PT-2025-5044 · Kapost · Kapost

Name of the Vulnerable Software and Affected Versions: Kapost versions n/a through 2.2.9 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that also allows Stored XSS. This means an attacker can perform actions on behalf of a user without their knowledge and can also injec...

PT-2025-5064 · Unknown · Mybb Last Topics

Name of the Vulnerable Software and Affected Versions: mybb Last Topics versions n/a through 1.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application, and...

PT-2025-5045 · Unknown · Hack Me If You Can

Name of the Vulnerable Software and Affected Versions: Hack me if you can versions n/a through 1.2 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application, and...

PT-2025-5029 · Unknown · Shabbos/Yom Tov

Name of the Vulnerable Software and Affected Versions: Shabbos and Yom Tov versions 1.9 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

PT-2025-5156 · Unknown · Copyright Safeguard Footer Notice

Name of the Vulnerable Software and Affected Versions: Copyright Safeguard Footer Notice versions prior to 3.0 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on...

PT-2025-4944 · Intuitive Design · Intuitive Design Gdreseller

Name of the Vulnerable Software and Affected Versions: Intuitive Design GDReseller versions prior to 1.6 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web applicatio...

PT-2025-4681 · Olaf Lederer · Wp Ajax Contact Form

Name of the Vulnerable Software and Affected Versions: Olaf Lederer Ajax Contact Form versions 1.2.5.1 and earlier Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting', which allows stored XSS. This means an attacke...

CVE-2024-13323

The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'booking' shortcode in all versions up to, and including, 10.9.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2025-4600 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.6 Description: A Stored Cross-Site Scripting XSS vulnerability was identified in the dependente editarInfoPessoal.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scrip...

PT-2025-4599 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.6 Description: A Stored Cross-Site Scripting XSS vulnerability was identified in the informacao adicional.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into...

WordPress plugin Orbit Fox by ThemeIsle 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

CVE-2024-6155

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Authenticated Subscriber+ Server-Side Request Forgery and Stored Cross Site Scripting in all versions up to, and including, 9.0.0 due to a missing capability check in the greenshiftdownloadfilelocaly function...

WordPress Zephyr Admin Theme Plugin <= 1.4.1 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by Abdi Pranata Patchstack Alliance in WordPress Plugin Zephyr Admin Theme versions = 1.4.1...

PT-2025-4440 · Unknown · Nik Chankov Autocompleter

Name of the Vulnerable Software and Affected Versions: Nik Chankov Autocompleter versions 1.3.5.2 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on ...

PT-2025-4451 · Wenprise · Wizhi Multi Filters

Name of the Vulnerable Software and Affected Versions: Wizhi Multi Filters by Wenprise versions 1.8.6 and earlier Description: A Cross-Site Request Forgery CSRF issue in Wizhi Multi Filters by Wenprise allows Stored XSS. This means an attacker can perform actions on behalf of a user without their...

PT-2025-4577 · Unknown · Bozdoz Quote Tweet

Name of the Vulnerable Software and Affected Versions: bozdoz Quote Tweet versions n/a through 0.7 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application, and...

PT-2025-1717 · WordPress · The Taskbuilder

Name of the Vulnerable Software and Affected Versions: The Taskbuilder – WordPress Project & Task Management plugin versions up to, and including, 3.0.6 Description: The issue is related to Stored Cross-Site Scripting via the plugin's wppm tasks shortcode due to insufficient input sanitization an...

WordPress NAVER Analytics plugin <= 0.9 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by 渡辺康介 Patchstack Alliance in WordPress Plugin NAVER Analytics versions = 0.9...

CVE-2024-11607

The GTPayment Donations WordPress plugin through 1.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

PT-2024-16969 · WordPress · Spotlight

Name of the Vulnerable Software and Affected Versions: Spotlightr plugin for WordPress versions up to, and including, 0.1.9 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'spotlightr-v' shortcode due to insufficient input sanitization and output escaping on...