CVE-2025-23446

Cross-Site Request Forgery CSRF vulnerability in KokoenDE WP SpaceContent wp-spacecontent allows Stored XSS.This issue affects WP SpaceContent: from n/a through = 0.4.5...

CVE-2025-23437

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in nordtramper ntp-header-images header-images-rotator allows Reflected XSS.This issue affects ntp-header-images: from n/a through = 1.2...

CVE-2025-26970

CVE-2025-26970 : WordPress Ark Theme Core (ark-core)

CVE-2025-27279

CVE-2025-27279 is a Reflected XSS in the WordPress Flashfader plugin (affected: NotFound Flashfader; versions up to and including 1.1.1). It arises from improper input neutralization during web page generation, enabling reflected cross-site scripting. Public records in the connected documents ide...

CVE-2025-27269

CVE-2025-27269 relates to the WordPress plugin “.htaccess Login block” (vulnerable:

CVE-2025-27274

CVE-2025-27274: WordPress GPX Viewer (NotFound GPX Viewer) is affected up to version 2.2.11 by a path traversal vulnerability. Root cause is a path traversal flaw in the GPX Viewer component. Remediation: update to GPX Viewer 2.2.11 or later (patched). Exploitation details are not provided in the...

CVE-2025-27271

CVE-2025-27271 is a Reflected XSS in the WordPress plugin “DB Tables Import/Export” affecting version range from n/a through 1.0.1. The description identifies improper input neutralization during web page generation as the root cause. Multiple connected sources corroborate the same vulnerability ...

CVE-2025-26588

CVE-2025-26588 describes a reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin TTT Crop . The Initial Description specifies a Reflected XSS affecting “NotFound TTT Crop” from n/a through 1.0. Connected documents corroborate the issue as a Reflected Cross Site Scripting vuln...

CVE-2025-27263

CVE-2025-27263 covers a SQL Injection in WordPress plugin Doctor Appointment Booking (NotFound Doctor Appointment Booking). Affected: Doctor Appointment Booking versions n/a through 1.0.0. Root cause: improper neutralization of input in SQL commands. Impact: confidentiality impact High (as per CV...

CVE-2025-26589

CVE-2025-26589 concerns the WordPress plugin IE CSS3 Support (

CVE-2025-26585

CVE-2025-26585 — WordPress plugin DL Leadback is affected by a Reflected Cross-Site Scripting (XSS) vulnerability in versions up to 1.2.1 due to improper input neutralization during web page generation. Public sources (NVD/Red Hat/CVE listings) describe the flaw as DL Leadback: notcapped escalati...

CVE-2025-26587

CVE-2025-26587 is a Reflected Cross-Site Scripting vulnerability in WordPress sidebarTabs

CVE-2025-26540

CVE-2025-26540 corresponds to a path traversal vulnerability in the WordPress Helloprint plugin. The affected component is the Helloprint plugin for WordPress, with versions n/a through 2.0.7. Root cause: improper limitation of a pathname to a restricted directory, enabling traversal to access or...

CVE-2025-26586

CVE-2025-26586 corresponds to a WordPress plugin issue: WordPress Events Planner

CVE-2025-26563

CVE-2025-26563 is described as a Reflected XSS in the WordPress Mobile/NotFound (NotFound Mobile) plugin, with the NotFound Mobile variant affected up to version 1.3.3. The CVE entry cites an improper input handling during web page generation as the root cause, enabling cross-site scripting. The ...

CVE-2025-26563 WordPress Rocket Mobile Plugin <= 0.4.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Muneeb Mobile rocket-wp-mobile allows Reflected XSS.This issue affects Mobile: from n/a through = 1.3.3...

CVE-2025-25169 WordPress Authors Autocomplete Meta Box plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Rachel Cherry Authors Autocomplete Meta Box authors-autocomplete-meta-box allows Reflected XSS.This issue affects Authors Autocomplete Meta Box: from n/a through = 1.2...

CVE-2025-25164

CVE-2025-25164 affects WordPress Meta Accelerator plugin versions up to 1.0.4, where Reflected XSS arises from improper input neutralization during web page generation. Root cause: improper neutralization of user input leads to reflected cross-site scripting. Impact: XSS could affect pages render...

CVE-2025-25165

CVE-2025-25165 affects WordPress Staff Directory Plugin: Company Directory (versions up to 4.3). Vulnerability: Stored XSS due to improper neutralization of input during web page generation. Impact/conditions: the issue is a cross-site scripting vulnerability described in multiple sources; the CV...

CVE-2025-25170

CVE-2025-25170 affects the WordPress Migrate Posts plugin (versions