CVE-2025-26563

CVE-2025-26563 is described as a Reflected XSS in the WordPress Mobile/NotFound (NotFound Mobile) plugin, with the NotFound Mobile variant affected up to version 1.3.3. The CVE entry cites an improper input handling during web page generation as the root cause, enabling cross-site scripting. The ...

CVE-2025-25164

CVE-2025-25164 affects WordPress Meta Accelerator plugin versions up to 1.0.4, where Reflected XSS arises from improper input neutralization during web page generation. Root cause: improper neutralization of user input leads to reflected cross-site scripting. Impact: XSS could affect pages render...

CVE-2025-25169 WordPress Authors Autocomplete Meta Box plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Rachel Cherry Authors Autocomplete Meta Box authors-autocomplete-meta-box allows Reflected XSS.This issue affects Authors Autocomplete Meta Box: from n/a through = 1.2...

CVE-2025-25165

CVE-2025-25165 affects WordPress Staff Directory Plugin: Company Directory (versions up to 4.3). Vulnerability: Stored XSS due to improper neutralization of input during web page generation. Impact/conditions: the issue is a cross-site scripting vulnerability described in multiple sources; the CV...

CVE-2025-25170

CVE-2025-25170 affects the WordPress Migrate Posts plugin (versions

CVE-2025-25142

CVE-2025-25142 describes a Stored XSS vulnerability in the WordPress WP Less Compiler plugin (versions up to 1.3.0). The issue arises from improper neutralization of input during web page generation, allowing attacker-supplied input to be stored and later reflected in pages. The advisory lists WP...

CVE-2025-25158

CVE-2025-25158 is a reflected Cross-Site Scripting vulnerability in WordPress Uncomplicated SEO plugin (versions

CVE-2025-25161

CVE-2025-25161 concerns the WordPress plugin WP Find Your Nearest (v &lt;= 0.3.1). The connected Red Hat and CVE records describe a CSRF to Settings Change vulnerability that can be exploited to modify plugin settings, implying an unauthorized action may be performed by an attacker authenticated ...

CVE-2025-25162

The CVE-2025-25162 entry concerns WordPress Sports Rankings and Lists plugin (versions up to 1.0.2; CVE-2025-25162) with an Arbitrary File Download vulnerability via path traversal. Public sources (Wordfence, CVE records) indicate the vulnerability affects Sports Rankings and Lists and is current...

CVE-2025-25129

The CVE-2025-25129 entry relates to a WordPress plugin issue: Callback Request (NotFound Callback Request) vulnerability tracked as CVE-2025-25129, affecting versions &lt;= 1.4. The root cause is improper input neutralization during web page generation, enabling reflected cross-site scripting (XS...

CVE-2025-25137

CVE-2025-25137 refers to a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress Social Links plugin, affecting versions up to 1.0.11. The issue stems from improper input handling during web page generation, enabling stored XSS as described in Red Hat and NVD entries. Publicly availabl...

CVE-2025-25133

CVE-2025-25133 describes a Reflected Cross-Site Scripting vulnerability in the WordPress WP Frontend Submit plugin (affecting versions from n/a through 1.1.0). Technical details in connected sources confirm the issue: improper input handling during web page generation enabling XSS. CVSS v3.1 base...

CVE-2025-25121

CVE-2025-25121 is linked to the WordPress Theme Options Z plugin and is documented as a Cross-Site Forgery (CSRF) vulnerability affecting Theme Options Z versions up to 1.4. The connected sources (Red Hat, NVD, CVE listings) indicate a CSRF issue, with related mentions of possible downstream impa...

CVE-2025-25118

CVE-2025-25118 is a Cross-Site Scripting (XSS) vulnerability in the WordPress plugin WPOptin Top Bar – PopUps, affecting versions up to 2.0.8. The issue is an improper neutralization of input during web page generation, yielding a reflected XSS condition. Affected product: WPOptin – AI-Powered To...

CVE-2025-25119

CVE-2025-25119 is a Cross-Site Scripting vulnerability in the WordPress plugin WooCommerce osCommerce Sync (NotFound)

CVE-2025-25109

CVE-2025-25109 affects WP Vehicle Manager

CVE-2025-25112

CVE-2025-25112 affects the WordPress Social Links plugin (vulnerable

CVE-2025-25115

CVE-2025-25115 concerns the WordPress plugin Like dislike plus counter (also listed as Like Dislike Buttons) with a Cross-Site Scripting (XSS) vulnerability that allows stored XSS. The vulnerability affects version

CVE-2025-25084

The CVE-2025-25084 entry concerns the WordPress UniTimetable plugin, affected versions are

CVE-2025-23956 WordPress WP Easy Post Mailer Plugin <= 0.64 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Richard Leishman WP Easy Post Mailer wp-mailer allows Reflected XSS.This issue affects WP Easy Post Mailer: from n/a through = 0.64...