CVE-2025-52493

PagerDuty Runbook through 2025-06-12 exposes stored secrets directly in the webpage DOM at the configuration page. Although these secrets appear masked as password fields, the actual secret values are present in the page source and can be revealed by simply modifying the input field type from...

CVE-2025-13072

The HandL UTM Grabber / Tracker WordPress plugin versions prior to 2.8.1 is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the insufficient sanitization and escaping of the utm_source parameter before it is outputted back to the page. An attacker could exploit this to exec...

CVE-2024-12731

The Aklamator INfeed WordPress plugin through 2.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...