CVE-2025-22792 WordPress Js O3 Lite theme <= 1.5.8.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in jinwen Js O3 Lite allows Reflected XSS.This issue affects Js O3 Lite: from n/a through 1.5.8.2...

CVE-2024-51106

A cross-site scripting XSS vulnerability in the component mcgs/admin/aboutus.php of PHPGURUKUL Medical Card Generation System using PHP and MySQL v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the pagetitle parameter...

CVE-2025-48240 WordPress Cost of Goods for WooCommerce <= 3.7.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPFactory Cost of Goods for WooCommerce allows Stored XSS. This issue affects Cost of Goods for WooCommerce: from n/a through 3.7.0...

WordPress Plugin Oficial – Getnet para WooCommerce plugin < 1.8.1 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Hassan Khan Yusufzai - Splint3r7 in WordPress Plugin Plugin Oficial – Getnet para WooCommerce versions 1.8.1...

WordPress RegistrationMagic plugin < 6.0.2.1 - Stored XSS vulnerability

Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin RegistrationMagic versions 6.0.2.1...

WordPress Download Manager plugin <= 3.2.98 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Download Manager versions = 3.2.98...

WordPress WP Content Copy Protection & No Right Click (premium) plugin <= 15.0 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin WP Content Copy Protection & No Right Click premium versions = 15.0...

WordPress Mobile Contact Bar plugin < 3.0.5 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin Mobile Contact Bar versions 3.0.5...

PT-2025-21974 · Unknown · Multivendorx

Name of the Vulnerable Software and Affected Versions: MultiVendorX versions through 4.2.22 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks. Recommendations: For versions throu...

PT-2025-21944 · Unknown · Phpgurukul Medical Card Generation System

Name of the Vulnerable Software and Affected Versions: PHPGURUKUL Medical Card Generation System version 1.0 Description: A cross-site scripting XSS issue exists in the component mcgs/admin/aboutus.php, allowing attackers to execute arbitrary web scripts or HTML by injecting a crafted payload int...

CVE-2025-44108

A stored Cross-Site Scripting XSS vulnerability exists in the administration panel of Flatpress CMS before 1.4 via the gallery captions component. An attacker with admin privileges can inject a malicious JavaScript payload into the system, which is then stored persistently...

PT-2025-22006 · Carzine · Carzine

Name of the Vulnerable Software and Affected Versions: CarZine versions 1.4.6 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS attacks. Recommendations: For CarZine...

WordPress plugin Qi Blocks 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on servers running PHP and MySQL. A security vulnerability exists in the...

CVE-2025-47557

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in RomanCode MapSVG mapsvg allows Stored XSS.This issue affects MapSVG: from n/a through = 8.5.31...

CVE-2025-40632

Cross-site scripting XSS in Icewarp Mail Server affecting version 11.4.0. This vulnerability allows an attacker to modify the “lastLogin” cookie with malicious JavaScript code that will be executed when the page is rendered...

CVE-2025-4862 PHPGurukul Directory Management System searchdata.php cross site scripting

A vulnerability, which was classified as problematic, has been found in PHPGurukul Directory Management System 2.0. Affected by this issue is some unknown functionality of the file /searchdata.php. The manipulation of the argument searchdata leads to cross site scripting. The attack may be launch...

CVE-2025-4859

A vulnerability was found in D-Link DAP-2695 120b36r137ALLen20210528. It has been rated as problematic. This issue affects some unknown processing of the file /advmacbypass.php of the component MAC Bypass Settings Page. The manipulation of the argument fmac leads to cross site scripting. The atta...

CVE-2025-4860 D-Link DAP-2695 Static Pool Settings Page adv_dhcps.php cross site scripting

A vulnerability classified as problematic has been found in D-Link DAP-2695 120b36r137ALLen20210528. Affected is an unknown function of the file /advdhcps.php of the component Static Pool Settings Page. The manipulation of the argument fmac leads to cross site scripting. It is possible to launch...

CVE-2025-4745

A vulnerability, which was classified as problematic, was found in code-projects Employee Record System 1.0. This affects an unknown part of the file currentemployees.php. The manipulation of the argument employeedid/firstname/middlename/lastname leads to cross site scripting. It is possible to...

CVE-2024-9227

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.9.18 does not sanitise and escape some of its settings when adding a podcast, which could allow admin users to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...