CVE-2025-62894

The CVE-2025-62894 entry documents a Stored XSS vulnerability in the WordPress plugin “ACF Recent Posts Widget” (acf-recent-posts-widget), caused by improper input neutralization during web page generation. Affected versions are up to 5.9.3 (i.e.,

PT-2025-43933

Name of the Vulnerable Software and Affected Versions Zytec Dalian Zhuoyun Technology Central Authentication Service versions prior to 20251010 Description A code injection issue exists in the Central Authentication Service. The issue is located in the empty function of the /index.php/auth/widget...

PT-2025-43830

Cross-Site Request Forgery CSRF vulnerability in iseremet Reloadly reloadly-topup-widget allows Stored XSS.This issue affects Reloadly: from n/a through = 2.0.1...

Zytec Central Authentication Service 代码注入漏洞

Zytec Central Authentication Service is a centralized authentication service from China's Zhuo Yun Zytec Company. A code injection vulnerability exists in Zytec Central Authentication Service 20251009 and earlier versions, which stems from incorrect manipulation of the parameters get.layer,...

PT-2025-43902

Name of the Vulnerable Software and Affected Versions chatwoot versions prior to 4.7.0 Description A flaw exists in chatwoot that allows for origin validation errors. This issue is located within the initPostMessageCommunication function of the app/javascript/sdk/IFrameHelper.js file, part of the...

WordPress plugin ACF Recent Posts Widget 跨站脚本漏洞

WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up a personal blog site on a PHP and MySQL based server.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in the WordPress plugin ACF Recent Posts Widget, no...

PT-2025-43773

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in magicoders ACF Recent Posts Widget acf-recent-posts-widget allows Stored XSS.This issue affects ACF Recent Posts Widget: from n/a through = 5.9.3...

WordPress plugin Widget Options 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

EUVD-2025-35925

The Widget Options – The 1 WordPress Widget & Block Control Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple functions in all versions up to, and including, 4.1.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-10580

The Widget Options – The 1 WordPress Widget & Block Control Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple functions in all versions up to, and including, 4.1.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-10580

Widget Options (WordPress plugin) is affected by a stored cross-site scripting (XSS) vulnerability in versions up to 4.1.2, allowing authenticated attackers with Contributor+ or higher privileges to inject scripts that run on pages accessed by users. Wordfence reports the vulnerability with CVSS ...

CVE-2025-10580 Widget Options – The #1 WordPress Widget & Block Control Plugin <= 4.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Widget Options – The 1 WordPress Widget & Block Control Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple functions in all versions up to, and including, 4.1.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-10580 Widget Options – The #1 WordPress Widget & Block Control Plugin <= 4.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Widget Options – The 1 WordPress Widget & Block Control Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple functions in all versions up to, and including, 4.1.2 due to insufficient input sanitization and output escaping. This makes it possible for...

WordPress Widget Options plugin <= 4.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Nguyen Ngoc Quang Bach maysbachs in WordPress Plugin Widget Options versions = 4.1.2...

[SECURITY] Fedora 41 Update: qt5-qtsvg-5.15.17-2.fc41

Scalable Vector Graphics SVG is an XML-based language for describing two-dimensional vector graphics. Qt provides classes for rendering and displaying SVG drawings in widgets and on other paint devices...

PT-2025-43717

Name of the Vulnerable Software and Affected Versions Widget Options – The 1 WordPress Widget & Block Control Plugin versions prior to 4.1.3 Description The software is susceptible to a Stored Cross-Site Scripting issue due to inadequate input sanitization and output escaping. This allows...

CVE-2025-60168

Cross-Site Request Forgery CSRF vulnerability in integrationshotelrunner HotelRunner Booking Widget hotelrunner allows Stored XSS.This issue affects HotelRunner Booking Widget: from n/a through = 1.6...

CVE-2025-62071

Missing Authorization vulnerability in Repuso Social proof testimonials and reviews by Repuso social-testimonials-and-reviews-widget.This issue affects Social proof testimonials and reviews by Repuso: from n/a through = 5.29...

CVE-2025-11827

The Oboxmedia Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'beforewidget' and 'afterwidget' parameters of the oboxads-ad-widget shortcode in all versions up to, and including, 1.9.8. This is due to insufficient input sanitization and output escaping. This makes it...

EUVD-2025-35367

Missing Authorization vulnerability in Repuso Social proof testimonials and reviews by Repuso social-testimonials-and-reviews-widget.This issue affects Social proof testimonials and reviews by Repuso: from n/a through = 5.29...