WordPress TZ PlusGallery Plugin <= 1.5.5 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Jieun Kim in WordPress Plugin TZ PlusGallery versions = 1.5.5...

WordPress CP Multi View Event Calendar plugin <= 1.4.34 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin CP Multi View Event Calendar versions = 1.4.34...

WordPress Image Editor by Pixo Plugin <= 2.3.8 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin Image Editor by Pixo versions = 2.3.8...

CVE-2025-57909

CVE-2025-57909 affects Editor Custom Color Palette (Rouergue Création) for WordPress, with a Missing Authorization flaw in versions

CVE-2025-57909 WordPress Editor Custom Color Palette plugin <= 3.5.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in Rouergue Création Editor Custom Color Palette editor-custom-color-palette allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Editor Custom Color Palette: from n/a through = 3.5.6...

CVE-2025-57909 WordPress Editor Custom Color Palette plugin <= 3.5.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in Rouergue Création Editor Custom Color Palette editor-custom-color-palette allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Editor Custom Color Palette: from n/a through = 3.5.6...

CVE-2025-58232 WordPress Image Editor by Pixo Plugin <= 2.3.8 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ickata Image Editor by Pixo image-editor-by-pixo allows DOM-Based XSS.This issue affects Image Editor by Pixo: from n/a through = 2.3.8...

CVE-2025-58232

CVE-2025-58232 affects Image Editor by Pixo (WordPress plugin). The entry documents a DOM/Stored XSS vector in the Editor component, arising from Improper Neutralization of Input During Web Page Generation. Affected version:

CVE-2025-58232 WordPress Image Editor by Pixo Plugin <= 2.3.8 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ickata Image Editor by Pixo image-editor-by-pixo allows DOM-Based XSS.This issue affects Image Editor by Pixo: from n/a through = 2.3.8...

PT-2025-39019

Name of the Vulnerable Software and Affected Versions Rouergue Création Editor Custom Color Palette versions through 3.4.8 Description An authorization issue exists in Rouergue Création Editor Custom Color Palette due to incorrectly configured access control security levels. This allows...

CVE-2025-57205

iNiLabs School Express SMS Express 6.2 is affected by a Stored Cross-Site Scripting XSS vulnerability in the content-management features available to authenticated admin users. The vulnerability resides in POSTed editor parameters submitted to the /posts/edit/id endpoint and similarly in Notice a...

CVE-2025-57205

Inilabs School Express (SMS Express) 6.2 is affected by a Stored XSS in content-management editors (POST /posts/edit/{id} and similar for Notices/Pages). The root cause is insufficient input sanitization and output encoding for editor parameters; payloads are saved and later rendered unsanitized,...

CVE-2025-57205

iNiLabs School Express SMS Express 6.2 is affected by a Stored Cross-Site Scripting XSS vulnerability in the content-management features available to authenticated admin users. The vulnerability resides in POSTed editor parameters submitted to the /posts/edit/id endpoint and similarly in Notice a...

PT-2025-39078

Name of the Vulnerable Software and Affected Versions iNiLabs School Express SMS Express version 6.2 Description iNiLabs School Express SMS Express 6.2 is susceptible to a Stored Cross-Site Scripting XSS issue within its content-management features, accessible to authenticated administrator users...

WordPress plugin Image Editor by Pixo 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin ... A cross-site scripting...

WordPress plugin Editor Custom Color Palette 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin.... A security...

Inilabs School Express 安全漏洞

Inilabs School Express is a school management software from Inilabs Bangladesh. A security vulnerability exists in Inilabs School Express version 6.2, which stems from insufficient cleanup and coding of the POSTed editor parameter in the content management functionality, which could lead to a...

PT-2025-38897

Name of the Vulnerable Software and Affected Versions Ickata Image Editor by Pixo versions through 2.3.8 Description The software contains a flaw related to improper input handling during web page generation, leading to a DOM-Based Cross-site Scripting XSS condition. This allows for the potential...

PoC-Stored-XSS-textpattern-4.8.8-Exploit

Textpattern CMS 4.8.8 — Stored XSS Advisory Title: Stored...

CVE-2025-58174

LAM (LDAP Account Manager) up to v9.2 has a stored XSS in the Profile section via the profile name field. An authenticated user with profile edit rights can inject script that executes when the profile is viewed. The issue is fixed in v9.3; upgrade to 9.3 or later is the recommended remediation. ...