CVE-2025-32523

CVE-2025-32523 is a reflected Cross-Site Scripting vulnerability in the WooCommerce – Payphone Gateway plugin for WordPress. Affected: plugins in the WooCommerce – Payphone Gateway line from unknown (n/a) up to version 3.2.0 . Base score 7.1 (CVSS 3.1, HIGH). Exploitation details/impact are descr...

CVE-2025-31378

CVE-2025-31378 is a Reflected XSS in the Oppso Unit Converter WordPress plugin. Affected software: Oppso Unit Converter

CVE-2025-31379 WordPress Insert HTML Here plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in programphases Insert HTML Here allows Reflected XSS. This issue affects Insert HTML Here: from n/a through 1.0...

CVE-2025-31021

CVE-2025-31021: Reflected XSS in Mobile Smart (Dolby_uk Mobile Smart) due to improper input neutralization during web page generation. Affected: Mobile Smart, versions up to v1.3.16; impact per CVSSv3.1: HIGH (7.1) with network attack vector and user interaction required. Connected docs indicate ...

PT-2025-16080 · Unknown · Miunosoft Task Scheduler

Name of the Vulnerable Software and Affected Versions: miunosoft Task Scheduler versions 1.6.3 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Reflected Cross-site Scripting XSS. This enables potential attackers to...

PT-2025-16060 · Unknown · Sandeep Verma Html5 Video Player With Playlist

Name of the Vulnerable Software and Affected Versions: Sandeep Verma HTML5 Video Player with Playlist versions 2.50 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Reflected Cross-site Scripting XSS. This enables...

PT-2025-16054 · Scand · Scand Multimailer

Name of the Vulnerable Software and Affected Versions: SCAND MultiMailer versions 1.0.3 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Reflected Cross-site Scripting XSS. This enables attackers to inject malicious...

phpIPAM 1.6 - Reflected Cross Site Scripting (XSS)

Exploit Title: phpIPAM 1.6 - Reflected Cross Site Scripting XSS Date: 2024-10-26 Exploit Author: CodeSecLab Vendor Homepage: https://github.com/phpipam/phpipam Software Link: https://github.com/phpipam/phpipam Version: 1.5.1 Tested on: Ubuntu Windows CVE : CVE-2023-24657 PoC:...

PT-2025-16046 · Unknown · Oppso Unit Converter

Name of the Vulnerable Software and Affected Versions: Oppso Unit Converter versions n/a through 1.1.1 Description: The issue is related to improper neutralization of input during web page generation, which allows for Reflected Cross-site Scripting XSS. This enables attackers to inject malicious...

CVE-2025-3421: Improper Neutralization of Input During Web Page Generation

The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'formid' parameter in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping...

PT-2025-16082 · Unknown · Twispay Credit Card Payments

Name of the Vulnerable Software and Affected Versions: Twispay Credit Card Payments versions 2.1.2 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Reflected Cross-site Scripting XSS. This means that an attacker can...

CVE-2025-27350 WordPress Vice Versa plugin <= 2.2.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Hugh Mungus Vice Versa vice-versa allows Reflected XSS.This issue affects Vice Versa: from n/a through = 2.2.3...

CVE-2025-32116 WordPress QR Master plugin <= 1.0.5 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Studi7 QR Master allows Reflected XSS. This issue affects QR Master: from n/a through 1.0.5...

CVE-2025-32114 WordPress 5sterrenspecialist plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in 5sterrenspecialist 5sterrenspecialist allows Reflected XSS. This issue affects 5sterrenspecialist: from n/a through 1.3...

CVE-2025-32114 WordPress 5sterrenspecialist plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in 5sterrenspecialist WordPress 5sterrenspecialist Plugin 5-sterrenspecialist allows Reflected XSS.This issue affects WordPress 5sterrenspecialist Plugin: from n/a through = 1.4...

CVE-2025-32115 WordPress Popping Content Light plugin <= 2.4 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in OTWthemes Popping Content Light allows Reflected XSS. This issue affects Popping Content Light: from n/a through 2.4...

CVE-2024-13874

The Feedify WordPress plugin before 2.4.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13874

The Feedify WordPress plugin before 2.4.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

Moodle 4.4.x < 4.4.2 Multiple Vulnerabilities

According to its self-reported version, the Moodle install hosted on the remote host is 4.1.x prior to 4.1.12, 4.2.x prior to 4.2.9, 4.3.x prior to 4.3.6, or 4.4.x prior to 4.4.2. It is, therefore, affected by multiple vulnerabilities. - A LFI vulnerability when restoring malformed block backups....

Moodle < 4.1.12 Multiple Vulnerabilities

According to its self-reported version, the Moodle install hosted on the remote host is 4.1.x prior to 4.1.12, 4.2.x prior to 4.2.9, 4.3.x prior to 4.3.6, or 4.4.x prior to 4.4.2. It is, therefore, affected by multiple vulnerabilities. - A LFI vulnerability when restoring malformed block backups....