CVE-2025-0981 Session Hijacking via Stored Cross-Site Scripting (XSS) in ChurchCRM GroupEditor.php Description Field

A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to hijack a user's session by exploiting a Stored Cross Site Scripting XSS vulnerability in the Group Editor page. This allows admin users to inject malicious JavaScript in the description field, which captures the sessi...

CVE-2025-0981 Session Hijacking via Stored Cross-Site Scripting (XSS) in ChurchCRM GroupEditor.php Description Field

A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to hijack a user's session by exploiting a Stored Cross Site Scripting XSS vulnerability in the Group Editor page. This allows admin users to inject malicious JavaScript in the description field, which captures the sessi...

CVE-2025-0981 Session Hijacking via Stored Cross-Site Scripting (XSS) in ChurchCRM GroupEditor.php Description Field

A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to hijack a user's session by exploiting a Stored Cross Site Scripting XSS vulnerability in the Group Editor page. This allows admin users to inject malicious JavaScript in the description field, which captures the sessi...

CVE-2025-0981

A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to hijack a user's session by exploiting a Stored Cross Site Scripting XSS vulnerability in the Group Editor page. This allows admin users to inject malicious JavaScript in the description field, which captures the sessi...

CVE-2024-13852

The Option Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing nonce validation on the pluginpage function. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site via a forged request, grant...

CVE-2024-13852

CVE-2024-13852 affects the WordPress plugin Option Editor (version 1.0). The root cause is missing nonce validation in the plugin_page() function, enabling CSRF. This allows unauthenticated attackers to forge requests to update arbitrary site options, potentially setting the default registration ...

CVE-2024-13852 Option Editor <= 1.0 - Cross-Site Request Forgery to Arbitrary Options Update

The Option Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing nonce validation on the pluginpage function. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site via a forged request, grant...

CVE-2024-13852 Option Editor <= 1.0 - Cross-Site Request Forgery to Arbitrary Options Update

The Option Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing nonce validation on the pluginpage function. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site via a forged request, grant...

WordPress Plugin Option Editor Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery...

PT-2025-6818

Name of the Vulnerable Software and Affected Versions ChurchCRM versions 5.13.0 and prior Description A Stored Cross Site Scripting XSS vulnerability exists in the Group Editor page, allowing attackers to hijack user sessions. Admin users can inject malicious JavaScript in the description field,...

CVE-2024-13852: Cross-Site Request Forgery (CSRF)

The Option Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing nonce validation on the pluginpage function. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site via a forged request, grant...

PT-2025-6617

Name of the Vulnerable Software and Affected Versions Option Editor plugin for WordPress version 1.0 Description The issue is due to missing nonce validation on the plugin page function, making it possible for unauthenticated attackers to update arbitrary options on the WordPress site via a forge...

CVE-2025-0981: Improper Authentication

A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to hijack a user's session by exploiting a Stored Cross Site Scripting XSS vulnerability in the Group Editor page. This allows admin users to inject malicious JavaScript in the description field, which captures the sessi...

WordPress Option Editor plugin <= 1.0 - Cross-Site Request Forgery to Arbitrary Options Update vulnerability

Cross-Site Request Forgery to Arbitrary Options Update vulnerability discovered by Colin Xu in WordPress Plugin Option Editor versions = 1.0...

CVE-2025-26775: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in RealMag777 BEAR woo-bulk-editor allows Stored XSS.This issue affects BEAR: from n/a through = 1.1.4.4...

CVE-2025-26582

Cross-Site Request Forgery CSRF vulnerability in Blackbam TinyMCE Advanced qTranslate fix editor problems tinymce-advanced-qtranslate-fix-editor-problems allows Stored XSS.This issue affects TinyMCE Advanced qTranslate fix editor problems: from n/a through = 1.0.0...

CVE-2025-0908

PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target...

org.webjars.npm:monaco-editor (0.54.0) potentially affected by CVE-2025-26791 via org.webjars.npm:dompurify (3.1.7)

org.webjars.npm:dompurify MAVEN version 3.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:dompurify and may be impacted: - org.webjars.npm:monaco-editor 0.54.0 Source cves: CVE-2025-26791 Source advisory:...

PT-2025-7201

Name of the Vulnerable Software and Affected Versions: TinyMCE Advanced qTranslate fix editor problems versions prior to 1.0.0 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing...

CVE-2025-26582: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Blackbam TinyMCE Advanced qTranslate fix editor problems tinymce-advanced-qtranslate-fix-editor-problems allows Stored XSS.This issue affects TinyMCE Advanced qTranslate fix editor problems: from n/a through = 1.0.0...