CVE-2025-5686

The Paged Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gallery' shortcode in all versions up to, and including, 0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-5565 Hide It <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Hide It plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'hideit' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...

CVE-2025-5536

CVE-2025-5536 involves the Freemind Viewer WordPress plugin and enables a Stored Cross‑Site Scripting (XSS) via the plugin shortcode “freemind” in all versions up to 1.0. The vulnerability arises from insufficient input sanitization and output escaping on user‑supplied attributes, allowing an aut...

PT-2025-24042 · WordPress · Hide It

Name of the Vulnerable Software and Affected Versions: Hide It plugin for WordPress versions up to, and including, 1.0.1 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'hideit' shortcode due to insufficient input sanitization and output escaping on user-supplied...

PT-2025-24206 · Unknown · Shiftnav – Responsive Mobile Menu

Name of the Vulnerable Software and Affected Versions: ShiftNav – Responsive Mobile Menu versions 1.8 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means an attacker c...

PT-2025-24247 · Unknown · Themefic Hydra Booking

Name of the Vulnerable Software and Affected Versions: Themefic Hydra Booking versions 1.1.10 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2025-24093 · Pickplugins · Pickplugins Wishlist

Name of the Vulnerable Software and Affected Versions: PickPlugins Wishlist versions 1.0.43 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks. Recommendations: For...

PT-2025-24244 · Wptouch · Wptouch

Name of the Vulnerable Software and Affected Versions: WPtouch versions 4.3.60 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks. Recommendations: For WPtouch version...

PT-2025-24164 · WordPress · Wordpress

Name of the Vulnerable Software and Affected Versions: Broadly for WordPress versions 3.0.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This enables potential attackers to...

PT-2025-24123 · Unknown · Post Author

Name of the Vulnerable Software and Affected Versions: Post Author versions n/a through 1.1.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application, and also...

PT-2025-24106 · Unknown · Bang Tinh Vay

Name of the Vulnerable Software and Affected Versions: Bang tinh vay versions n/a through 1.0.1 Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that an attacker can inject malicious...

CVE-2025-30084

A stored XSS vulnerability in RSMail! component 1.19.20 - 1.22.26 for Joomla was discovered. The issue occurs within the dashboard component, where user-supplied input is not properly sanitized before being stored and rendered. An attacker can inject malicious JavaScript code into text fields or...

SUSE-SU-2025:01571-1 Security update for gimp

This update for gimp fixes the following issues: - CVE-2025-2761: unvalidated user input in FLI file parsing may lead to an out-of-bounds write bsc1241691...

CVE-2025-30084 Extension - rsjoomla.com - Reflected XSS vulnerability RSMail! component 1.19.20-1.22.26 for Joomla

A stored XSS vulnerability in RSMail! component 1.19.20 - 1.22.26 for Joomla was discovered. The issue occurs within the dashboard component, where user-supplied input is not properly sanitized before being stored and rendered. An attacker can inject malicious JavaScript code into text fields or...

CVE-2025-30084 Extension - rsjoomla.com - Reflected XSS vulnerability RSMail! component 1.19.20-1.22.26 for Joomla

A stored XSS vulnerability in RSMail! component 1.19.20 - 1.22.26 for Joomla was discovered. The issue occurs within the dashboard component, where user-supplied input is not properly sanitized before being stored and rendered. An attacker can inject malicious JavaScript code into text fields or...

SUSE SLES15 / openSUSE 15 Security Update : gnuplot (SUSE-SU-2025:01811-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01811-1 advisory. - CVE-2025-31176: invalid read leads to segmentation fault on plot3dpoints bsc1240325. - CVE-2025-31177: improper...

VulnCheck KEV: CVE-2025-0288

Various Paragon Software products contain an arbitrary kernel memory vulnerability within biontdrv.sys, facilitated by the memmove function, which does not validate or sanitize user controlled input, allowing an attacker the ability to write arbitrary kernel memory and perform privilege escalatio...

PT-2025-23926 · Joomla · Rsmail!

Name of the Vulnerable Software and Affected Versions: RSMail! component versions 1.19.20 through 1.22.26 for Joomla Description: A stored XSS issue was discovered in the RSMail! component for Joomla, where user-supplied input is not properly sanitized before being stored and rendered within the...

CVE-2025-20279

A vulnerability in the web-based management interface of Cisco Unified CCX could allow an authenticated, remote attacker to conduct a stored XSS attack on an affected system. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to...

CVE-2025-20273

A vulnerability in the web-based management interface of Cisco Unified Intelligent Contact Management Enterprise could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. This...