PT-2025-17918

Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description A flaw was found in the policy tool of Moodle, where the return URL required additional sanitizing to prevent a reflected Cross-site scripting XSS risk. Recommendations At the moment, there is...

code-projects Online Exam Mastering System 1.0 - Reflected Cross-Site Scripting (XSS)

Exploit Title: code-projects Online Exam Mastering System 1.0 - Reflected Cross-Site Scripting XSS Google Dork: inurl:/exam/feedback.php Date: 2025-04-19 Exploit Author: Pruthu Raut Vendor Homepage: https://code-projects.org/ Software Link:...

ZooEffect <= 1.11 - Reflected Cross-Site Scripting

Description The ZooEffect plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...

CVE-2025-3598

The Coupon Affiliates – Affiliate Plugin for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the commissionsummary parameter in all versions up to, and including, .6.3.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-3598 Coupon Affiliates – Affiliate Plugin for WooCommerce <= 6.3.0 - Reflected Cross-Site Scripting via 'commission_summary' Parameter

The Coupon Affiliates – Affiliate Plugin for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the commissionsummary parameter in all versions up to, and including, .6.3.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-3598

CVE-2025-3598 concerns the Coupon Affiliates – Affiliate Plugin for WooCommerce for WordPress. It is a reflected Cross-Site Scripting vulnerability exploitable via the commission_summary parameter in all versions up to and including 6.3.0, caused by insufficient input sanitization and output esca...

CVE-2025-3598 Coupon Affiliates – Affiliate Plugin for WooCommerce <= 6.3.0 - Reflected Cross-Site Scripting via 'commission_summary' Parameter

The Coupon Affiliates – Affiliate Plugin for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the commissionsummary parameter in all versions up to, and including, .6.3.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-32634

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in mdedev Run Contests, Raffles, and Giveaways with ContestsWP contest-code-checker allows Reflected XSS.This issue affects Run Contests, Raffles, and Giveaways with ContestsWP: from n/a through = 2.1...

CVE-2025-32511

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Excellent Dynamics Make Email Customizer for WooCommerce make-email-customizer-for-woocommerce allows Reflected XSS.This issue affects Make Email Customizer for WooCommerce: from n/a through = 1.0....

CVE-2025-27319

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ivan82 User List user-list allows Reflected XSS.This issue affects User List: from n/a through = 1.5.1...

CVE-2025-27292

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PoppinsDigital.com WPYog Documents wpyog-documents allows Reflected XSS.This issue affects WPYog Documents: from n/a through = 1.3.5...

CVE-2025-23782 WordPress TotalContest Lite Plugin <= 2.8.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in TotalSuite TotalContest Lite totalcontest-lite allows Reflected XSS.This issue affects TotalContest Lite: from n/a through = 2.8.1...

CVE-2025-23855

The CVE-2025-23855 entry affects the WordPress SpiderDisplay plugin (versions n/a through 1.9.1). The issue is an improper neutralization of input during web page generation, enabling Reflected Cross-Site Scripting (XSS). Public-enrichment sources confirm this affects SpiderDisplay up to version ...

CVE-2025-23858 WordPress Custom Users Order Plugin <= 4.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Hiren Patel Custom Users Order custom-users-order allows Reflected XSS.This issue affects Custom Users Order: from n/a through = 4.2...

CVE-2025-24539 WordPress DeBounce Email Validator plugin <= 5.6.5 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in debounce DeBounce Email Validator debounce-io-email-validator allows Reflected XSS.This issue affects DeBounce Email Validator: from n/a through = 5.6.5...

CVE-2025-24539

CVE-2025-24539 concerns the WordPress DeBounce Email Validator plugin

CVE-2025-24539 WordPress DeBounce Email Validator plugin <= 5.6.5 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in debounce DeBounce Email Validator debounce-io-email-validator allows Reflected XSS.This issue affects DeBounce Email Validator: from n/a through = 5.6.5...

CVE-2025-24548

CVE-2025-24548 affects the WordPress plugin Autoglot – Automatic WordPress Translation, with a Reflected XSS vulnerability in versions n/a through 2.4.7 due to improper input neutralization during web page generation. Reported across multiple sources (NVD/Red Hat/CVE List) and corroborated by PT ...

CVE-2025-24553 WordPress Shipping with Venipak for WooCommerce plugin <= 1.22.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Akadrama Shipping with Venipak for WooCommerce wc-venipak-shipping allows Reflected XSS.This issue affects Shipping with Venipak for WooCommerce: from n/a through = 1.22.3...

CVE-2025-24619

The CVE-2025-24619 entry concerns the WordPress plugin WP Log Action (versions 0.51 and earlier). The vulnerability is a Reflected XSS caused by improper input neutralization during web page generation, allowing malicious scripts to be reflected in the response. Public sources (Patchstack, CVE re...