CVE-2025-23441 WordPress Attach Gallery Posts plugin <= 1.6 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in dkukral Attach Gallery Posts attach-gallery-posts allows Reflected XSS.This issue affects Attach Gallery Posts: from n/a through = 1.6...

CVE-2025-23441

The CVE-2025-23441 entry concerns the WordPress NotFound Attach Gallery Posts plugin (versions

CVE-2025-23437

CVE-2025-23437 describes a reflected cross-site scripting vulnerability in the WordPress plugin ntp-header-images (NotFound) versions up to and including 1.2 . The issue stems from improper input neutralization during web page generation, enabling reflected XSS when processing input. Public docum...

CVE-2025-23437 WordPress ntp-header-images plugin <=1.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in nordtramper ntp-header-images header-images-rotator allows Reflected XSS.This issue affects ntp-header-images: from n/a through = 1.2...

CVE-2025-23437 WordPress ntp-header-images plugin <=1.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NotFound ntp-header-images allows Reflected XSS. This issue affects ntp-header-images: from n/a through 1.2...

CVE-2025-23425 WordPress Marekkis Watermark plugin <= 0.9.4 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in marekki Marekkis Watermark marekkis-watermark allows Reflected XSS.This issue affects Marekkis Watermark: from n/a through = 0.9.4...

CVE-2025-23425

CVE-2025-23425 : The connected Patchstack entry confirms a concrete vuln in the WordPress plugin Marekkis Watermark, version

CVE-2025-23433 WordPress vcOS plugin <=1.4.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in jnwry vcOS allows Reflected XSS. This issue affects vcOS: from n/a through 1.4.0...

CVE-2025-23433

CVE-2025-23433 concerns the WordPress vcOS plugin (versions ≤ 1.4.0) with a Reflected XSS vulnerability caused by improper input neutralization during web page generation. Affected component: vcOS plugin for WordPress (jnwry vcOS). Root cause: improper neutralization of input in web page generati...

PT-2025-9431 · Dreamstime · Dreamstime Stock Photos

Name of the Vulnerable Software and Affected Versions: Dreamstime Stock Photos versions n/a through 4.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. Recommendations: For versions n/a...

CVE-2025-22272

CVE-2025-22272 affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. In the /EPMUI/ModalDlgHandler.ashx?value=showReadonlyDlg endpoint, the POST parameter modalDlgMsgInternal can be used to inject code that is executed in the browser; exploitation risk is mitigated by the need to by...

CVE-2025-22272 Self Reflected XSS in CyberArk Endpoint Privilege Manager

In the "/EPMUI/ModalDlgHandler.ashx?value=showReadonlyDlg" endpoint, it is possible to inject code in the "modalDlgMsgInternal" parameter via POST, which is then executed in the browser. The risk of exploiting vulnerability is reduced due to the required additional bypassing the...

CVE-2025-23687

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in simonhunter Woo Store Mode woo-store-mode allows Reflected XSS.This issue affects Woo Store Mode: from n/a through = 1.0.1...

CVE-2025-21627

GLPI is a free asset and IT management software package. In versions prior to 10.0.18, a malicious link can be crafted to perform a reflected XSS attack on the search page. If the anonymous ticket creation is enabled, this attack can be performed by an unauthenticated user. Version 10.0.18 contai...

CVE-2025-23687

CVE-2025-23687 is a Reflected XSS in the WordPress plugin Woo Store Mode (affected: 1.0.1 and earlier). The issue stems from improper input neutralization during web page generation. Public sources (NVD/Red Hat/CIRCL) confirm the vulnerability and provide a CVSS v3.1 base score of 7.1 (HIGH) , wi...

CVE-2025-26987

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element allows Reflected XSS.This issue affects Frontend Admin by DynamiApps: from n/a through = 3.25.17...

CVE-2025-26751

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Fahad Mahmood Alphabetic Pagination alphabetic-pagination allows Reflected XSS.This issue affects Alphabetic Pagination: from n/a through = 3.2.1...

CVE-2025-26993

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Reflected XSS.This issue affects Atarim: from n/a through = 4.1.0...

WordPress Countdown Timer plugin <= 1.0 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Hassan Khan Yusufzai - Splint3r7 in WordPress Plugin Countdown Timer versions = 1.0...

CVE-2025-27307

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in oooorgle Quotes llama quotes-llama allows Reflected XSS.This issue affects Quotes llama: from n/a through = 3.0.1...