CVE-2025-3752

CVE-2025-3752 involves the Able Player WordPress plugin with a Stored Cross-Site Scripting vulnerability via the preload parameter in versions up to 1.2.1. Exploitation requires authenticated access at Contributor level or higher, enabling injection of scripts that execute when a user loads the a...

CVE-2025-3752 Able Player, accessible HTML5 media player <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via preload Parameter

The Able Player, accessible HTML5 media player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘preload’ parameter in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

Cross-Site Scripting (XSS)

pear/httprequest2 is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to the lack of proper sanitization and escaping of user input in the affected files tests/network/getparameters.php and tests/network/postparameters.php, which allows GET and POST parameters to be reflected...

PT-2025-17890 · WordPress · Custom Admin-Bar Favorites

Name of the Vulnerable Software and Affected Versions: Custom Admin-Bar Favorites plugin for WordPress versions up to, and including, 0.1 Description: The issue is related to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping via the menuObject parameter. Th...

PT-2025-17880 · WordPress · The Contact Form By Bit Form

Name of the Vulnerable Software and Affected Versions: The Contact Form by Bit Form plugin for WordPress versions up to, and including, 2.18.3 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This...

PT-2025-17877 · Unknown · Able Player

Name of the Vulnerable Software and Affected Versions: Able Player versions up to, and including, 1.2.1 Description: The issue is related to Stored Cross-Site Scripting via the preload parameter due to insufficient input sanitization and output escaping. This allows authenticated attackers with...

CVE-2025-3749

The Breeze Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘calsize’ parameter in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level acces...

CVE-2025-1294

The eForm - WordPress Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.18.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...

CVE-2025-1294 eForm <= 4.18.0 - Unauthenticated Stored Cross-Site Scripting

The eForm - WordPress Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.18.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...

CVE-2025-1294

CVE-2025-1294 : The eForm - WordPress Form Builder plugin for WordPress is affected by a stored XSS vulnerability in all versions up to and including 4.18.0, caused by insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary scripts that execu...

CVE-2025-1294 eForm <= 4.18.0 - Unauthenticated Stored Cross-Site Scripting

The eForm - WordPress Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.18.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...

CVE-2025-3749 Breeze Display <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via cal_size Parameter

The Breeze Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘calsize’ parameter in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level acces...

CVE-2025-3832

The FuseDesk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘successredirect’ parameter in all versions up to, and including, 6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level acces...

CVE-2025-2579

The Lottie Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File uploads in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to...

CVE-2025-3832 FuseDesk <= 6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via successredirect Parameter

The FuseDesk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘successredirect’ parameter in all versions up to, and including, 6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level acces...

CVE-2025-2579

CVE-2025-2579 (Lottie Player for WordPress) : The plugin versions up to 1.1.8 are vulnerable to Stored Cross-Site Scripting via file uploads due to insufficient input sanitization/output escaping. Exploitation requires authenticated access at Author level or higher, enabling injection of scripts ...

CVE-2025-2579 Lottie Player <= 1.1.8 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload

The Lottie Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File uploads in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to...

CVE-2025-3832 FuseDesk <= 6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via successredirect Parameter

The FuseDesk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘successredirect’ parameter in all versions up to, and including, 6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level acces...

CVE-2025-3832

Summary (CVE-2025-3832): The FuseDesk WordPress plugin (≤ v6.7) is vulnerable to Stored Cross-Site Scripting via the successredirect parameter due to insufficient input sanitization and output escaping. The issue allows authenticated attackers with at least Contributor privileges to inject and tr...

CVE-2025-2543

CVE-2025-2543 concerns the WordPress plugin Advanced Accordion Gutenberg Block . Multiple connected sources confirm a Stored Cross-Site Scripting (XSS) vulnerability via SVG file uploads, exploitable by authenticated attackers with at least Author-level access. The CVE entry notes impact on versi...