CVE-2025-0687

The CVE-2025-0687 entry covers a reflected Cross-Site Scripting flaw in the WordPress plugin Spiritual Gifts Survey (and S.H.A.P.E. survey) for versions up to 0.9.10. The issue arises because a parameter is not sanitized/escaped before being echoed in the page, allowing a reflected XSS attack tha...

CVE-2025-0687 Spiritual Gifts Survey <= 0.9.10 - Unauthenticated CSRF to XSS

The Spiritual Gifts Survey and optional S.H.A.P.E survey WordPress plugin through 0.9.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users...