CVE-2024-13758: Cross-Site Request Forgery (CSRF)

The CP Contact Form with PayPal plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.52. This is due to missing or incorrect nonce validation on the cpcontactformpaypalcheckinitactions function. This makes it possible for unauthenticated...

CVE-2023-37412: Execution with Unnecessary Privileges

IBM Aspera Faspex 5.0.0 through 5.0.10 could allow a privileged user to make system changes without proper access controls...

CVE-2024-37527

IBM OpenPages with Watson 8.3 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2025-24689: Insertion of Sensitive Information into Externally-Accessible File or Directory

Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Javier Carazo Import and export users and customers import-users-from-csv-with-meta allows Retrieve Embedded Sensitive Data.This issue affects Import and export users and customers: from n/a through =...

CVE-2024-37527: Improper Neutralization of Input During Web Page Generation

IBM OpenPages with Watson 8.3 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2025-23792: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Busters Passwordless WP – Login with your glance or fingerprint passwordless-wp allows Reflected XSS.This issue affects Passwordless WP – Login with your glance or fingerprint: from n/a through ...

CVE-2024-13458: Improper Neutralization of Input During Web Page Generation

The WordPress SEO Friendly Accordion FAQ with AI assisted content generation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'noticefaq' shortcode in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping on user...

CVE-2025-24638

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in pddring Create with Code create-with-code allows DOM-Based XSS.This issue affects Create with Code: from n/a through = 1.4...

CVE-2025-24638 WordPress Create with Code plugin <= 1.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Pete Dring Create with Code allows DOM-Based XSS. This issue affects Create with Code: from n/a through 1.4...

CVE-2025-24638

CVE-2025-24638 is a DOM-Based XSS in the WordPress plugin Create with Code, affecting versions n/a through 1.4. It results from improper input neutralization during web page generation. Public sources (NVD, Red Hat, Wordfence) classify it as Cross-Site Scripting, with Wordfence noting a patch/Pat...

WordPress Create with Code plugin <= 1.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by SOPROBRO in WordPress Plugin Create with Code versions = 1.4...

MAL-2025-532 Malicious code in lyft-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 191527fd54bb2116b8405e7655ca0fa98138ea2f8f4463ca288460aeb3d1caf9 The OpenSSF Package Analysis project identified 'lyft-internal' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2025-520 Malicious code in lyft-admin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d38f448299b8cf08b4e9a13e97a9c14c62534e926734f9f7b65fd051eb22509c The OpenSSF Package Analysis project identified 'lyft-admin' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2025-483 Malicious code in iberia-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis dbeb23de83ef06752a7c78f785f0b4cde49252cd16b137dd3e3fec73e2714bfc The OpenSSF Package Analysis project identified 'iberia-analytics' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

CVE-2025-24638: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in pddring Create with Code create-with-code allows DOM-Based XSS.This issue affects Create with Code: from n/a through = 1.4...

CVE-2024-13409: Improper Limitation of a Pathname to a Restricted Directory

The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.10 via the 'theme' parameter of the posttypeajaxhandler function. This makes it possible for...

CVE-2024-13542: Improper Neutralization of Input During Web Page Generation

The WP Google Street View with 360° virtual tour & Google maps + Local SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpgsv' shortcode in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-13583: Improper Neutralization of Input During Web Page Generation

The Simple Gallery with Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'c2twsgwf' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2025-5465 · Unknown · Create With Code

Name of the Vulnerable Software and Affected Versions: Create with Code versions n/a through 1.4 Description: The issue is related to improper neutralization of input during web page generation, which allows for DOM-Based XSS. This enables potential attackers to inject malicious scripts into the...

WordPress plugin "Create with Code" cross-site scripting vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...