CVE-2025-26528 Stored XSS in ddimageortext question type

The drag-and-drop onto image ddimageortext question type required additional sanitizing to prevent a stored XSS risk...

WordPress plugin Table of Contents Block 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in PHP. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in WordPress plugin Table o...

PT-2025-7753 · Unknown · Smart Maintenance & Countdown

Name of the Vulnerable Software and Affected Versions: Smart Maintenance & Countdown versions 1.2 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that also allows Stored XSS. Recommendations: For versions 1.2 and earlier, update to a version that...

CVE-2025-1407

The AMO Team Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's amoteamskills shortcode in all versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2023-51306

PHPJabbers Event Ticketing System v1.0 is vulnerable to Multiple Stored Cross-Site Scripting XSS in the "name, title" parameters...

CVE-2024-13748

The Ultimate Classified Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Title parameter in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

Multiple cross-site scripting vulnerabilities in Movable Type

Overview Movable Type provided by Six Apart Ltd. contains multiple cross-site scripting vulnerabilities listed below. Stored cross-site scripting vulnerability in the custom block edit page of MT Block Editor CWE-79 - CVE-2025-22888 Stored cross-site scripting vulnerability in the HTML edit mode ...

PT-2025-7224 · Unknown · Alexvtn Content Snippet Manager

Name of the Vulnerable Software and Affected Versions: alexvtn Content Snippet Manager versions 1.1.5 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

CVE-2025-26569

Cross-Site Request Forgery CSRF vulnerability in Callmeforsox Post Thumbs allows Stored XSS. This issue affects Post Thumbs: from n/a through 1.5...

WordPress RSS FIlter Plugin <= 1.2 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

CSRF to Stored Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 in WordPress Plugin RSS Filter versions = 1.2...

CVE-2024-13119

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even wh...

CVE-2025-25160

Cross-Site Request Forgery CSRF vulnerability in Mark Barnes Style Tweaker allows Stored XSS. This issue affects Style Tweaker: from n/a through 0.11...

PT-2025-5958 · Unknown · Danillo Nunes Login-Box

Name of the Vulnerable Software and Affected Versions: Danillo Nunes Login-box versions 2.0.4 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

PT-2025-5950 · Unknown · Scriptonite Simple User Profile

Name of the Vulnerable Software and Affected Versions: Scriptonite Simple User Profile versions 1.9 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS in Scriptonite Simple User Profile. Recommendations: For versions 1.9 and earlier, updat...

PT-2025-5957 · Elbowrobo · Elbowrobo

Name of the Vulnerable Software and Affected Versions: ElbowRobo Read More Copy Link versions n/a through 1.0.2 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

CVE-2024-56267

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in html5maps Interactive UK Map interactive-uk-map allows Stored XSS.This issue affects Interactive UK Map: from n/a through = 3.4.8...

CVE-2024-49672

Cross-Site Request Forgery CSRF vulnerability in giffordcheung Google Docs RSVP google-docs-rsvp-guestlist allows Stored XSS.This issue affects Google Docs RSVP: from n/a through = 2.0.1...

CVE-2024-54440

Cross-Site Request Forgery CSRF vulnerability in blueskyy WP-Ban-User wp-ban-user allows Stored XSS.This issue affects WP-Ban-User: from n/a through = 1.0...

CVE-2024-48048

Cross-Site Request Forgery CSRF vulnerability in GabbyKhrmon Wsify Widget wsify-widget allows Stored XSS.This issue affects Wsify Widget: from n/a through = 1.0...

CVE-2024-53726

Cross-Site Request Forgery CSRF vulnerability in RealtyCandy.com RealtyCandy IDX Broker Extended realtycandy-idx-broker-extended allows Stored XSS.This issue affects RealtyCandy IDX Broker Extended: from n/a through = 1.5.1...