CVE-2025-48321 WordPress Ultimate twitter profile widget plugin <= 1.0 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in dyiosah Ultimate twitter profile widget allows Stored XSS. This issue affects Ultimate twitter profile widget: from n/a through 1.0...

CVE-2025-48319

CVE-2025-48319 corresponds to a stored XSS in the WordPress plugin “Mesa Mesa Reservation Widget” (versions up to 1.0.0). The root cause is improper input neutralization during web page generation, enabling attacker-supplied payloads to persist in the widget. Reported as affecting Mesa Mesa Reser...

CVE-2025-48319 WordPress Mesa Mesa Reservation Widget plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in gslauraspeck Mesa Mesa Reservation Widget mesa-mesa-reservation-widget allows Stored XSS.This issue affects Mesa Mesa Reservation Widget: from n/a through = 1.0.0...

Malicious code in etoro-plaid-widget (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-41560 Malicious code in etoro-plaid-widget (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2025-8603

CVE-2025-8603 affects the WordPress plugin “Unlimited Elements For Elementor” (Auth Contributor+). Root cause: insufficient input sanitization and output escaping in multiple widgets, enabling stored XSS. Impact: authenticated attackers can inject scripts that run when other users visit the injec...

CVE-2025-48321: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in dyiosah Ultimate twitter profile widget ultimate-twitter-profile-widget allows Stored XSS.This issue affects Ultimate twitter profile widget: from n/a through = 1.0...

WordPress plugin Theme Blvd Widget Areas 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerability...

CVE-2025-48308: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in nonletter Newsletter subscription optin module newsletter-subscription-widget-for-sendblaster allows Stored XSS.This issue affects Newsletter subscription optin module: from n/a through = 1.2.9...

CVE-2025-53289: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jason Theme Blvd Widget Areas theme-blvd-widget-areas allows Reflected XSS.This issue affects Theme Blvd Widget Areas: from n/a through = 1.3.0...

CVE-2025-48319: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in gslauraspeck Mesa Mesa Reservation Widget mesa-mesa-reservation-widget allows Stored XSS.This issue affects Mesa Mesa Reservation Widget: from n/a through = 1.0.0...

WordPress plugin ATT YouTube Widget 跨站请求伪造漏洞

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery vulnerability exists in the WordPress plugin ATT YouTube Widget, no detaile...

WordPress plugin Ultimate twitter profile widget 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

CVE-2025-48359: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in thaihavnn07 ATT YouTube Widget att-youtube allows Stored XSS.This issue affects ATT YouTube Widget: from n/a through = 1.0...

WordPress plugin Mesa Mesa Reservation Widget 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2025-35009

Name of the Vulnerable Software and Affected Versions: dyiosah Ultimate twitter profile widget versions through 1.0 Description: A Cross-Site Request Forgery CSRF vulnerability exists in dyiosah Ultimate twitter profile widget, which also allows Stored Cross-Site Scripting XSS. Recommendations: A...

PT-2025-35027

Name of the Vulnerable Software and Affected Versions: thaihavnn07 ATT YouTube Widget versions through 1.0 Description: A Cross-Site Request Forgery CSRF vulnerability exists in the thaihavnn07 ATT YouTube Widget, which can lead to Stored Cross-Site Scripting XSS. Recommendations: Update...

PT-2025-35007

Name of the Vulnerable Software and Affected Versions: Mesa Mesa Reservation Widget versions through 1.0.0 Description: The Mesa Mesa Reservation Widget contains a Stored Cross-site Scripting XSS issue due to improper neutralization of input during web page generation. Recommendations: Update Mes...

CVE-2025-48322: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Finn Dohrn Statify Widget statify-widget allows Stored XSS.This issue affects Statify Widget: from n/a through = 1.4.6...

WordPress plugin Statify Widget 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...