CVE-2025-23472

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in flexostudio Flexo Slider flexo-slider allows Reflected XSS.This issue affects Flexo Slider: from n/a through = 1.0013...

CVE-2025-23478

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in cmsaccount Photo Video Store photo-video-store allows Reflected XSS.This issue affects Photo Video Store: from n/a through = 21.07...

CVE-2025-23479

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in melascrivi melascrivi melascrivi allows Reflected XSS.This issue affects melascrivi: from n/a through = 1.4...

CVE-2025-23473

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Punit Bhalodiya Killer Theme Options killer-theme-options allows Reflected XSS.This issue affects Killer Theme Options: from n/a through = 2.0...

CVE-2025-23468

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wrenchpilot Essay Wizard wpCRES essay-wizard-wpcres allows Reflected XSS.This issue affects Essay Wizard wpCRES: from n/a through = 1.0.6.4...

CVE-2025-23446

Cross-Site Request Forgery CSRF vulnerability in KokoenDE WP SpaceContent wp-spacecontent allows Stored XSS.This issue affects WP SpaceContent: from n/a through = 0.4.5...

CVE-2025-23437

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in nordtramper ntp-header-images header-images-rotator allows Reflected XSS.This issue affects ntp-header-images: from n/a through = 1.2...

CVE-2025-26970

CVE-2025-26970 : WordPress Ark Theme Core (ark-core)

CVE-2025-27279

CVE-2025-27279 is a Reflected XSS in the WordPress Flashfader plugin (affected: NotFound Flashfader; versions up to and including 1.1.1). It arises from improper input neutralization during web page generation, enabling reflected cross-site scripting. Public records in the connected documents ide...

CVE-2025-27269

CVE-2025-27269 relates to the WordPress plugin “.htaccess Login block” (vulnerable:

CVE-2025-27274

CVE-2025-27274: WordPress GPX Viewer (NotFound GPX Viewer) is affected up to version 2.2.11 by a path traversal vulnerability. Root cause is a path traversal flaw in the GPX Viewer component. Remediation: update to GPX Viewer 2.2.11 or later (patched). Exploitation details are not provided in the...

CVE-2025-27271

CVE-2025-27271 is a Reflected XSS in the WordPress plugin “DB Tables Import/Export” affecting version range from n/a through 1.0.1. The description identifies improper input neutralization during web page generation as the root cause. Multiple connected sources corroborate the same vulnerability ...

CVE-2025-26588

CVE-2025-26588 describes a reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin TTT Crop . The Initial Description specifies a Reflected XSS affecting “NotFound TTT Crop” from n/a through 1.0. Connected documents corroborate the issue as a Reflected Cross Site Scripting vuln...

CVE-2025-27263

CVE-2025-27263 covers a SQL Injection in WordPress plugin Doctor Appointment Booking (NotFound Doctor Appointment Booking). Affected: Doctor Appointment Booking versions n/a through 1.0.0. Root cause: improper neutralization of input in SQL commands. Impact: confidentiality impact High (as per CV...

CVE-2025-26589

CVE-2025-26589 concerns the WordPress plugin IE CSS3 Support (

CVE-2025-26587

CVE-2025-26587 is a Reflected Cross-Site Scripting vulnerability in WordPress sidebarTabs

CVE-2025-26563 WordPress Rocket Mobile Plugin <= 0.4.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Muneeb Mobile rocket-wp-mobile allows Reflected XSS.This issue affects Mobile: from n/a through = 1.3.3...

CVE-2025-26586

CVE-2025-26586 corresponds to a WordPress plugin issue: WordPress Events Planner

CVE-2025-26585

CVE-2025-26585 — WordPress plugin DL Leadback is affected by a Reflected Cross-Site Scripting (XSS) vulnerability in versions up to 1.2.1 due to improper input neutralization during web page generation. Public sources (NVD/Red Hat/CVE listings) describe the flaw as DL Leadback: notcapped escalati...

CVE-2025-26540

CVE-2025-26540 corresponds to a path traversal vulnerability in the WordPress Helloprint plugin. The affected component is the Helloprint plugin for WordPress, with versions n/a through 2.0.7. Root cause: improper limitation of a pathname to a restricted directory, enabling traversal to access or...