35316 matches found
WordPress plugin PDF for WPForms + Drag and Drop Template Builder – Cross-site scripting vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerabili...
CVE-2024-12593: Improper Neutralization of Input During Web Page Generation
The PDF for WPForms + Drag and Drop Template Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's yeepdfdotab shortcode in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This...
Server-side Request Forgery (SSRF)
Overview hillelcoren/invoice-ninja is an Invoices, expenses & time-tracking built with Laravel Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the PDF rendering functionality. Remediation Upgrade hillelcoren/invoice-ninja to version 5.11.8 or higher...
CVE-2024-50807
Trippo Responsive Filemanager 9.14.0 is vulnerable to Cross Site Scripting XSS via file upload using the svg and pdf extensions...
CVE-2024-50807
Trippo Responsive Filemanager 9.14.0 is vulnerable to Cross Site Scripting XSS via file upload using the svg and pdf extensions...
CVE-2024-50807
Trippo Responsive Filemanager 9.14.0 is vulnerable to Cross Site Scripting XSS via file upload using the svg and pdf extensions...
CVE-2024-50807: Improper Neutralization of Input During Web Page Generation
Trippo Responsive Filemanager 9.14.0 is vulnerable to Cross Site Scripting XSS via file upload using the svg and pdf extensions...
CVE-2024-50807
Trippo Responsive Filemanager 9.14.0 is vulnerable to Cross Site Scripting XSS via file upload using the svg and pdf extensions...
CVE-2024-50807
Trippo Responsive Filemanager 9.14.0 is vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. The vulnerability is triggered specifically when uploading files with svg and pdf extensions, which may allow for the execution of malicious scripts...
CVE-2025-22809
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in theme funda PDF Catalog Woocommerce pdf-catalog-woocommerce allows DOM-Based XSS.This issue affects PDF Catalog Woocommerce: from n/a through = 2.0...
CVE-2025-22809
CVE-2025-22809 is a DOM-based XSS in PDF Catalog Woocommerce (WordPress plugin) caused by improper input neutralization during web page generation. Affected: PDF Catalog Woocommerce up to version 2.0. Patch status: Patched (per Wordfence vulnerability entry). Exploitation details are not provided...
CVE-2025-22809 WordPress PDF Catalog Woocommerce plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in theme funda PDF Catalog Woocommerce pdf-catalog-woocommerce allows DOM-Based XSS.This issue affects PDF Catalog Woocommerce: from n/a through = 2.0...
CVE-2025-22809 WordPress PDF Catalog Woocommerce plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in theme funda PDF Catalog Woocommerce pdf-catalog-woocommerce allows DOM-Based XSS.This issue affects PDF Catalog Woocommerce: from n/a through = 2.0...
[SECURITY] Fedora 40 Update: mupdf-1.24.6-2.fc40
MuPDF is a lightweight PDF viewer and toolkit written in portable C. The renderer in MuPDF is tailored for high quality anti-aliased graphics. MuPDF renders text with metrics and spacing accurate to within fractions of a pixel for the highest fidelity in reproducing the look of a printed page on...
PT-2025-4718
Name of the Vulnerable Software and Affected Versions Gravity Master PDF Catalog Woocommerce versions n/a through 2.0 Description The issue is related to improper neutralization of input during web page generation, which allows for DOM-Based XSS. This means that an attacker could potentially inje...
CVE-2025-22809: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in theme funda PDF Catalog Woocommerce pdf-catalog-woocommerce allows DOM-Based XSS.This issue affects PDF Catalog Woocommerce: from n/a through = 2.0...
CVE-2024-11830 Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer <= 2.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting
The PDF Flipbook, 3D Flipbook—DearFlip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via outline settings in all versions up to 2.3.52 due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for authenticated attackers with...
CVE-2024-11830 Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer <= 2.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting
The PDF Flipbook, 3D Flipbook—DearFlip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via outline settings in all versions up to 2.3.52 due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for authenticated attackers with...
CVE-2024-11830
CVE-2024-11830 affects Dear Flipbook – PDF Flipbook, 3D Flipbook (WordPress plugin) up to version 2.3.52, enabling Stored XSS via outline settings with authenticated (contributor+) access. Wordfence notes patched status (no exploit/vector details provided in the documents). Red Hat and other entr...