Linux Distros Unpatched Vulnerability : CVE-2018-18625

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Grafana 5.3.1 has XSS via a link on the Dashboard All Panels General screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099...

CVE-2025-8150

The Events Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Typewriter and Countdown widgets in all versions up to, and including, 2.2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

WordPress Plugin Beaver Builder Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin Beaver Builder has a cross-site scripting vulnerability that can be exploited by an...

CVE-2025-6247

The WordPress Automatic Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.118.0. This is due to missing or incorrect nonce validation on one of its functions. This makes it possible for unauthenticated attackers to update campaigns and...

CVE-2025-20296

A vulnerability in the web-based management interface of Cisco UCS Manager Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the...

CVE-2025-8603

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 1.5.148 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-48307

Cross-Site Request Forgery CSRF vulnerability in kasonzhao SEO For Images seo-for-images allows Stored XSS.This issue affects SEO For Images: from n/a through = 1.0.0...

Linux Distros Unpatched Vulnerability : CVE-2021-23225

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cacti 1.1.38 allows authenticated users with User Management permissions to inject arbitrary web script or HTML in the newusername field during creation of a ne...

SUSE CVE-2025-40927

CGI::Simple versions before 1.282 for Perl has a HTTP response splitting flaw This vulnerability is a confirmed HTTP response splitting flaw in CGI::Simple that allows HTTP response header injection, which can be used for reflected XSS or open redirect under certain conditions. Although some...

PT-2025-35189

Name of the Vulnerable Software and Affected Versions: OSM Map Widget for Elementor plugin for WordPress versions prior to 1.3.1 Description: The OSM Map Widget for Elementor plugin for WordPress is susceptible to Stored Cross-Site Scripting through the Map Block URL due to inadequate input...

CVE-2025-48356

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Isra Kanpress kanpress allows Stored XSS.This issue affects Kanpress: from n/a through = 1.1...

CVE-2025-48353

Cross-Site Request Forgery CSRF vulnerability in dactum Clickbank WordPress Plugin Niche Storefront clickbank-niche-storefronts allows Stored XSS.This issue affects Clickbank WordPress Plugin Niche Storefront: from n/a through = 1.3.5...

CVE-2025-48343

Cross-Site Request Forgery CSRF vulnerability in Aaron Axelsen WPMU Ldap Authentication wpmuldap allows Stored XSS.This issue affects WPMU Ldap Authentication: from n/a through = 5.0.1...

CVE-2025-48321 WordPress Ultimate twitter profile widget plugin <= 1.0 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in dyiosah Ultimate twitter profile widget ultimate-twitter-profile-widget allows Stored XSS.This issue affects Ultimate twitter profile widget: from n/a through = 1.0...

CVE-2025-48307

CVE-2025-48307 : WordPress plugin SEO For Images has a CSRF vulnerability that can lead to stored XSS. Affected versions are n/a through 1.0.0. Evidence from Patchstack and PT-Security confirms CSRF to Stored XSS is present, with remediation guidance recommending updating to a version later than ...

CVE-2025-48109 WordPress XM-Backup plugin <= 0.9.1 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Xavier Media XM-Backup xm-backup allows Stored XSS.This issue affects XM-Backup: from n/a through = 0.9.1...

CVE-2025-6255

CVE-2025-6255 affects the WordPress plugin Dynamic AJAX Product Filters for WooCommerce . Root cause: insufficient input sanitization and output escaping in the className parameter, enabling Stored Cross‑Site Scripting . Affected versions: all up to and including 1.3.7 . Impact: authenticated att...

WordPress plugin Clickbank WordPress Plugin (Niche Storefront) 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

PT-2025-35027

Name of the Vulnerable Software and Affected Versions: thaihavnn07 ATT YouTube Widget versions through 1.0 Description: A Cross-Site Request Forgery CSRF vulnerability exists in the thaihavnn07 ATT YouTube Widget, which can lead to Stored Cross-Site Scripting XSS. Recommendations: Update...

WordPress plugin Beaver Builder 跨站脚本漏洞

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin Beaver Builder has a cross-site scripting vulnerability that can be exploited by an...