CVE-2025-8689

CVE-2025-8689 : Elements Plus! for WordPress is vulnerable to Stored Cross‑Site Scripting in versions up to 2.16.4 via the plugin’s Image Comparison, HotSpot Plus, and Google Maps widgets. An authenticated attacker with contributor+ privileges can inject scripts that execute when users load an in...

CVE-2025-8689 Elements Plus! <= 2.16.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

The Elements Plus! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Comparison, HotSpot Plus, and Google Maps widgets in all versions up to, and including, 2.16.4 due to insufficient input sanitization and output escaping on user supplied attributes. This...

WordPress Elements Plus! plugin <= 2.16.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Multiple Widgets vulnerability discovered by zer0gh0st in WordPress Plugin Elements Plus! versions = 2.16.4...

CVE-2025-57665

Element Plus Link component el-link through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol...

CVE-2025-8689: Improper Neutralization of Input During Web Page Generation

The Elements Plus! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Comparison, HotSpot Plus, and Google Maps widgets in all versions up to, and including, 2.16.4 due to insufficient input sanitization and output escaping on user supplied attributes. This...

PT-2025-37136

The Elements Plus! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Comparison, HotSpot Plus, and Google Maps widgets in all versions up to, and including, 2.16.4 due to insufficient input sanitization and output escaping on user supplied attributes. This...

WordPress plugin Elements Plus has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...

com.alilitech:boot-plus-generator (>=1.1.0, <=1.3.7), com.alilitech:boot-plus-log (>=1.2.0, <=2.0.5) +35 more potentially affected by CVE-2025-58754 via org.webjars.npm:axios (>=0.5.4, <=0.26.0)

org.webjars.npm:axios MAVEN version =0.5.4, =1.1.0, =1.2.0, =1.1.0, =1.0.0, =1.0.1, =1.6.1, =1.1.71, =1.1.521 - org.webjars.npm:googlemapsgoogle-maps-services-js 3.1.13 - org.webjars.npm:grot-table 1.6.1 and more Source cves: CVE-2025-58754 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-12613774...

Linux Distros Unpatched Vulnerability : CVE-2020-13881

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In support.c in pamtacplus 1.3.8 through 1.5.1, the TACACS+ shared secret gets logged via syslog if the DEBUG loglevel and journald are used. CVE-2020-13881 Not...

Improper Encoding or Escaping of Output

Overview org.webjars.npm:element-plus is an A Component Library for Vue 3 Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the href attribute handling in the el-link component. An attacker can execute arbitrary scripts, redirect users to malicious...

Improper Encoding or Escaping of Output

Overview element-plus is an A Component Library for Vue 3 Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the href attribute handling in the el-link component. An attacker can execute arbitrary scripts, redirect users to malicious sites, or conduct...

GHSA-5M5X-9J46-H678 Element Plus Link component (el-link) implements insufficient input validation for the href attribute

Element Plus Link component el-link prior to 2.11.0 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol...

Element Plus Link component (el-link) implements insufficient input validation for the href attribute

Element Plus Link component el-link prior to 2.11.0 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol...

@142vip/vitepress (>=0.0.1-alpha.14, <=0.0.1-alpha.24), @56jun/fe-chat (>=1.0.0-beta.1, <=1.0.0-beta.26) +612 more potentially affected by CVE-2025-57665 via element-plus (>=2.0.0, <=2.11.0)

element-plus NPM version =2.0.0, =0.0.1-alpha.14, =1.0.0-beta.1, =0.6.1-annotator.1, =1.1.2, =2.4.2-beta.1, =1.1.2, =0.7.0-annotator.0, =1.0.3, =1.4.2, =1.0.1, =3.72.0, =2.0.6, =0.0.0, =0.0.11 and more Source cves: CVE-2025-57665 Source advisory: OSV:GHSA-5M5X-9J46-H678...

@142vip/vitepress (>=0.0.1-alpha.14, <=0.0.1-alpha.24), @56jun/fe-chat (>=1.0.0-beta.1, <=1.0.0-beta.26) +612 more potentially affected by CVE-2025-57665 via element-plus (>=2.0.0, <=2.11.0)

element-plus NPM version =2.0.0, =0.0.1-alpha.14, =1.0.0-beta.1, =0.6.1-annotator.1, =1.1.2, =2.4.2-beta.1, =1.1.2, =0.7.0-annotator.0, =1.0.3, =1.4.2, =1.0.1, =3.72.0, =2.0.6, =0.0.0, =0.0.11 and more Source cves: CVE-2025-57665 Source advisory: GHSA-5M5X-9J46-H678...

1997ckf-ui-comp (>=0.0.9, <=0.0.17), 1data-business (>=0.0.1, <=0.0.3) +6267 more potentially affected by CVE-2025-57665 via element-plus (>=1.0.1-beta.0, <=2.14.7)

element-plus NPM version =1.0.1-beta.0, =0.0.9, =0.0.1, =1.0.0, =0.1.11, =0.1.0, =1.0.0, =0.3.1, =1.0.0-beta.0, =1.0.0, =0.0.1-alpha.10, =0.1.6-alpha.17, =0.1.6-alpha.18 - @17mkh/ui 0.0.2 - @1api/serve 0.1.0 and more Source cves: CVE-2025-57665 Source advisory: SNYK:JS-ELEMENTPLUS-12670415...

CVE-2025-57665

Element Plus Link component el-link through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol...

CVE-2025-55243

Exposure of sensitive information to an unauthorized actor in Microsoft Office Plus allows an unauthorized attacker to perform spoofing over a network...

CVE-2025-55243

Exposure of sensitive information to an unauthorized actor in Microsoft Office Plus allows an unauthorized attacker to perform spoofing over a network...

Microsoft OfficePlus Spoofing Vulnerability

Exposure of sensitive information to an unauthorized actor in Microsoft Office Plus allows an unauthorized attacker to perform spoofing over a network...