CVE-2025-49398

The CVE refers to CVE-2025-49398 targeting the WordPress plugin WordPress Easy Appointments (plugin name: Easy Appointments) with versions <= 3.12.14. The flaw is described as Improper Neutralization of Script-Related HTML Tags in a Web Page, leading to a Basic XSS/Content Injection vulnerabil...

WordPress Strong Testimonials plugin <= 3.2.16 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Kishan Vyas in WordPress Plugin Strong Testimonials versions = 3.2.16...

Improper Input Validation

@digitalocean/do-markdownit is vulnerable to Improper Input Validation. The vulnerability is due to the callout and fenceenvironment plugins using .includes substring matching when allowedClasses or allowedEnvironments are strings instead of arrays, which allows an attacker to bypass intended...

EUVD-2025-37203

Cross-site scripting XSS vulnerability in the Blogs widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, 7.3 GA through update 36, and older unsupported versions allow...

CVE-2025-62798

The CVE-2025-62798 issue affects the code16/sharp package (Sharp) used with Laravel, specifically the SharpShowTextField component. In vulnerable versions prior to 9.11.1, Vue evaluated expressions wrapped in {{ ... }} when rendering content, allowing attacker-controlled input to execute arbitrar...

CVE-2025-62936 WordPress xSmart theme <= 1.2.9.4 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Jthemes xSmart xsmart allows Code Injection.This issue affects xSmart: from n/a through = 1.2.9.4...

CVE-2025-62936 WordPress xSmart theme <= 1.2.9.4 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Jthemes xSmart xsmart allows Code Injection.This issue affects xSmart: from n/a through = 1.2.9.4...

CVE-2025-62936

CVE-2025-62936 concerns WordPress theme/plugin xSmart (WordPress Theme: xSmart) with versions up to and including 1.2.9.4. The issue is Improper Neutralization of Script-Related HTML Tags in a Web Page, i.e., a Basic XSS vulnerability that can enable Code Injection. The vulnerability affects the ...

CVE-2025-62897 WordPress WP Recipe Maker plugin < 10.1.0 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Brecht WP Recipe Maker wp-recipe-maker allows Code Injection.This issue affects WP Recipe Maker: from n/a through 10.1.0...

CVE-2025-62897 WordPress WP Recipe Maker plugin < 10.1.0 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Brecht WP Recipe Maker wp-recipe-maker allows Code Injection.This issue affects WP Recipe Maker: from n/a through 10.1.0...

CVE-2025-62897

CVE-2025-62897 affects the WordPress plugin WP Recipe Maker (wp-recipe-maker), with versions up to and including 10.1.1 reported as vulnerable. The underlying issue is “Improper Neutralization of Script-Related HTML Tags” (Basic XSS) that enables Code Injection through content handling in the plu...

WordPress Discussion Board – WordPress Forum Plugin plugin <= 2.5.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution vulnerability

Authenticated Subscriber+ Arbitrary Shortcode Execution vulnerability discovered by Kishan Vyas in WordPress Plugin Discussion Board versions = 2.5.5...

CVE-2025-9980

CVE-2025-9980 describes a Stored XSS vulnerability in QuickCMS, specifically in the page editor (pages-form). The issue allows a malicious actor with admin privileges to inject arbitrary HTML/JavaScript that is rendered/executed when visiting the edited page. The public material notes that only v...

Improper Input Validation

@anthropic-ai/claude-code is vulnerable to Improper Input Validation. The vulnerability is due to an error in command parsing that allows an attacker to bypass the confirmation prompt and trigger execution of untrusted commands by injecting malicious content into a Claude Code context window...

CVE-2025-58970 WordPress Doctreat theme <= 1.6.7 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in AmentoTech Doctreat doctreat allows Code Injection.This issue affects Doctreat: from n/a through = 1.6.7...

CVE-2025-58970 WordPress Doctreat theme <= 1.6.7 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in AmentoTech Doctreat doctreat allows Code Injection.This issue affects Doctreat: from n/a through = 1.6.7...

CVE-2025-58970

CVE-2025-58970 is a WordPress Doctreat theme vulnerability (versions ≤ 1.6.7) described as an Improper Neutralization of Script-Related HTML Tags in a Web Page, enabling Code Injection (Basic XSS). Connected sources consistently identify the affected component as the Doctreat WordPress theme, up ...

WordPress Stockie Extra plugin <= 1.2.11 - Content Injection vulnerability

Content Injection vulnerability discovered by Bonds in WordPress Plugin Stockie Extra versions = 1.2.11...

WordPress WP Go Maps (formerly WP Google Maps) plugin <= 9.0.48 - Unauthenticated Cache Poisoning vulnerability

Unauthenticated Cache Poisoning vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin WP Go Maps versions = 9.0.48...

WordPress xSmart theme <= 1.2.9.4 - Content Injection vulnerability

Content Injection vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme xSmart versions = 1.2.9.4...