CVE-2025-5537

The Lightbox & Modal Popup WordPress Plugin – FooBox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alternative texts in all versions up to, and including, 2.7.34 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2025-24764

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in A. Jones Simply Guest Author Name guest-author-name allows DOM-Based XSS.This issue affects Simply Guest Author Name: from n/a through = 4.36...

CVE-2023-50786

Dradis through 4.16.0 allows referencing external images resources over HTTPS, instead of forcing the use of embedded uploaded images. This can be leveraged by an authorized author to attempt to steal the Net-NTLM hashes of other authors on a Windows domain network...

CVE-2025-24764

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in A. Jones Simply Guest Author Name guest-author-name allows DOM-Based XSS.This issue affects Simply Guest Author Name: from n/a through = 4.36...

CVE-2025-24764

The CVE-2025-24764 entry pertains to the WordPress plugin “(Simply) Guest Author Name” (versions up to 4.36) and describes a DOM-based Cross-Site Scripting (XSS) vulnerability caused by improper input neutralization during web page generation. Public sources in the connected docs indicate this is...

CVE-2025-24764 WordPress (Simply) Guest Author Name plugin <= 4.36 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in A. Jones Simply Guest Author Name guest-author-name allows DOM-Based XSS.This issue affects Simply Guest Author Name: from n/a through = 4.36...

PT-2025-27872 · Unknown · Guest Author Name

Name of the Vulnerable Software and Affected Versions: Simply Guest Author Name versions n/a through 4.36 Description: The issue is related to improper neutralization of input during web page generation, which allows DOM-Based XSS. This enables potential attackers to execute malicious scripts in...

WordPress plugin (Simply) Guest Author Name 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in PHP. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress plugin...

CVE-2025-4367

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpdmuserdashboard shortcode in all versions up to, and including, 3.3.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WordPress Pixabay Images plugin <= 3.4 - Authenticated (Author+) Arbitrary File Upload vulnerability

Authenticated Author+ Arbitrary File Upload vulnerability discovered by siavashvafshar in WordPress Plugin Pixabay Images versions = 3.4...

WordPress ZotPress plugin <= 7.3.15 - Authenticated (Author+) Stored Cross-Site Scripting via 'nickname' vulnerability

Authenticated Author+ Stored Cross-Site Scripting via 'nickname' vulnerability discovered by mohamed hamadou ZoeniX in WordPress Plugin Zotpress versions = 7.3.15...

CVE-2025-4666

The Zotpress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘nickname’ parameter in all versions up to, and including, 7.3.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and...

CVE-2025-4666

CVE-2025-4666 (Zotpress for WordPress) : Stored Cross-Site Scripting via the nickname parameter affects Zotpress versions up to 7.3.15. Reported as exploitable by authenticated attackers with Author-level access and above. Root cause: insufficient input sanitization/output escaping. Impact: scrip...

CVE-2025-28950

Cross-Site Request Forgery CSRF vulnerability in David Shabtai Post Author post-author allows Stored XSS.This issue affects Post Author: from n/a through = 1.1.1...

CVE-2025-28950

Cross-Site Request Forgery CSRF vulnerability in David Shabtai Post Author post-author allows Stored XSS.This issue affects Post Author: from n/a through = 1.1.1...

CVE-2025-28950 WordPress Post Author plugin <= 1.1.1 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in David Shabtai Post Author post-author allows Stored XSS.This issue affects Post Author: from n/a through = 1.1.1...

CVE-2025-28950

CVE-2025-28950: The WordPress plugin Post Author (David Shabtai) is affected by a CSRF vulnerability that can lead to Stored XSS. The vulnerability is reported for Post Author versions up to 1.1.1 (no details on patch status are provided in the connected documents). Public sources in the Connecte...

CVE-2025-28950 WordPress Post Author plugin <= 1.1.1 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in David Shabtai Post Author post-author allows Stored XSS.This issue affects Post Author: from n/a through = 1.1.1...

PT-2025-24123 · Unknown · Post Author

Name of the Vulnerable Software and Affected Versions: Post Author versions n/a through 1.1.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application, and also...

WordPress plugin Post Author 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. Cross-site request forgery...