Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via the X-Islandora-Args header. An attacker can execute arbitrary code on the server by sending a crafted request containing malicious inp...

Progress Telerik UI command injection vulnerability

Progress Telerik UI is a suite of UI user interface controls for application development from Progress, Inc. A command injection vulnerability exists in Progress Telerik UI prior to version 2025 Q1, which stems from a command injection attack that can be performed by incorrectly neutralizing...

CVE-2024-13543: Improper Neutralization of Input During Web Page Generation

The Zarinpal Paid Download WordPress plugin through 2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

Fortinet FortiWeb operating system command injection vulnerability

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning, and other attacks to secure web applications and protect sensitive database content. Fortinet FortiWeb suffers from an operating...

CVE-2025-25105

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in coffeestudios Pop Up popup-seo-optimized allows Stored XSS.This issue affects Pop Up: from n/a through = 0.1...

CVE-2025-22653

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in tuyennv Music Press Pro music-press-pro allows Stored XSS.This issue affects Music Press Pro: from n/a through = 1.4.6...

CVE-2025-22664

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ays Pro Survey Maker survey-maker allows Stored XSS.This issue affects Survey Maker: from n/a through = 5.1.3.5...

CVE-2024-52882

An issue was discovered in AudioCodes One Voice Operations Center OVOC before 8.4.582. Due to improper neutralization of input via the devices API, an attacker can inject malicious JavaScript code XSS to attack logged-in administrator sessions...

CVE-2025-25159

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in robertkolatzek WP doodlez wpdoodlez allows Stored XSS.This issue affects WP doodlez: from n/a through = 1.0.10...

CVE-2025-25117

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Alex Polonski Smart Countdown FX smart-countdown-fx allows Stored XSS.This issue affects Smart Countdown FX: from n/a through = 1.5.5...

CVE-2025-25098

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Zack Katz Links in Captions links-in-captions allows Stored XSS.This issue affects Links in Captions: from n/a through = 1.2...

CVE-2025-25078

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Andrew Norcross Google Earth Embed google-earth-tours allows Stored XSS.This issue affects Google Earth Embed: from n/a through = 1.0...

CVE-2025-25159

CVE-2025-25159 affects the WordPress plugin WP doodlez. The vulnerability is a Stored Cross-Site Scripting (XSS) due to improper input neutralization during web page generation, impacting WP doodlez versions up to 1.0.10. The available connected documents confirm affected software and the XSS nat...

CVE-2025-25105 WordPress Pop Up Plugin <= 0.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in coffeestudios Pop Up allows Stored XSS. This issue affects Pop Up: from n/a through 0.1...

CVE-2025-25096 WordPress RSS in Page plugin <= 2.9.1 - Stored Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in titusbicknell RSS in Page allows Stored XSS. This issue affects RSS in Page: from n/a through 2.9.1...

CVE-2025-25080 WordPress Kona Gallery Block plugin <= 1.7 - Stored Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in gubbigubbi Kona Gallery Block kona-instagram-feed-for-gutenberg allows Stored XSS.This issue affects Kona Gallery Block: from n/a through = 1.7...

CVE-2025-25080

CVE-2025-25080 is a stored XSS in the WordPress Kona Gallery Block (versions up to 1.7). The vulnerability arises from improper input neutralization during web page generation. Public records identify the affected software as Kona Gallery Block

CVE-2025-25073

CVE-2025-25073 describes a Stored XSS in Easy WP Tiles for WordPress, caused by improper input neutralization during web page generation. Affected: Easy WP Tiles versions n/a through 1. The provided documents do not include exploitation details or a confirmed patch/remediation version. Related so...

CVE-2025-24602

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP24 WP24 Domain Check wp24-domain-check allows Reflected XSS.This issue affects WP24 Domain Check: from n/a through = 1.10.14...

CVE-2025-24598

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in brandtoss WP Mailster wp-mailster allows Reflected XSS.This issue affects WP Mailster: from n/a through = 1.8.17.0...