318 matches found
CVE-2025-25165
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in richardgabriel Staff Directory Plugin: Company Directory staff-directory-pro allows Stored XSS.This issue affects Staff Directory Plugin: Company Directory: from n/a through = 4.3...
CVE-2025-25090 WordPress Dreamstime Stock Photos plugin <= 4.1 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in dreamstime Dreamstime Stock Photos dreamstime-stock-photos allows Reflected XSS.This issue affects Dreamstime Stock Photos: from n/a through = 4.1...
CVE-2025-27347
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in techmix Direct Checkout Button for WooCommerce woo-direct-checkout-button allows Stored XSS.This issue affects Direct Checkout Button for WooCommerce: from n/a through = 1.0...
CVE-2025-26973 WordPress Social Warfare Plugin <= 4.5.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WarfarePlugins Social Warfare social-warfare allows DOM-Based XSS.This issue affects Social Warfare: from n/a through = 4.5.5...
CVE-2025-23905 WordPress Admin Options Pages plugin <= 0.9.7 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Johannes van Poelgeest Admin Options Pages admin-options-pages allows Reflected XSS.This issue affects Admin Options Pages: from n/a through = 0.9.7...
PT-2025-7189
Name of the Vulnerable Software and Affected Versions: Elfsight Yottie Lite versions 1.3.3 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored Cross-site Scripting XSS. This means that an attacker can inject malicio...
CVE-2024-27781
CVE-2024-27781 is an XSS vulnerability in Fortinet FortiSandbox products due to improper neutralization of input during web page generation. The issue affects FortiSandbox versions 3.0.0–3.2.x, 4.0.0–4.0.4, 4.2.0–4.2.6, and 4.4.0–4.4.4, allowing an authenticated attacker to execute unauthorized c...
1000 Projects Bookstore Management System SQL注入漏洞
1000 Projects Bookstore Management System is an open source bookstore management system from 1000 Projects. A SQL injection vulnerability exists in 1000 Projects Bookstore Management System version 1.0, which stems from a parameter id in the file processusersdel.php that can lead to SQL injection...
CVE-2021-4164
calibre-web is vulnerable to Cross-Site Request Forgery CSRF...
CVE-2025-24560 WordPress Awesome Event Booking plugin <= 2.7.1 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in AwesomeTOGI Awesome Event Booking awesome-event-booking allows Reflected XSS.This issue affects Awesome Event Booking: from n/a through = 2.7.1...
Fortinet FortiPortal Cross-Site Scripting Vulnerability (CNVD-2025-03523)
Fortinet FortiPortal is an advanced, feature-rich hosted security analysis and management support tool for Fortinet's FortiGate, FortiWiFi and FortiAP product lines, available as a virtual machine for MSPs. A cross-site scripting vulnerability exists in Fortinet FortiPortal that stems from an...
CVE-2025-23676
CVE-2025-23676 affects LH Email (WordPress LH Email plugin). The Red Hat advisory notes an Improper Neutralization of Input leading to Reflected XSS in LH Email up to version 1.12. The vulnerability is described as Reflected XSS in LH Email with unpatched status per the LH Email entry. Connected ...
CVE-2025-23946
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Le-Pixel-Solitaire Enhanced YouTube Shortcode enhanced-youtube-shortcode allows Stored XSS.This issue affects Enhanced YouTube Shortcode: from n/a through = 2.0.1...
CVE-2025-23699
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in techmix Event Countdown Timer Plugin by TechMix event-countdown-timer allows Reflected XSS.This issue affects Event Countdown Timer Plugin by TechMix: from n/a through = 1.4...
CVE-2024-52967
Fortinet FortiPortal versions 6.0.0–6.0.14 are affected by CVE-2024-52967 due to improper neutralization of script-related HTML tags, enabling HTML injection and basic cross-site scripting that can allow an attacker to run unauthorized code or commands. The issue stems from a script-related HTML ...
CVE-2024-13247
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Coffee allows Cross-Site Scripting XSS.This issue affects Coffee: from 0.0.0 before 1.4.0...
CVE-2025-22808 WordPress Surbma | Premium WP plugin <= 9.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Surbma Surbma | Premium WP allows DOM-Based XSS.This issue affects Surbma | Premium WP: from n/a through 9.0...
Cross-site Scripting (XSS)
Overview phpoffice/phpspreadsheet is a Spreadsheet engine that Read, Create and Write Spreadsheet documents in PHP . Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper user input sanitization passed through the generateMeta parameter of the class...
WordPress plugin Embed PDF Viewer 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports PHP and MySQL servers to set up a personal blog site. WordPress plugin is an application plug-in. WordPress plugin Embed PDF Viewer...