CVE-2025-23966 WordPress a Gateway for Pasargad Bank on WooCommerce Plugin <= 2.5.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ala Falaki a Gateway for Pasargad Bank on WooCommerce a-gateway-for-pasargad-bank-on-woocommerce allows Reflected XSS.This issue affects a Gateway for Pasargad Bank on WooCommerce: from n/a through...

CVE-2025-23959 WordPress Good Old Gallery Plugin <= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Linus Lundahl Good Old Gallery good-old-gallery allows Reflected XSS.This issue affects Good Old Gallery: from n/a through = 2.1.2...

CVE-2025-23959 WordPress Good Old Gallery Plugin <= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Linus Lundahl Good Old Gallery good-old-gallery allows Reflected XSS.This issue affects Good Old Gallery: from n/a through = 2.1.2...

CVE-2025-23959

CVE-2025-23959 describes a Reflected XSS in Good Old Gallery (Linus Lundahl). The vulnerability results from improper input neutralization during web page generation and affects Good Old Gallery versions from n/a up to 2.1.2. The connected Red Hat advisory confirms the same description; no public...

CVE-2025-23803 WordPress Snippy Plugin <= 1.4.1 - CSRF to Cross Site Scripting (XSS) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Rik Schennink Snippy snippy allows Reflected XSS.This issue affects Snippy: from n/a through = 1.4.1...

CVE-2025-23806 WordPress Ultimate Subscribe Plugin <=1.3 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability

Cross-Site Request Forgery CSRF vulnerability in ThemeFarmer Ultimate Subscribe ultimate-subscribe allows Reflected XSS.This issue affects Ultimate Subscribe: from n/a through = 1.3...

CVE-2025-23798 WordPress Mass Messaging in BuddyPress Plugin <= 2.2.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ElbowRobo Mass Messaging in BuddyPress mass-messaging-in-buddypress allows Reflected XSS.This issue affects Mass Messaging in BuddyPress: from n/a through = 2.2.1...

CVE-2025-23867

CVE-2025-23867 : NotFound WordPress File Search is affected by a reflected XSS due to improper input neutralization during web page generation. The issue affects WordPress File Search plugin versions up to 1.2 (exact vulnerable range implied by “from n/a through 1.2”). CVSS v3.1 base score 7.1 (H...

CVE-2025-23803 WordPress Snippy Plugin <= 1.4.1 - CSRF to Cross Site Scripting (XSS) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Rik Schennink Snippy snippy allows Reflected XSS.This issue affects Snippy: from n/a through = 1.4.1...

CVE-2025-23866 WordPress EU DSGVO Helper Plugin <= 1.0.6.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in E. Marten EU DSGVO Helper dsgvo allows Reflected XSS.This issue affects EU DSGVO Helper: from n/a through = 1.0.6.1...

CVE-2025-23806

CVE-2025-23806 describes a CSRF vulnerability in ThemeFarmer Ultimate Subscribe (ultimate-subscribe) that enables Reflected XSS, affecting Ultimate Subscribe versions up to 1.3. The description and Red Hat entry confirm the cross-site request forgery context and XSS impact; no public exploit deta...

CVE-2025-23811

CVE-2025-23811 is a reflected XSS vulnerability affecting WP2APP NotFound WP2APP, with affected range up to version 2.6.2. The connected Red Hat and RH Security notes confirm the issue as an input-neutralization failure leading to cross-site scripting. The exact root cause and vendor/product reme...

CVE-2025-23874

CVE-2025-23874 – Reflected Cross‑Site Scripting in NotFound WP Block Pack (WP Block Pack). Affected: WP Block Pack versions up to 1.1.6 (noted as NotFound Block Pack). Public references in the data set include Red Hat’s RH:CVE-2025-23874 and Wordfence vulnerability listings for Block Pack under C...

CVE-2025-23769

CVE-2025-23769 (Content Mirror WordPress Plugin) is a reflected XSS vulnerability described as improper neutralization of input during web page generation, affecting Content Mirror versions from n/a up to 1.2. The Red Hat advisory RH:CVE-2025-23769 reiterates the same description, confirming a re...

CVE-2025-23769 WordPress Content Mirror plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in dreamsofmatter Content Mirror content-mirror allows Reflected XSS.This issue affects Content Mirror: from n/a through = 1.2...

CVE-2025-23700 WordPress yCyclista plugin <= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in yonisink yCyclista ycyclista allows Reflected XSS.This issue affects yCyclista: from n/a through = 1.2.3...

CVE-2025-23706 WordPress Jet Skinner for BuddyPress plugin <= 1.2.5 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in milordk Jet Skinner for BuddyPress jet-skinner-for-buddypress allows Reflected XSS.This issue affects Jet Skinner for BuddyPress: from n/a through = 1.2.5...

CVE-2025-23701

CVE-2025-23701 describes a Reflected XSS in Lime Developer Login (Lime Developer Login by LimeSquare Pty Ltd) caused by improper neutralization of input during web page generation. Affected: Lime Developer Login, version range v1.0 through v1.4.0 (as stated). The Red Hat CVE record confirms the s...

CVE-2025-23758 WordPress pootle button plugin <= 1.2.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in pootlepress Pootle button pootle-button allows Reflected XSS.This issue affects Pootle button: from n/a through = 1.2.0...

CVE-2025-23701 WordPress Lime Developer Login plugin <= 1.4.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Matthew Blackford, LimeSquare Pty Ltd Lime Developer Login allows Reflected XSS. This issue affects Lime Developer Login: from n/a through 1.4.0...