CVE-2025-23746 WordPress CMC MIGRATE plugin <= 0.0.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Edem CMC MIGRATE cmc-migrate allows Reflected XSS.This issue affects CMC MIGRATE: from n/a through = 0.0.3...

CVE-2025-23866 WordPress EU DSGVO Helper Plugin <= 1.0.6.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in E. Marten EU DSGVO Helper dsgvo allows Reflected XSS.This issue affects EU DSGVO Helper: from n/a through = 1.0.6.1...

CVE-2025-23811

CVE-2025-23811 is a reflected XSS vulnerability affecting WP2APP NotFound WP2APP, with affected range up to version 2.6.2. The connected Red Hat and RH Security notes confirm the issue as an input-neutralization failure leading to cross-site scripting. The exact root cause and vendor/product reme...

CVE-2025-23770

CVE-2025-23770 is a reflected XSS affecting the WordPress plugin Fast Tube (notFound Fast Tube), with impact up to version 2.3.1. The CVSS 3.1 base score is 7.1 (HIGH), attack vector NETWORK, attack complexity LOW, privileges NONE, user interaction REQUIRED, and the vulnerability involves imprope...

CVE-2025-23700 WordPress yCyclista plugin <= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in yonisink yCyclista ycyclista allows Reflected XSS.This issue affects yCyclista: from n/a through = 1.2.3...

CVE-2025-23695

CVE-2025-23695 corresponds to a Reflected XSS in the CtyGrid Hyp3rL0cal Search WordPress plugin. The vulnerability is due to improper neutralization of input during web page generation. It affects the CtyGrid Hyp3rL0cal Search WordPress Plugin versions up to 0.1.1.1 (and is tracked in RH/CVE-2025...

CVE-2025-23696

Technical details about CVE-2025-23696 (NotFound Staging CDN reflected XSS) are not publicly disclosed in the provided connected documents. No vendor/version/root-cause or remediation is specified here. Monitor for official updates from Red Hat/NVD for concrete details and patches.

CVE-2025-23679 WordPress FP RSS Category Excluder plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Moshiur Rahman Mehedi FP RSS Category Excluder allows Reflected XSS. This issue affects FP RSS Category Excluder: from n/a through 1.0.0...

CVE-2025-23679 WordPress FP RSS Category Excluder plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Flourish Pixel FP RSS Category Excluder fp-rss-category-excluder allows Reflected XSS.This issue affects FP RSS Category Excluder: from n/a through = 1.0.0...

CVE-2025-23678 WordPress LocalGrid plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Md Imranur Rahman LocalGrid localgrid allows Reflected XSS.This issue affects LocalGrid: from n/a through = 1.0.1...

CVE-2025-23607

CAMOO SMS (Camoo Sarl) is affected by CVE-2025-23607: a Reflected XSS vulnerability described as Improper Neutralization of Input During Web Page Generation, affecting CAMOO SMS versions from n/a through 3.0.1. The Red Hat and ENISA ENISA entries confirm the same CVE description. No exploitation ...

CVE-2025-23535

CVE-2025-23535 describes a Stored XSS in the REAL WordPress Sidebar plugin (drag-and-drop-custom-sidebar). The common detail across sources attributes the issue to improper neutralization of input during web page generation, enabling an unauthenticated attacker to inject/script content in stored ...

CVE-2025-23498 WordPress Translation.Pro plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ContentLocalized Translation.Pro translation-pro allows Reflected XSS.This issue affects Translation.Pro: from n/a through = 1.0.0...

CVE-2025-23498 WordPress Translation.Pro plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NotFound Translation.Pro allows Reflected XSS. This issue affects Translation.Pro: from n/a through 1.0.0...

CVE-2025-23500

CVE-2025-23500 describes a Reflected XSS in the WordPress plugin Simple Custom post type custom field (also listed as Simple Content Construction Kit) that allows input that is not properly neutralized during web page generation. Affected versions are from n/a through 1.0.3. The CVSS/metrics indi...

CVE-2025-23503 WordPress Customizable Captcha and Contact us plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in osolwordpress Customizable Captcha and Contact Us customizable-captcha-and-contact-us-form allows Reflected XSS.This issue affects Customizable Captcha and Contact Us: from n/a through = 1.0.2...

WordPress plugin Content Planner has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-4968 · Unknown · Rezdy Reloaded

Name of the Vulnerable Software and Affected Versions: Rezdy Reloaded versions 1.0.1 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored XSS. This means that an attacker can inject malicious scripts into the website...

WordPress plugin Easy Filtering: Cross-site scripting vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerabili...

WordPress plugin InFunding has a cross-site scripting vulnerability.

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...