CVE-2025-9332 Interactive Medical Drawing of Human Body <= 2.6 - Authenticated (Admin+) Stored Cross-Site Scripting

The Interactive Human Anatomy with Clickable Body Parts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...

PT-2025-40605

Name of the Vulnerable Software and Affected Versions KUNO CMS versions prior to 1.3.14 Description KUNO CMS, a full-stack blog application, has flaws in its file upload functionality. The upload process only validates file types based on Content-Type headers and does not analyze file content or...

CVE-2025-40989

CVE-2025-40989 describes a stored cross-site scripting vulnerability in Ekushey CRM v5.0 (Creativeitem) caused by insufficient validation of user input in the POST endpoint dealing with the applicant’s message, specifically the API path that includes the message parameter. The affected component ...

CVE-2025-9512

The Schema & Structured Data for WP & AMP WordPress plugin before 1.50 does not properly handles HTML tag attribute modifications, making it possible for unauthenticated attackers to conduct Stored XSS attacks via post comments...

CVE-2025-10196

The Survey Anyplace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'surveyanyplaceembed' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-9075

CVE-2025-9075 is a stored cross-site scripting vulnerability in the WordPress plugin ZoloBlocks (versions up to and including 2.3.10). The issue stems from insufficient input sanitization and output escaping on user-supplied attributes across multiple Gutenberg blocks (Google Maps markers, Lightb...

Issabel 跨站脚本漏洞

Issabel is a unified communications platform from the Issabel organization. A cross-site scripting vulnerability exists in Issabel version 5.0.0 that stems from a lack of validation of user input and could lead to a stored cross-site scripting attack...

CVE-2025-43811

Multiple stored cross-site scripting XSS vulnerability in the related asset selector in Liferay Portal 7.4.3.50 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.7, and 7.4 update 50 through update 92 allows remote authenticated attackers to inject arbitrar...

CVE-2025-6815 LatePoint <= 5.1.94 - Authenticated (Administrator+) Stored Cross-Site Scripting

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘servicename’ parameter in all versions up to, and including, 5.1.94 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-10182 dbview <= 0.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

The dbview plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dbview' shortcode in all versions up to, and including, 0.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...

WordPress plugin planetcalc 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2025-60164

Cross-Site Request Forgery CSRF vulnerability in NewsMAN NewsmanApp newsmanapp allows Stored XSS.This issue affects NewsmanApp: from n/a through = 2.7.7...

CVE-2025-10178

The CM Business Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cmbdfeaturedimage' shortcode in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-60170

Cross-Site Request Forgery CSRF vulnerability in Taraprasad Swain HTACCESS IP Blocker htaccess-ip-blocker allows Stored XSS.This issue affects HTACCESS IP Blocker: from n/a through = 1.0...

CVE-2025-60173 WordPress GST for WooCommerce Plugin <= 2.0 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in Ashwani kumar GST for WooCommerce gst-for-woocommerce allows Stored XSS.This issue affects GST for WooCommerce: from n/a through = 2.0...

CVE-2025-60172 WordPress Flytedesk Digital Plugin <= 20181101 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in flytedesk Flytedesk Digital flytedesk-digital allows Stored XSS.This issue affects Flytedesk Digital: from n/a through = 20181101...

CVE-2025-60172

CVE-2025-60172 is a CSRF vulnerability in Flytedesk Digital WordPress plugin that can lead to Stored XSS. The Initial/Wordfence data indicate affected range “from n/a through 20181101” and list the patch status as Unpatched as of 2025-09-26. No explicit exploit details, affected versions beyond t...

CVE-2025-60169

CVE-2025-60169: WordPress repository entry for W3SCloud Contact Form 7 to Zoho CRM reports a CSRF vulnerability that can lead to a Stored XSS in the W3SCloud Contact Form 7 to Zoho CRM plugin (versions up to 3.0). The CVSS metrics indicate NETWORK attack vector, NO privileges required, UI require...

PT-2025-39606

Name of the Vulnerable Software and Affected Versions NewsmanApp versions through 2.7.7 Description A Cross-Site Request Forgery CSRF issue exists in NewsMAN NewsmanApp, which also allows Stored Cross-Site Scripting XSS. The issue allows for potential malicious actions to be performed on behalf o...

PT-2025-39610

Name of the Vulnerable Software and Affected Versions W3SCloud Contact Form 7 to Zoho CRM versions through 3.0 Description A Cross-Site Request Forgery CSRF issue exists in W3SCloud Contact Form 7 to Zoho CRM, which may also lead to Stored Cross-Site Scripting XSS. The issue allows attackers to...