CVE-2025-3643 Moodle: reflected xss risk in policy tool

A flaw was found in Moodle. The return URL in the policy tool required additional sanitizing to prevent a reflected Cross-site scripting XSS risk...

CVE-2025-46506

Cross-Site Request Forgery CSRF vulnerability in Lora77 WpZon – Amazon Affiliate Plugin wpzon allows Reflected XSS.This issue affects WpZon – Amazon Affiliate Plugin: from n/a through = 1.3...

CVE-2025-46234

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Habibur Rahman Razib Control Listings control-listings allows Reflected XSS.This issue affects Control Listings: from n/a through = 1.0.4.1...

CVE-2025-39400

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpeverest User Registration user-registration allows Reflected XSS.This issue affects User Registration: from n/a through 4.2.0...

CVE-2025-39397

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in [email protected] Anything Popup anything-popup allows Reflected XSS.This issue affects Anything Popup: from n/a through = 7.3...

CVE-2025-39382

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in danielpataki ACF: Google Font Selector acf-google-font-selector-field allows Reflected XSS.This issue affects ACF: Google Font Selector: from n/a through = 3.0.1...

CVE-2025-46506 WordPress WpZon – Amazon Affiliate Plugin plugin <= 1.3 - CSRF to XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Lora77 WpZon – Amazon Affiliate Plugin wpzon allows Reflected XSS.This issue affects WpZon – Amazon Affiliate Plugin: from n/a through = 1.3...

CVE-2025-46506 WordPress WpZon – Amazon Affiliate Plugin plugin <= 1.3 - CSRF to XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Lora77 WpZon – Amazon Affiliate Plugin wpzon allows Reflected XSS.This issue affects WpZon – Amazon Affiliate Plugin: from n/a through = 1.3...

CVE-2025-46506

CVE-2025-46506 describes a CSRF-to-Reflected XSS in the WordPress plugin WpZon – Amazon Affiliate Plugin (versions

CVE-2025-39382 WordPress ACF: Google Font Selector plugin <= 3.0.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in danielpataki ACF: Google Font Selector acf-google-font-selector-field allows Reflected XSS.This issue affects ACF: Google Font Selector: from n/a through = 3.0.1...

CVE-2025-39382 WordPress ACF: Google Font Selector plugin <= 3.0.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in danielpataki ACF: Google Font Selector allows Reflected XSS. This issue affects ACF: Google Font Selector: from n/a through 3.0.1...

CVE-2025-39400

CVE-2025-39400 is a reflected Cross-Site Scripting (XSS) vulnerability in the WordPress User Registration plugin. Affected versions are WordPress User Registration

CVE-2025-39408

CVE-2025-39408 describes a reflected cross-site scripting (XSS) vulnerability in the WordPress plugin BruteGuard – Brute Force Login Protection, due to improper neutralization of input during web page generation. Affected versions are BruteGuard – Brute Force Login Protection up to 0.1.4. The con...

CVE-2025-46234

CVE-2025-46234 describes a Reflected Cross-Site Scripting vulnerability in the WordPress plugin Control Listings (versions up to 1.0.4.1). Concretely, input is not properly neutralized during web page generation, enabling XSS. Severity is rated high (CVSS 3.1 base score 7.1) with attack vector Ne...

PT-2025-17759 · Unknown · Habibur Rahman Razib Control Listings

Name of the Vulnerable Software and Affected Versions: Habibur Rahman Razib Control Listings versions 1.0.4.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This means an...

PT-2025-17756 · Unknown · Wpeverest User Registration

Name of the Vulnerable Software and Affected Versions: wpeverest User Registration affected versions not specified Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS in the User...

PT-2025-17754 · Unknown · Popup Anything

Name of the Vulnerable Software and Affected Versions: Anything Popup versions n/a through 7.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS, where an attacker can inject maliciou...

PT-2025-17812 · WordPress · Wpzon – Amazon Affiliate Plugin

Name of the Vulnerable Software and Affected Versions: WpZon – Amazon Affiliate Plugin versions 1.3 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Reflected XSS. Recommendations: For versions 1.3 and earlier, update to a version that contains a f...

CVE-2025-43952

The CVE-2025-43952 entry applies to Mettler Toledo FreeWeight.Net Web Reports Viewer 8.4.0 (440). The vulnerability is a reflected cross-site scripting (XSS) flaw that allows an attacker to inject malicious scripts via the IW_SessionID_ parameter, potentially affecting users who interact with the...

PT-2025-17532 · Pluggabl Llc · Booster Plus For Woocommerce

Name of the Vulnerable Software and Affected Versions: Booster Plus for WooCommerce versions through 7.2.4 Description: The issue affects the Booster Plus for WooCommerce plugin, allowing for Reflected XSS due to improper neutralization of input during web page generation. This can lead to...