Reflected Cross-Site Scripting (Reflected XSS)

yeswiki/yeswiki is vulnerable to reflected cross-site scripting XSS. The vulnerability is due to improper sanitization of user input in the file upload form, which allows attackers to craft malicious links that execute arbitrary scripts in the victim’s browser...

Cross-Site Scripting (XSS)

yeswiki/yeswiki is vulnerable to Reflected Cross-Site Scripting Reflected XSS. The vulnerability is due to insufficient sanitization of user-supplied input in URLs, which allows attackers to inject malicious scripts that are reflected in the server’s response...

Cross-Site Scripting (XSS)

yeswiki/yeswiki is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to insufficient input sanitization of the idformulaire parameter on the /?BazaR endpoint, which allows attackers to perform reflected cross-site scripting attacks to steal session cookies, hijack user sessions,...

CVE-2025-4055

The Multiple Post Type Order plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mpto' shortcode in all versions up to, and including, 1.10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-4220

The Xavins List Subpages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'xls' shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-3860

The CarDealerPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘saleclass' parameter in all versions up to, and including, 6.8.2505.00 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-lev...

CVE-2025-4054

The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the highlights functionality in all versions up to, and including, 4.24.3 Free and = 2.27.4 Premium, due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-4054 Relevanssi <= 4.24.3 (Free) and <= 2.27.4 (Premium) - Unauthenticated Stored Cross-Site Scripting via Search Highlights

The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the highlights functionality in all versions up to, and including, 4.24.3 Free and = 2.27.4 Premium, due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-4054

The CVE-2025-4054 affects Relevanssi – A Better Search (WordPress) in versions up to and including 4.24.3, where insufficient input sanitization and output escaping in the highlights feature allows stored XSS. This enables unauthenticated attackers to inject scripts that execute when users view a...

CVE-2025-4220 Xavin's List Subpages <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Xavins List Subpages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'xls' shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-4220

CVE-2025-4220 affects the WordPress plugin Xavin’s List Subpages. The issue is a Stored Cross-Site Scripting via the plugin’s 'xls' shortcode caused by insufficient input sanitization and output escaping of user-supplied attributes. Attack requires authenticated access at contributor level or hig...

CVE-2025-4220 Xavin's List Subpages <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Xavins List Subpages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'xls' shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-4055 Multiple Post Type Order <= 1.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mpto Shortcode

The Multiple Post Type Order plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mpto' shortcode in all versions up to, and including, 1.10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-4055

CVE-2025-4055 affects the WordPress plugin Multiple Post Type Order (versions up to and including 1.10.0). It is a Stored Cross-Site Scripting flaw in the mpto shortcode caused by insufficient input sanitization and output escaping of user-supplied attributes. Exploitation requires authenticated ...

CVE-2025-3860 CarDealerPress <= 6.8.2505.00 - Authenticated (Contributor+) Stored Cross-Site Scripting via saleclass Parameter

The CarDealerPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘saleclass' parameter in all versions up to, and including, 6.8.2505.00 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-lev...

CVE-2025-4055 Multiple Post Type Order <= 1.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mpto Shortcode

The Multiple Post Type Order plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mpto' shortcode in all versions up to, and including, 1.10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-3860

The CVE-2025-3860 entry concerns the CarDealerPress WordPress plugin. A Stored Cross-Site Scripting vulnerability exists in the saleclass parameter across all versions up to 6.7.2504.00, enabling an authenticated attacker with Contributor-level access or higher to inject scripts that run on pages...

USN-7497-1: CarrierWave vulnerabilities

Rikita Ishikawa discovered that CarrierWave did not correctly sanitize certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. CVE-2021-21305 Norihide Saito discovered that CarrierWave did not correctly...

PT-2025-19915 · WordPress · Multiple Post Type Order

Name of the Vulnerable Software and Affected Versions: Multiple Post Type Order plugin for WordPress versions up to and including 1.10.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'mpto' shortcode due to insufficient input sanitization and output escaping on...

PT-2025-19914

Name of the Vulnerable Software and Affected Versions Relevanssi – A Better Search plugin for WordPress versions up to, and including, 4.24.3 Description The issue is related to Stored Cross-Site Scripting via the highlights functionality due to insufficient input sanitization and output escaping...