WordPress plugin Product Import Export for WooCommerce 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in WordPress...

The vulnerability of the Application-Layer Protocol Negotiation (ALPN) component in Mozilla Firefox, Firefox ESR, and email clients Thunderbird, Thunderbird ESR, allows a hacker to redirect users to any desired URL address.

The vulnerability of the Application-Layer Protocol Negotiation ALPN component in Mozilla Firefox, Firefox ESR, and Thunderbird email clients, including Thunderbird ESR, is related to the redirection of URLs to unreliable websites. Exploiting this vulnerability allows a malicious actor to redirec...

CVE-2025-2108

The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Site Title’ widget's 'titletag' and 'htmltag' parameters in all versions up to, and including, 1.4.6.8 due to insufficient input sanitization and output escaping. This...

CVE-2025-2484 Multi Video Box <= 1.5.2 - Reflected Cross-Site Scripting via video_id and group_id Parameters

The Multi Video Box plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'videoid' and 'groupid' parameters in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

CVE-2025-2479

CVE-2025-2479 affects the WordPress plugin Easy Custom Admin Bar . It is a Reflected Cross‑Site Scripting vulnerability via the msg parameter in versions

CVE-2024-13739

CVE-2024-13739 concerns the WordPress Newsletters plugin. Affected: Newsletters plugin for WordPress, all versions up to and including 4.9.9.7. Issue: Reflected Cross-Site Scripting via the to parameter caused by insufficient input sanitization and output escaping. Impact: unauthenticated attacke...

CVE-2025-29410

A cross-site scripting XSS vulnerability in the component /contact.php of Hospital Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the txtEmail parameter...

The vulnerability of the PHP programming language interpreter, related to a numerical truncation error, allows attackers to redirect users to any arbitrary URL address or cause a service failure.

The vulnerability of the PHP programming language interpreter is related to a numerical truncation error. Exploiting this vulnerability can allow an attacker to redirect a user to any desired URL address or cause a service failure...

CVE-2025-26127

A stored cross-site scripting XSS vulnerability in the Send for Approval function of FileCloud v23.241.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

CVE-2025-2164

CVE-2025-2164 affects the WordPress plugin pixelstats (

CVE-2025-25908

A stored cross-site scripting XSS vulnerability in tianti v2.3 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the coverImageURL parameter at /article/ajax/save...

CVE-2025-2166

CVE-2025-2166 affects the WordPress plugin CM FAQ – Simplify support with an intuitive FAQ management tool, with a Reflected Cross‑Site Scripting vulnerability caused by insufficient URL escaping in remove_query_arg. Affected versions are all up to and including 1.2.5. An unauthenticated attacker...

Rafed CMS 安全漏洞

Rafed CMS is a blogging system from Rafed Inc. A security vulnerability exists in Rafed CMS version 1.44, which stems from a cross-site scripting vulnerability that could allow an attacker to execute arbitrary web script or HTML via a specially crafted payload...

PT-2025-11000 · WordPress · The Uncanny Automator – Easy Automation

Name of the Vulnerable Software and Affected Versions: The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress versions up to, and including, 6.2 Description: The issue allows authenticated attackers with Administrator-level access and above t...

4 author cheer up donate <= 1.3 - Reflected Cross-Site Scripting

Description The 4 author cheer up donate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts ...

IBM Control Center Cross-Site Scripting Vulnerability

IBM Control Center is a centralized monitoring and management system from International Business Machines IBM. A cross-site scripting vulnerability exists in IBM Control Center versions 6.2.1 through 6.3.1, which stems from improper validation of the HOST header input, and can be exploited by an...

CVE-2025-25925

A stored cross-scripting XSS vulnerability in Openmrs v2.4.3 Build 0ff0ed allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the personName.middleName parameter at /openmrs/admin/patients/shortPatientForm.form...

CVE-2024-13649

The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 1.4.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2025-0370

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘src’ parameter in all versions up to, and including, 7.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-13839

The Staff Directory Plugin: Company Directory plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 4.3. This makes it possible for unauthenticated attackers to inject...