CVE-2025-30840

CVE-2025-30840: Reflected XSS in xili-dictionary (WordPress plugin) due to improper neutralization of input during web page generation. Affected: xili-dictionary versions up to 2.12.5 (vulnerable range not further specified). Root cause: insufficient escaping of user-controlled input in page gene...

CVE-2025-30840 WordPress xili-dictionary plugin <= 2.12.5 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Michel - xiligroup dev xili-dictionary xili-dictionary allows Reflected XSS.This issue affects xili-dictionary: from n/a through = 2.12.5...

CVE-2025-30848

CVE-2025-30848 affects the Hostel (WordPress) plugin, specifically versions up to 1.1.5 (Hostel: 1.0.x through 1.1.5). The issue is a Reflected XSS caused by improper neutralization of input during web page generation, enabling an attacker to trigger script execution when a user visits a crafted ...

CVE-2025-30840 WordPress xili-dictionary plugin <= 2.12.5 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Michel - xiligroup dev xili-dictionary xili-dictionary allows Reflected XSS.This issue affects xili-dictionary: from n/a through = 2.12.5...

CVE-2025-30869 WordPress Image Wall plugin <= 3.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Parakoos Image Wall image-wall allows Reflected XSS.This issue affects Image Wall: from n/a through = 3.0...

CVE-2025-30798 WordPress Better WishList API plugin <= 1.1.4 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in rickonlinenl Better WishList API better-wlm-api allows Reflected XSS.This issue affects Better WishList API: from n/a through = 1.1.4...

CVE-2025-30827

WP2LEADS (WordPress plugin)

CVE-2025-30808

CVE-2025-30808 is a reflected XSS in the WordPress plugin About Author . Connected docs confirm the issue affects the plugin’s vulnerability surface up to version 1.6.2 . Root cause: Improper Neutralization of Input During Web Page Generation . Impact, as per metrics: High (CVSS 3.1 base 7.1) wit...

CVE-2025-30808 WordPress About Author plugin <= 1.6.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Weblizar - WordPress Themes & Plugin About Author about-author allows Reflected XSS.This issue affects About Author: from n/a through = 1.6.2...

CVE-2025-30794

CVE-2025-30794 is a reflected XSS in The Events Calendar Event Tickets (Event Tickets and Registration). The Wordfence vulnerability feed lists it as CVE-2025-30794 with affected software Event Tickets and a patch status of Patched, indicating the issue was fixed in a later release (the feed note...

CVE-2025-30796 WordPress The Ultimate WordPress Toolkit – WP Extended plugin <= 3.0.14 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended allows Reflected XSS.This issue affects The Ultimate WordPress Toolkit – WP Extended: from n/a through = 3.0.14...

CVE-2025-30794 WordPress Event Tickets plugin <= 5.20.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in StellarWP Event Tickets event-tickets allows Reflected XSS.This issue affects Event Tickets: from n/a through = 5.20.0...

CVE-2025-30794 WordPress Event Tickets plugin <= 5.20.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in StellarWP Event Tickets event-tickets allows Reflected XSS.This issue affects Event Tickets: from n/a through = 5.20.0...

CVE-2025-30796

CVE-2025-30796 in The Ultimate WordPress Toolkit – WP Extended (up to 3.0.14) is a reflected XSS vulnerability caused by improper neutralization of input during web page generation. The CVSS‑3.1 base score is 7.1 (HIGH) with NETWORK attack vector, LOW confidentiality/integrity/availability impact...

CVE-2025-30796 WordPress The Ultimate WordPress Toolkit – WP Extended plugin <= 3.0.14 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended allows Reflected XSS.This issue affects The Ultimate WordPress Toolkit – WP Extended: from n/a through = 3.0.14...

CVE-2025-30607 WordPress Quick Localization plugin <= 0.1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Name.ly Quick Localization quick-localization allows Reflected XSS.This issue affects Quick Localization: from n/a through = 0.1.0...

CVE-2025-30614

CVE-2025-30614 corresponds to a Reflected XSS in the Google Font Fix plugin for WordPress (Google Font Fix). Affected: Google Font Fix versions up to 2.3.1 (from n/a through 2.3.1). Root cause: improper neutralization of input during web page generation. Impact: Cross-site scripting exposure; use...

CVE-2025-30614 WordPress Google Font Fix plugin <= 2.3.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Haozhe Xie Google Font Fix google-font-fix allows Reflected XSS.This issue affects Google Font Fix: from n/a through = 2.3.1...

CVE-2025-30607

CVE-2025-30607 is a reflected XSS in the WordPress plugin Quick Localization (aka Quick Localisation), affecting versions up to 0.1.0. Public details indicate improper input neutralization during web page generation leading to cross-site scripting, with CVSS 3.1 base score 7.1 (HIGH) and exploita...

CVE-2025-30548 WordPress Advanced Post Search plugin <= 1.1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in VarDump s.r.l. Advanced Post Search advanced-post-search allows Reflected XSS.This issue affects Advanced Post Search: from n/a through = 1.1.0...