CVE-2025-32311 WordPress Pressroom theme <= 7.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in QuanticaLabs Pressroom pressroom allows Reflected XSS.This issue affects Pressroom: from n/a through = 7.0...

WordPress plugin Beautiful Cookie Consent Banner 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...

Streamline NX Client (XSS) (2025-000008)

The version of Streamline NX Client installed on the remote host is between 3.5.0 and 3.7.2. It is, therefore, affected by a reflected cross-site scripting vulnerability via a specific parameter exists in SLNX Help Documentation of RICOH Streamline NX. If this vulnerability is exploited, an...

CVE-2024-11405

The WP Front-end login and register plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the email and wpmpresetpasswordtoken parameters in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-11405 WP Front-end login and register <= 2.1.0 - Reflected Cross-Site Scripting

The WP Front-end login and register plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the email and wpmpresetpasswordtoken parameters in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-11405

WP Front-end login and register for WordPress is vulnerable to Reflected XSS via the email and wpmp_reset_password_token parameters in all versions up to 2.1.0. This allows unauthenticated attackers to inject scripts in pages executed when a user is tricked into clicking a link. The connected doc...

CVE-2025-41439

CVE-2025-41439 describes a reflected cross-site scripting vulnerability in the SLNX Help Documentation of Ricoh Streamline NX. The issue arises from a vulnerable parameter which can cause arbitrary scripts to run in a user’s browser when the product is accessed. Concrete details from connected so...

PT-2025-27426 · Unknown · Daily Expense Manager

Name of the Vulnerable Software and Affected Versions: Daily Expense Manager version 1.0 Description: The issue is a Reflected Cross-Site Scripting XSS vulnerability that allows an attacker to execute JavaScript code. This is achieved by sending a POST request through the password and confirm...

PT-2025-27425 · Unknown · Daily Expense Manager

Name of the Vulnerable Software and Affected Versions: Daily Expense Manager version 1.0 Description: A Reflected Cross-Site Scripting XSS issue exists, allowing an attacker to execute JavaScript code. This is achieved by sending a POST request through the username parameter in the "/login.php" A...

CVE-2025-27361

CVE-2025-27361 concerns the WordPress plugin “Photo Express for Google” (thhake) with versions

CVE-2025-27361 WordPress Photo Express for Google plugin <= 0.3.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in thhake Photo Express for Google photo-express-for-google allows Reflected XSS.This issue affects Photo Express for Google: from n/a through = 0.3.2...

CVE-2025-31428

CVE-2025-31428 describes an unpatched Reflected Cross-Site Scripting (XSS) in the BuddhaThemes HYDRO WordPress theme (versions n/a through 2.8). The vulnerability arises from improper neutralization of user input during web page generation, enabling an attacker to inject scripts via a reflected p...

CVE-2025-31428 WordPress HYDRO theme <= 2.8 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BuddhaThemes HYDRO hydro allows Reflected XSS.This issue affects HYDRO: from n/a through = 2.8...

CVE-2025-39488

CVE-2025-39488 affects WordPress MagOne theme versions &lt;= 8.5. It is a Reflected XSS caused by improper input neutralization during web page generation, with CVSS v3.1 base score 7.1 (HIGH). Public sources indicate the issue is currently unpatched in MagOne (Wordfence listing shows Unpatched; ...

CVE-2025-39488 WordPress MagOne theme <= 8.8 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Sneeit MagOne magone allows Reflected XSS.This issue affects MagOne: from n/a through = 8.8...

CVE-2025-49290 WordPress Off-Canvas Sidebars & Menus (Slidebars) plugin <= 0.5.8.4 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jory Hogeveen Off-Canvas Sidebars & Menus Slidebars off-canvas-sidebars allows Reflected XSS.This issue affects Off-Canvas Sidebars & Menus Slidebars: from n/a through = 0.5.8.4...

WordPress Pressroom theme <= 7.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao KhanhVCI - VNPT in WordPress Theme Pressroom versions = 7.0...

CVE-2025-27828

A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4, 10.1.0.0 through 10.1.0.5, and 10.2.0.0 through 10.2.0.4 could allow an unauthenticated attacker to conduct a reflected cross-site scripting XSS attack due to insufficient input validation. A...

CVE-2025-27828

Mit el MiContact Center Business legacy chat component is affected by CVE-2025-27828. A reflected XSS due to insufficient input validation affects versions 10.0.0.0–10.0.0.4, 10.1.0.0–10.1.0.5, and 10.2.0.0–10.2.0.4. Exploitation requires user interaction and unauthenticated access could allow ex...

CVE-2025-27828

A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4, 10.1.0.0 through 10.1.0.5, and 10.2.0.0 through 10.2.0.4 could allow an unauthenticated attacker to conduct a reflected cross-site scripting XSS attack due to insufficient input validation. A...