CVE-2025-32670 WordPress Spark GF Failed Submissions plugin <= 1.3.5 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Mark Parnell Spark GF Failed Submissions allows Reflected XSS. This issue affects Spark GF Failed Submissions: from n/a through 1.3.5...

CVE-2025-32670

CVE-2025-32670 is a reflected XSS vulnerability in WordPress Spark GF Failed Submissions (versions up to 1.3.5). The root cause is improper input neutralization during web page generation. CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base score 7.1 (HIGH). Public references in the conne...

CVE-2025-39519

CVE-2025-39519 is a reflected XSS in the WordPress plugin Bulk Page Stub Creator (versions n/a–1.1) due to improper input neutralization during web page generation. The issue enables a reflected payload to be delivered via user-supplied input, potentially compromising visitor sessions or stealing...

CVE-2025-39519 WordPress Bulk Page Stub Creator plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in rtpHarry Bulk Page Stub Creator allows Reflected XSS. This issue affects Bulk Page Stub Creator: from n/a through 1.1...

CVE-2025-39521 WordPress Contact Form vCard Generator plugin <= 2.4 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ashish Ajani Contact Form vCard Generator contact-form-vcard-generator allows Reflected XSS.This issue affects Contact Form vCard Generator: from n/a through = 2.4...

CVE-2025-39521 WordPress Contact Form vCard Generator plugin <= 2.4 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ashish Ajani Contact Form vCard Generator contact-form-vcard-generator allows Reflected XSS.This issue affects Contact Form vCard Generator: from n/a through = 2.4...

CVE-2025-39558 WordPress CRM Perks plugin <= 1.1.7 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CRM Perks CRM Perks support-x allows Reflected XSS.This issue affects CRM Perks: from n/a through = 1.1.7...

CVE-2025-39567

CVE-2025-39567 targets Shamalli Web Directory Free (WordPress plugin)

CVE-2025-39567 WordPress Web Directory Free plugin <= 1.7.8 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Shamalli Web Directory Free web-directory-free allows Reflected XSS.This issue affects Web Directory Free: from n/a through = 1.7.8...

CVE-2025-39567 WordPress Web Directory Free plugin <= 1.7.8 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Shamalli Web Directory Free allows Reflected XSS. This issue affects Web Directory Free: from n/a through 1.7.8...

CVE-2025-39594

CVE-2025-39594 is a reflected XSS in the Arigato Autoresponder and Newsletter WordPress plugin (versions n/a–2.7.2.4). The vulnerability allows network-based exploitation requiring user interaction, with a CVSS v3.1 base score of 7.1 (High) and low impacts to confidentiality, integrity, and avail...

CVE-2025-22565 WordPress vooPlayer v4 Plugin <= 4.0.4 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Bill Zimmerman vooPlayer v4 vooplayer allows Reflected XSS.This issue affects vooPlayer v4: from n/a through = 4.0.4...

CVE-2025-22565

Affected software : WordPress vooPlayer plugin for v4 (versions

CVE-2025-22565 WordPress vooPlayer v4 Plugin <= 4.0.4 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Bill Zimmerman vooPlayer v4 vooplayer allows Reflected XSS.This issue affects vooPlayer v4: from n/a through = 4.0.4...

CVE-2025-22651

CVE-2025-22651 is a Reflected XSS vulnerability in the WordPress plugin Stylish Google Sheet Reader (versions ≤ 4.0). The issue arises from improper input neutralization during web page generation, allowing attacker-supplied input to be reflected and executed in a victim’s browser. Public sources...

CVE-2025-22651 WordPress Stylish Google Sheet Reader plugin <= 4.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wppluginboxdev Stylish Google Sheet Reader stylish-google-sheet-reader allows Reflected XSS.This issue affects Stylish Google Sheet Reader: from n/a through = 4.0...

CVE-2025-22692 WordPress Sponsered Link plugin <= 4.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in rachanaS Sponsered Link sponsered-link allows Reflected XSS.This issue affects Sponsered Link: from n/a through = 4.0...

CVE-2025-22774

CVE-2025-22774 is a reflected XSS in the WordPress plugin CRUDLab Scroll to Top (versions up to 1.0.1). Technical details: affected software is CRUDLab Scroll to Top; vulnerability class is Cross-Site Scripting (Reflected). CVSS3.1 base score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Root cau...

CVE-2025-22796 WordPress WP-Asambleas Plugin <= 2.85.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in platcom WP-Asambleas allows Reflected XSS. This issue affects WP-Asambleas: from n/a through 2.85.0...

CVE-2025-39464

CVE-2025-39464 applies to WordPress AdminQuickbar plugin (versions ≤ 1.9.1) and is a Reflected XSS vulnerability caused by improper input neutralization during web page generation. The impact is ability to execute script in the context of affected users when visiting a crafted URL, with a base CV...