CVE-2025-23650

CVE-2025-23650 describes a reflected XSS vulnerability in the WordPress plugin “Tidy.ro” by razvypp. The Red Hat and NVD entries confirm the flaw as an Improper Neutralization of Input During Web Page Generation, enabling Reflected XSS for Tidy.ro versions up to 1.3 (development and affected scop...

CVE-2025-23652

Summary (CVE-2025-23652): A WordPress plugin issue in Add custom content after post (notFound) exhibits Reflected Cross-Site Scripting due to improper input neutralization during web page generation. Affected versions are n/a through 1.0. The Red Hat and PT Security entries explicitly note the vu...

CVE-2025-23651

CVE-2025-23651 is a Reflected Cross-Site Scripting vulnerability in the WordPress Scroll Top plugin (NotFound Scroll Top) affecting versions up to 1.3.3. The issue stems from improper input neutralization during web page generation, enabling XSS in reflected context. Public references in multiple...

CVE-2025-23571

CVE-2025-23571 is a reflected XSS in WordPress Internal Links Generator (plugin)

CVE-2025-23647

CVE-2025-23647 is a WordPress WP-Clap plugin vulnerability: an improper neutralization of input leading to Reflected XSS affecting WP-Clap versions up to 1.5. The CVE lists a CVSS v3.1 base score of 7.1 (HIGH) with Network attack vector, Low confidentiality/integrity/availability impacts, and use...

WordPress plugin: Contact Form with Shortcode – Cross-site Script Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists i...

CVE-2025-24592: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in SysBasics Customize My Account for WooCommerce customize-my-account-for-woocommerce allows Reflected XSS.This issue affects Customize My Account for WooCommerce: from n/a through = 2.8.22...

PT-2025-7022 · Wp2Leads · Wp2Leads

Name of the Vulnerable Software and Affected Versions: WP2LEADS versions prior to 3.3.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables attackers to inject malicious scripts...

WordPress plugin “Customize My Account for WooCommerce” has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress plugin QMean – WordPress Did You Mean Cross-site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. WordPress plugin QMean - WordPress Did You Mean 2.0 an...

PT-2025-7029

Name of the Vulnerable Software and Affected Versions: Uix Page Builder versions 1.7.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to inje...

PT-2025-6998

Name of the Vulnerable Software and Affected Versions: Contact Form 7 – Paystack Add-on versions 1.2.3 and earlier Description: The issue is related to improper neutralization of input during web page generation, which can lead to Cross-site Scripting XSS, specifically Reflected XSS...

PT-2025-6981

Name of the Vulnerable Software and Affected Versions: QMean – WordPress Did You Mean versions 2.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS attacks...

PT-2025-7030

Name of the Vulnerable Software and Affected Versions: AcyMailing SMTP Newsletter affected versions not specified Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS in AcyMailing SMTP...

CVE-2025-23568: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in fredsted WP Login Attempt Log wp-login-attempt-log allows Reflected XSS.This issue affects WP Login Attempt Log: from n/a through = 1.3...

CVE-2025-23431: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in khaninejad Envato Affiliater envato-affiliater allows Reflected XSS.This issue affects Envato Affiliater: from n/a through = 1.2.4...

CVE-2025-23525: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in kvvaradha Kv Compose Email From Dashboard kv-send-email-from-admin allows Reflected XSS.This issue affects Kv Compose Email From Dashboard: from n/a through = 1.1...

CVE-2025-24688: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in brandtoss WP Mailster wp-mailster allows Reflected XSS.This issue affects WP Mailster: from n/a through = 1.8.20.0...

CVE-2025-23786: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in DuoGeek Email to Download email-to-download allows Reflected XSS.This issue affects Email to Download: from n/a through = 3.1.0...

CVE-2025-26789: Improper Neutralization of Special Elements Used in a Template Engine

An issue was discovered in Logpoint AgentX before 1.5.0. A vulnerability caused by limited access controls allowed li-admin users to access sensitive information about AgentX Manager in a Logpoint deployment...