Cross-site Scripting (XSS)

Overview prestashop/pscontactinfo is a package for displaying additional information about your store's customer service. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the getWidgetVariables function, due to the use of the nofilter tag, which allows malicious...

WordPress plugin Blue Wrench Video Widget has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2025-23809: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Sunil Nanda Blue Wrench Video Widget blue-wrench-videos-widget allows Reflected XSS.This issue affects Blue Wrench Video Widget: from n/a through = 2.1.0...

CVE-2023-45908

Homarr before v0.14.0 was discovered to contain a stored cross-site scripting XSS vulnerability via the Notebook widget...

CVE-2025-22722

Missing Authorization vulnerability in Marketing Fire Widget Options widget-options allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Widget Options: from n/a through = 4.0.8...

CVE-2025-22722 WordPress Widget Options plugin <= 4.0.8 - Broken Access Control to Notice Dimissal vulnerability

Missing Authorization vulnerability in Marketing Fire Widget Options widget-options allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Widget Options: from n/a through = 4.0.8...

CVE-2025-22722 WordPress Widget Options plugin <= 4.0.8 - Broken Access Control to Notice Dimissal vulnerability

Missing Authorization vulnerability in Marketing Fire Widget Options widget-options allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Widget Options: from n/a through = 4.0.8...

CVE-2025-22722

Technical details about CVE-2025-22722 are not provided in the connected documents. The initial entry notes a Missing Authorization issue in Widget Options plugin versions up to 4.0.8, but no technical specifics or affected product/version data are disclosed here. Monitor for updates.

PT-2025-3857 · WordPress · Jetelements

Name of the Vulnerable Software and Affected Versions: JetElements plugin for WordPress versions up to, and including, 2.7.2.1 Description: The JetElements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets due to insufficient input sanitization and output...

CVE-2023-45908

Homarr before v0.14.0 was discovered to contain a stored cross-site scripting XSS vulnerability via the Notebook widget...

PT-2025-1498 · Homarr · Homarr

Name of the Vulnerable Software and Affected Versions: Homarr versions prior to 0.14.0 Description: The issue is related to a stored cross-site scripting XSS vulnerability. This vulnerability can be exploited via the Notebook widget. Recommendations: For versions prior to 0.14.0, update to versio...

CVE-2023-45908

Homarr before v0.14.0 was discovered to contain a stored cross-site scripting XSS vulnerability via the Notebook widget...

PT-2025-4649

Name of the Vulnerable Software and Affected Versions Widget Options versions n/a through 4.0.8 Description The issue is related to a Missing Authorization vulnerability in Widget Options Team Widget Options, which allows exploiting incorrectly configured access control security levels...

WordPress plugin Widget Options has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2023-45908

The Homarr customizable browser homepage (versions prior to v0.14.0 ) is vulnerable to a stored cross-site scripting (XSS) vulnerability. The flaw exists within the Notebook widget , where improper neutralization of input during web page generation allows for malicious script execution. To remedi...

CVE-2023-45908: Improper Neutralization of Input During Web Page Generation

Homarr before v0.14.0 was discovered to contain a stored cross-site scripting XSS vulnerability via the Notebook widget...

CVE-2025-22722: Missing Authorization

Missing Authorization vulnerability in Marketing Fire Widget Options widget-options allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Widget Options: from n/a through = 4.0.8...

Homarr cross-site scripting vulnerabilities

homarr is a customizable browser homepage by Thomas Camlong, an individual developer, that is used to interact with Docker containers on the main server. A security vulnerability exists in homarr versions prior to v0.14.0 that stems from the inclusion of a stored cross-site scripting XSS...

CVE-2023-45908

Homarr before v0.14.0 was discovered to contain a stored cross-site scripting XSS vulnerability via the Notebook widget...

CVE-2024-12203 RSS Icon Widget <= 5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting

The RSS Icon Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘linkcolor’ parameter in all versions up to, and including, 5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...