient input sanitization and output escaping within the sanitizefile function. This...

CVE-2025-4420

The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘containerWidth’ parameter in all versions up to, and including, 1.3.1 due to a missing capability check on the vayublocksoptionpanelcallback function and...

CVE-2025-5116

The WP Plugin Info Card plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘containerid’ parameter in all versions up to, and including, 5.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

Cross-site Scripting (XSS)

github.com/forceu/gokapi is vulnerable to Stored Cross-site Scripting XSS. The vulnerability is due to improper input sanitization in the API key renaming feature, which allowed authenticated users to inject JavaScript that would execute when another user accessed the API tab...

USN-7556-1: Bootstrap vulnerabilities

It was discovered that Bootstrap did not correctly sanitize certain input in the carousel component. An attacker could possibly use this issue to execute a cross-site scripting XSS attack. CVE-2024-6484, CVE-2024-6531 It was discovered that Bootstrap did not correctly sanitize certain input in th...

CVE-2025-4224

The wpForo + wpForo Advanced Attachments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via media upload names in all versions up to, and including, 3.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...