CVE-2025-46958 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they brow...

CVE-2025-7646

The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom script parameter in all versions up to, and including, 6.3.10 even when the user does not have the unfilteredhtml...

CVE-2025-7500

The Ocean Social Sharing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via social icon titles in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level acce...

Cross-site Scripting (XSS)

Overview panel is a The powerful data exploration & web app framework for Python. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to missing HTML escaping in authentication templates. The errormessage variable in the basiclogin.html template and the error/errormsg...

PT-2025-31626 · Elementor +1 · Elementor +1

Name of the Vulnerable Software and Affected Versions: Sina Extension for Elementor versions through 3.7.0 Description: The Sina Extension for Elementor plugin for WordPress is susceptible to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in the Sina Posts,...

CVE-2025-51503

Summary: CVE-2025-51503 is a stored XSS vulnerability in Microweber CMS 2.0 that allows injection of malicious scripts into user profile fields, resulting in arbitrary JavaScript execution in an admin browser. Affected product / component: Microweber CMS 2.0 (Microweber/microweber stack indicated...

WordPress muse.ai video embedding cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in WordPress muse.ai video embedding, which stems from insufficient input cleanup and output escaping, and can be exploited by a...

JetBrains TeamCity Cross-Site Scripting Vulnerability

JetBrains TeamCity is a Continuous Integration CI/CD tool developed by JetBrains, Inc. to automate the software build, test and deployment process. JetBrains TeamCity suffers from a cross-site scripting vulnerability that stems from the presence of reflective cross-site scripting on the...

WordPress WP Get The Table Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in WordPress WP Get The Table, which stems from insufficient input cleanup and output escaping, and can be exploited by an...

WordPress FunnelCockpit Cross-Site Scripting Vulnerability

WordPress FunnelCockpit is an open source tool for tracking and analyzing the entire process of lead generation from initial contact to final closing, developed on the WordPress platform. WordPress FunnelCockpit suffers from a cross-site scripting vulnerability that stems from insufficient input...

PT-2025-31138 · WordPress · No Boss Testimonials

Name of the Vulnerable Software and Affected Versions: No Boss Testimonials versions 1.0.0 through 3.0.0 No Boss Testimonials versions 4.0.0 through 4.0.2 Description: A stored Cross-Site Scripting XSS issue exists in the No Boss Testimonials component. This allows an attacker to inject malicious...

CVE-2025-46993

Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they brow...

NewStart CGSL MAIN 7.02 : tuned Vulnerability (NS-SA-2025-0202)

The remote NewStart CGSL host, running version MAIN 7.02, has tuned packages installed that are affected by a vulnerability: - A script injection vulnerability was identified in the Tuned package. The instancecreate D-Bus function can be called by locally logged-in users without authentication...

PT-2025-30932 · Unknown · Church Donation System

Name of the Vulnerable Software and Affected Versions: Church Donation System version 1.0 Description: A vulnerability exists in Church Donation System version 1.0 related to cross site scripting. The issue is located in the /admin/edit members.php file. Manipulation of the fname argument can lea...

CVE-2025-46996

This CVE-2025-46996 affects Adobe Experience Manager (AEM) versions 6.5.22 and earlier. The vulnerability is a stored Cross-Site Scripting (XSS) in vulnerable form fields, exploitable by a low-privileged attacker to inject malicious scripts that execute in a victim’s browser when visiting a page ...

CVE-2025-5084

The Post Grid Master plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘argsArray'readmoretext'’ parameter in all versions up to, and including, 3.4.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

WordPress plugin muse.ai video embedding 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in WordPress muse.ai video embedding, which stems from insufficient input cleanup and output escaping, and can be exploited by a...

rsblog

Extension: RSBlog! Version: Old 1.14.4, 1.14.5 / New 1.14.6 Update details: Versions affected 1.11.6 to 1.14.5 Stored XSS allows remote authenticated attackers to inject arbitrary web script or HTML via the tag parameter. Fixed in 1.14.6 Update URL:...

CVE-2025-6235

In ExtremeControl before 25.5.12, a cross-site scripting XSS vulnerability was discovered in a login interface of the affected application. The issue stems from improper handling of user-supplied input within HTML attributes, allowing an attacker to inject script code that may execute in a user's...

CVE-2024-53287

Improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in VPN Setting functionality in Synology Router Manager SRM before 1.3.1-9346-11 allows remote authenticated users with administrator privileges to inject arbitrary web script or HTML via unspecified...