CVE-2025-27309

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jeannot Muller flickr-slideshow-wrapper flickr-slideshow-wrapper allows Stored XSS.This issue affects flickr-slideshow-wrapper: from n/a through = 5.4.6...

CVE-2025-39518

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in RedefiningTheWeb BMA Lite bma-lite-appointment-booking-and-scheduling allows SQL Injection.This issue affects BMA Lite: from n/a through = 1.4.2...

CVE-2025-39586

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows SQL Injection.This issue affects ProfileGrid : from n/a through = 5.9.4.8...

CVE-2025-46499

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in hccoder PayPal Express Checkout paypal-express-checkout allows Stored XSS.This issue affects PayPal Express Checkout: from n/a through = 2.1.2...

CVE-2025-46501

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in biancardi Mixcloud Embed mixcloud-embed allows Stored XSS.This issue affects Mixcloud Embed: from n/a through = 2.2.0...

CVE-2025-46469

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Benjamin Buddle Send From send-from allows Stored XSS.This issue affects Send From: from n/a through = 2.2...

CVE-2025-46469

CVE-2025-46469 (WordPress Send From plugin) is a stored XSS vulnerability caused by improper input neutralization during web page generation. Affected plugin versions are listed as 2.2 and earlier (n/a through 2.2). Connected sources confirm the issue as stored XSS with the potential impact on Wo...

CVE-2025-46451

CVE-2025-46451 is a stored XSS in the WordPress plugin Floating Social Bar , affecting versions up to 1.1.7. Root cause: improper neutralization of input during web page generation. Impact is described as stored cross-site scripting with logs indicating Medium severity (CVSS v3.1 base score 5.9)....

CVE-2025-46529

CVE-2025-46529 describes a stored XSS in the StressFree Sites Business Contact Widget (WordPress plugin) caused by improper input neutralization during web page generation. Affected versions are n/a through 2.7.0. Mitigation: upgrade the widget to a version later than 2.7.0 (exact fixed version n...

CVE-2025-46525

CVE-2025-46525 (WP Cookie Consent) : The vulnerability is an stored XSS caused by improper input neutralization during web page generation in the WordPress plugin WP Cookie Consent (affected: versions 1.0 and earlier). Root cause per sources: improper neutralization of input leading to Cross-site...

CVE-2025-46505 WordPress Peekaboo plugin <= 1.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in farinspace Peekaboo peekaboo allows Stored XSS.This issue affects Peekaboo: from n/a through = 1.1...

CVE-2025-46438

CVE-2025-46438: Stored XSS in GTDB Guitar Tuners (warmwhisky) affecting versions n/a–4.2.2. Root cause is improper input neutralization during web page generation. CVSS v3.1 base score 6.5 (Network, Low to Moderate impact per document; user interaction required). Connected sources indicate no pub...

CVE-2025-46476 WordPress Awesome Wp Image Gallery <= 1.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in nayon46 Awesome Wp Image Gallery allows Stored XSS. This issue affects Awesome Wp Image Gallery: from n/a through 1.0...

CVE-2025-39397

CVE-2025-39397 corresponds to a reflected cross-site scripting vulnerability in the WordPress plugin Anything Popup (versions up to 7.3). The issue arises from improper input neutralization during web page generation, enabling an attacker to inject and execute script in a victim’s browser. The CV...

CVE-2025-46260

CVE-2025-46260 is a stored cross-site scripting (XSS) vulnerability in the WordPress plugin “Sky Addons for Elementor.” The issue arises from improper input neutralization during web page generation, enabling stored XSS. Affected products/versions: Sky Addons for Elementor versions n/a through 3....

PT-2025-17776 · Zoho · Zoho Creator Forms

Name of the Vulnerable Software and Affected Versions: Zoho Creator Forms versions 1.0.0 through 1.0.5 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS in Zoho Creator Forms...

WordPress plugin BruteGuard – Brute Force Login Protection 跨站脚本漏洞

WordPress and the WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...

WordPress plugin Peekaboo 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress plugin User Registration 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPre...

WordPress plugin WP Customize Login Page 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...