CVE-2025-56243

CVE-2025-56243 - Reflected XSS in PuneethReddyHC / Event Management System v1.0 Title: Reflected Cross-Site Scripting XSS via eventid parameter in register.php Vendor / Repository: PuneethReddyHC / event-management Affected Version: 1.0 branch/tag master at the time of testing Reporter: Hafiz...

CVE-2026-111848

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Reflected XSS.This issue affects Geo Mashup: from n/a through 1.13.22...

CVE-2026-111838

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeHunk ThemeHunk Customizer themehunk-customizer allows Reflected XSS.This issue affects ThemeHunk Customizer: from n/a through 2.8.7...

CVE-2026-111840

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Reflected XSS.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.14...

MAL-012

MAL-012: Reflected Cross-Site Scripting in Admin Console leading to Remote Code Execution in Payara Server A reflected Cross Site Scripting XSS attack was found in the Payara Admin Console. By convincing an admin user to access the malicious URL and click the “Choose File” button, an attacker can...

CVE-2026-111840

The VideoWhisper.com Paid Videochat Turnkey Site WordPress plugin (ppv-live-webcams) versions 7.5.14 and below is vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability. The root cause is the improper neutralization of input during web page generation, which allows an attacker to inje...

EUVD-2026-107275

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeHunk ThemeHunk Customizer themehunk-customizer allows Reflected XSS.This issue affects ThemeHunk Customizer: from n/a through 2.8.7...

EUVD-2026-107279

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Reflected XSS.This issue affects Geo Mashup: from n/a through 1.13.22...

CVE-2026-111840 WordPress Paid Videochat Turnkey Site plugin <= 7.5.14 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Reflected XSS.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.14...

CVE-2026-111848 WordPress Geo Mashup plugin <= 1.13.22 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Reflected XSS.This issue affects Geo Mashup: from n/a through 1.13.22...

CVE-2026-111838 WordPress ThemeHunk Customizer plugin <= 2.8.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeHunk ThemeHunk Customizer themehunk-customizer allows Reflected XSS.This issue affects ThemeHunk Customizer: from n/a through 2.8.7...

CVE-2026-111838

The ThemeHunk Customizer WordPress plugin (versions

CVE-2026-111848 WordPress Geo Mashup plugin <= 1.13.22 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Reflected XSS.This issue affects Geo Mashup: from n/a through 1.13.22...

EUVD-2026-107274

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Reflected XSS.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.14...

CVE-2026-111848

The Geo Mashup WordPress plugin (versions

WordPress User Profile Builder plugin < 4.0.1 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by 0xBassia in WordPress Plugin Profile Builder versions 4.0.1...

WordPress WP Booking System plugin < 2.1.0.3 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Zahid Abbasi in WordPress Plugin WP Booking System versions 2.1.0.3...

CVE-2026-114407

e107 CMS before 2.3.13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML by manipulating the author GET parameter in search.php, which is parsed with parsestr and concatenated unescaped into a rendered input tag via the form...

CVE-2024-11252-Sassy-Social-Share-XSS

CVE-2023-XXXX: Sassy Social Share Plugin XSS Vulnerability Description This project demonstrates a reflected Cross-Site Scripting XSS vulnerability found in the Sassy Social Share plugin for WordPress. This vulnerability can be exploited via the heateormastodonshare parameter. Usage 1. PoC.html :...

CVE-2026-114407

The e107 CMS before version 2.3.13 is vulnerable to a reflected cross-site scripting (XSS) flaw. The issue resides in search.php when the author GET parameter is processed using parse_str(). Because the data is concatenated unescaped into a rendered input tag via the form handler's 'other' option...