CVE-2025-28903

CVE-2025-28903 is a reflected XSS in Driving Directions (WordPress plugin). The entry indicates improper input neutralization during web page generation, enabling reflected XSS. Reported as affecting Driving Directions: from n/a through 1.4.4, with CVSS v3.1 base score 7.1 (HIGH) and network atta...

CVE-2025-28917

CVE-2025-28917 : WordPress/Plugin Custom Smilies vulnerability with cross-site scripting (Stored XSS) due to improper neutralization of input during web page generation. Affected: Custom Smilies versions up to 2.9.2 (WordPress plugin). Connected documents confirm this CVE ID corresponds to the XS...

CVE-2025-28916 WordPress Docpro plugin <= 2.0.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Rashid Docpro docpro allows PHP Local File Inclusion.This issue affects Docpro: from n/a through = 2.0.1...

CVE-2025-28921

CVE-2025-28921 is a Reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin SpatialMatch IDX (NotFound SpatialMatch IDX). Affected versions are up to 3.0.9. The CVE description notes improper neutralization of input during web page generation, enabling reflected XSS. The associ...

CVE-2025-28889

CVE-2025-28889 is a reflected Cross-Site Scripting in the WordPress plugin “Custom Product Stickers for Woocommerce.” The connected Wordfence vulnerability listing specifies: affected software is Custom Product Stickers for Woocommerce (up to 1.9.0); vulnerability type: Reflected XSS; CVSS v3.1 b...

CVE-2025-28893

CVE-2025-28893 affects the WordPress plugin Visual Text Editor (versions up to 1.2.1). The vulnerability is described as a code-generation/remote code execution issue, with the CWE suggesting code injection via generation of code, and the CVE entry noting Remote Code Execution . The issue appears...

CVE-2025-28898

CVE-2025-28898 affects WP Multistore Locator (up to 2.5.2). It is an unauthenticated SQL Injection caused by improper input neutralization. Documented impact includes data access via SQL injection; no exploits or patch/version fix details are provided in the connected sources. Monitor for updates...

CVE-2025-28873

CVE-2025-28873 describes an SQL injection vulnerability in the WordPress Shuffle plugin that allows an authenticated (Subscriber) attacker to perform blind SQL injection. The issue is triggered via improper neutralization of input in SQL commands, leading to potential data exposure and high impac...

CVE-2025-28869

NextGEN Gallery Voting has a Reflected XSS vulnerability (CVE-2025-28869) that affects NextGEN Gallery Voting: from n/a through 2.7.6. The description specifies improper neutralization of input during web page generation as the root cause. The connected documents do not provide technical details ...

CVE-2025-28855

CVE-2025-28855 – Teleport (WordPress plugin) : Reflected XSS due to improper input neutralization in web page generation. Affected: Teleport up to version 1.2.4. Connected sources confirm the issue (CVE entry) and list Teleport as vulnerable to Reflected Cross-Site Scripting; no explicit fix/vers...

CVE-2025-26559

CVE-2025-26559 is a Reflected Cross-Site Scripting (XSS) vulnerability in the WordPress Secure Invites plugin. The CVE references NotFound Secure Invites and indicates an impact on Secure Invites versions up to 1.3. Connected documents specify a WordPress plugin context (Secure Invites) and list ...

CVE-2025-26566

CVE-2025-26566 – NotFound In Stock Mailer for WooCommerce is a Reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin In Stock Mailer for WooCommerce, affecting versions up to 2.1.1. The issue arises from improper input neutralization during web page generation, enabling refle...

CVE-2025-26560 WordPress WP Contact Form III Plugin <= 1.6.2d - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in KKWangen WP Contact Form III wp-contact-form-iii allows Reflected XSS.This issue affects WP Contact Form III: from n/a through = 1.6.2d...

CVE-2025-26560

CVE-2025-26560 describes a Reflected XSS in the WordPress plugin WP Contact Form III (notFound WP Contact Form III) affecting versions up to 1.6.2d. The root cause is improper input neutralization during web page generation. The connected Red Hat/Reddit Wordfence entries corroborate the vulnerabi...

CVE-2025-26544

CVE-2025-26544 affects the WordPress plugin setup for UTM tags tracking in Contact Form 7 (versions

CVE-2025-26546

CVE-2025-26546: A CSRF to Stored XSS vulnerability in WordPress Cookies Pro (versions

CVE-2025-26537

CVE-2025-26537 affects the WordPress plugin GDPR Tools (notFound GDPR Tools) with versions

CVE-2025-25134

CVE-2025-25134 concerns the WordPress plugin WordPress Theme Demo Bar (also referenced as Theme Demo Bar) with versions up to and including 1.6.3 . The vulnerability is described as an improper neutralization of input during web page generation that enables a Reflected Cross-Site Scripting (XSS) ...

CVE-2025-23714

CVE-2025-23714 corresponds to a reflected Cross-Site Scripting (XSS) flaw in the WordPress AppReview plugin (versions up to 0.2.9; NotFound AppReview). The root cause is improper input neutralization during web page generation, enabling a reflected XSS payload. Public disclosures and connected so...

CVE-2025-23728 WordPress AuMenu plugin <= 1.1.5 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in atelierhyper AuMenu aumenu allows Reflected XSS.This issue affects AuMenu: from n/a through = 1.1.5...