5976 matches found
CVE-2025-2484 Multi Video Box <= 1.5.2 - Reflected Cross-Site Scripting via video_id and group_id Parameters
The Multi Video Box plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'videoid' and 'groupid' parameters in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...
CVE-2025-2477 CryoKey <= 2.4 - Reflected Cross-Site Scripting via 'ckemail' Parameter
The CryoKey plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘ckemail’ parameter in all versions up to, and including, 2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts i...
CVE-2025-2479
CVE-2025-2479 affects the WordPress plugin Easy Custom Admin Bar . It is a Reflected Cross‑Site Scripting vulnerability via the msg parameter in versions
CVE-2025-2477 CryoKey <= 2.4 - Reflected Cross-Site Scripting via 'ckemail' Parameter
The CryoKey plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘ckemail’ parameter in all versions up to, and including, 2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts i...
CVE-2024-13739
CVE-2024-13739 concerns the WordPress Newsletters plugin. Affected: Newsletters plugin for WordPress, all versions up to and including 4.9.9.7. Issue: Reflected Cross-Site Scripting via the to parameter caused by insufficient input sanitization and output escaping. Impact: unauthenticated attacke...
CVE-2024-13739: Improper Neutralization of Input During Web Page Generation
The Newsletters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the "to" parameter in all versions up to, and including, 4.9.9.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...
CVE-2025-29410
A cross-site scripting XSS vulnerability in the component /contact.php of Hospital Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the txtEmail parameter...
CVE-2025-29410: Improper Neutralization of Input During Web Page Generation
A cross-site scripting XSS vulnerability in the component /contact.php of Hospital Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the txtEmail parameter...
CVE-2025-26127
A stored cross-site scripting XSS vulnerability in the Send for Approval function of FileCloud v23.241.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...
CVE-2025-2163
The Zoorum Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9. This is due to missing or incorrect nonce validation on the zoorumsetoptions function. This makes it possible for unauthenticated attackers to update settings and inject...
PT-2025-11502
Name of the Vulnerable Software and Affected Versions FileCloud version 23.241.2 Description A stored cross-site scripting XSS issue in the Send for Approval function allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Recommendations For version 23.241.2, consider...
CVE-2025-1526
The DethemeKit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the De Product Display Widget countdown feature in all versions up to, and including, 2.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
CVE-2025-2163 Zoorum Comments <= 0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
The Zoorum Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9. This is due to missing or incorrect nonce validation on the zoorumsetoptions function. This makes it possible for unauthenticated attackers to update settings and inject...
CVE-2025-2164
CVE-2025-2164 affects the WordPress plugin pixelstats (
CVE-2025-25908
A stored cross-site scripting XSS vulnerability in tianti v2.3 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the coverImageURL parameter at /article/ajax/save...
CVE-2025-2163: Improper Neutralization of Input During Web Page Generation
The Zoorum Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9. This is due to missing or incorrect nonce validation on the zoorumsetoptions function. This makes it possible for unauthenticated attackers to update settings and inject...
CVE-2025-2166
CVE-2025-2166 affects the WordPress plugin CM FAQ – Simplify support with an intuitive FAQ management tool, with a Reflected Cross‑Site Scripting vulnerability caused by insufficient URL escaping in remove_query_arg. Affected versions are all up to and including 1.2.5. An unauthenticated attacker...
CVE-2025-1503 WP Recipe Maker <= 9.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Roundup Recipe Name field in all versions up to, and including, 9.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-leve...
PT-2025-11224
Name of the Vulnerable Software and Affected Versions: Rafed CMS Website version 1.44 Description: A cross-site scripting XSS vulnerability in the component index.php of Rafed CMS Website allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Recommendations: For Rafed C...