Moodle 4.5.x < 4.5.1 Reflected XSS In Question Bank Filter

According to its self-reported version, the Moodle install hosted on the remote host is 4.3.x prior to 4.3.8 or 4.4.4 prior to 4.4.5 or 4.5.x prior to 4.5.1 . It is, therefore, affected by a Reflected XSS in question bank filter. Note that the scanner has not tested for these issues but has inste...

Moodle 4.3.x < 4.3.1 Multiple Cross-Site Scripting

According to its self-reported version, the Moodle install hosted on the remote host is 4.2.x prior to 4.2.4 or 4.3.x prior to 4.3.1. It is, therefore, affected by multiple cross-site scripting: - Reflected XSS risk on ad-hoc tasks page - Reflected XSS risk in grader report search - Stored XSS in...

PT-2025-15928 · Otwthemes · Otwthemes Popping Content Light

Name of the Vulnerable Software and Affected Versions: OTWthemes Popping Content Light versions n/a through 2.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This enables potential...

CVE-2025-32575

Cross-Site Request Forgery CSRF vulnerability in axew3 WP w3all phpBB wp-w3all-phpbb-integration allows Reflected XSS.This issue affects WP w3all phpBB: from n/a through = 2.9.9...

CVE-2025-32556

Cross-Site Request Forgery CSRF vulnerability in Sandor Kovacs Simple Post Meta Manager simple-post-meta-manager allows Reflected XSS.This issue affects Simple Post Meta Manager: from n/a through = 1.0.9...

CVE-2025-32543 WordPress Canonical Attachments Plugin <= 1.8 - Stored Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in hivedigital Canonical Attachments canonical-attachments allows Reflected XSS.This issue affects Canonical Attachments: from n/a through = 1.8...

CVE-2025-32556 WordPress Simple Post Meta Manager Plugin <= 1.0.9 - CSRF to Reflected Cross-Site Scripting vulnerability

Cross-Site Request Forgery CSRF vulnerability in Sandor Kovacs Simple Post Meta Manager allows Reflected XSS. This issue affects Simple Post Meta Manager: from n/a through 1.0.9...

CVE-2025-32575 WordPress WP w3all phpBB Plugin <= 2.9.9 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in axew3 WP w3all phpBB wp-w3all-phpbb-integration allows Reflected XSS.This issue affects WP w3all phpBB: from n/a through = 2.9.9...

CVE-2025-32575 WordPress WP w3all phpBB Plugin <= 2.9.2 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in axew3 WP w3all phpBB allows Reflected XSS. This issue affects WP w3all phpBB: from n/a through 2.9.2...

PT-2025-15785 · Unknown · Hivedigital Canonical Attachments

Name of the Vulnerable Software and Affected Versions: hivedigital Canonical Attachments versions n/a through 1.7 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an...

WordPress plugin Simple Post Meta Manager 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

CVE-2025-30292 ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a reflected Cross-Site Scripting XSS vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's...

CVE-2025-30292 ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a reflected Cross-Site Scripting XSS vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's...

CVE-2025-32117

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in OTWthemes Widgetize Pages Light widgetize-pages-light allows Reflected XSS.This issue affects Widgetize Pages Light: from n/a through = 3.0...

CVE-2025-32117

CVE-2025-32117: Reflected XSS in Widgetize Pages Light (and Widgets as Shortcodes) via improper input neutralization; affects Widgetize Pages Light up to 3.0. Vulnerability currently Unpatched per Wordfence; no public fix/version provided. Remediation status: none publicly documented.

CVE-2025-22466

Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to obtain admin privileges. User interaction is required...

CVE-2025-22466

Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to obtain admin privileges. User interaction is required...

CVE-2025-22466

Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to obtain admin privileges. User interaction is required...

CVE-2025-22466

Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to obtain admin privileges. User interaction is required...

CVE-2025-22466

Ivanti Endpoint Manager is affected by CVE-2025-22466 (Reflected XSS) in versions prior to 2024 SU1 and prior to 2022 SU7. An unauthenticated remote attacker can obtain admin privileges, with user interaction required. Connected sources also indicate remediation: Ivanti has released updates addre...