CVE-2025-53220

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in XmasB XmasB Quotes xmasb-quotes allows Reflected XSS.This issue affects XmasB Quotes: from n/a through = 1.6.1...

CVE-2025-48324

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in khashabawy tli.tl auto Twitter poster tlitl-auto-twitter-poster allows Stored XSS.This issue affects tli.tl auto Twitter poster: from n/a through = 3.4...

CVE-2025-48323

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Md Abunaser Khan Advance Food Menu advance-food-menu allows Stored XSS.This issue affects Advance Food Menu: from n/a through = 1.0...

CVE-2025-48312

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in 文派翻译（WP Chinese Translation） WPAvatar wpavatar allows Stored XSS.This issue affects WPAvatar: from n/a through = 1.9.4...

CVE-2025-48100

Improper Control of Generation of Code 'Code Injection' vulnerability in extremeidea bidorbuy Store Integrator bidorbuystoreintegrator allows Remote Code Inclusion.This issue affects bidorbuy Store Integrator: from n/a through = 2.12.0...

CVE-2025-49407

CVE-2025-49407 affects the WordPress theme Houzez (favethemes)

CVE-2025-48365

CVE-2025-48365 describes a stored XSS in the WordPress plugin “Custom Comment” (imaprogrammer Custom Comment) affecting versions from n/a through 2.1.6. The root cause is improper input neutralization during web page generation, enabling stored Cross‑Site Scripting. Public sources in the Connecte...

CVE-2025-48360

CVE-2025-48360 affects the WordPress Varnish/Nginx Proxy Caching plugin (versions up to 1.8.3). The issue is an improper neutralization of input during web page generation, leading to stored XSS. Public sources in the connected data confirm this vulnerability, its association with the plugin, and...

CVE-2025-48358

CVE-2025-48358 describes a stored cross-site scripting (XSS) vulnerability in the WordPress plugin “Risk Free Cash On Delivery (COD) – WooCommerce.” Affected: COD WooCommerce plugin versions up to 1.0.4. Root cause: improper neutralization of input during web page generation. Impact: stored XSS t...

CVE-2025-48356

CVE-2025-48356 is a Stored XSS in the WordPress Kanpress plugin (versions

CVE-2025-48352

CVE-2025-48352 describes a stored cross-site scripting (XSS) vulnerability in the WordPress plugin “Яндекс.ПДС Пингер / Yandex Site search pinger” (sitesearch-yandex) up to version 1.5, caused by improper neutralization of input during web page generation. The issue allows stored XSS. Public deta...

CVE-2025-48349

CVE-2025-48349 is a stored XSS in the WordPress add-on Video Gallery – Vimeo and YouTube Gallery (origincode) affecting versions up to and including 1.1.7. The vulnerability stems from improper input neutralization during web page generation, enabling stored cross-site scripting. Public reference...

CVE-2025-48323

CVE-2025-48323 is a stored XSS vulnerability in the WordPress plugin Advance Food Menu (affected: versions up to 1.0; vulnerability described as improper neutralization of input during web page generation). The issue allows injection of arbitrary web scripts/HTML via user-supplied data. Reported ...

CVE-2025-48312

CVE-2025-48312 affects the WordPress WPAvatar plugin (versions up to 1.9.3). The issue is an Improper Neutralization of Input During Web Page Generation leading to Stored XSS. Vulnerability details from connected docs show the risk is tied to input handling in WPAvatar, with CVSSv3.1 base score 6...

An Inside Look at our Next Gen Object Storage Launch

...

PT-2025-35012

Name of the Vulnerable Software and Affected Versions: khashabawy tli.tl auto Twitter poster versions through 3.4 Description: The software contains an Improper Neutralization of Input During Web Page Generation issue, which allows for Stored Cross-site Scripting XSS. Recommendations: Update to a...

AI Agentic Vulnerability Injection and Transformation with Optimized Reasoning

The increasing complexity of software systems and the sophistication of cyber-attacks have underscored the critical need for effective automated vulnerability detection and repair systems. Traditional methods, such as static program analysis, face significant challenges related to scalability,...

PT-2025-35026

Name of the Vulnerable Software and Affected Versions: everythingwp Risk Free Cash On Delivery COD – WooCommerce versions through 1.0.4 Description: The software contains a cross-site scripting XSS issue due to improper neutralization of input during web page generation. This allows for stored XS...

PT-2025-35047

Name of the Vulnerable Software and Affected Versions: eboekhouden versions n/a through 1.9.3 Description: The software contains a Reflected Cross-site Scripting XSS issue due to improper neutralization of input during web page generation. Recommendations: Update eboekhouden to a version later th...

CVE-2025-9590: Improper Neutralization of Input During Web Page Generation

A vulnerability was identified in Weaver E-Mobile Mobile Management Platform up to 20250813. Affected by this vulnerability is an unknown functionality. The manipulation of the argument gohome leads to cross site scripting. The attack can be initiated remotely. The exploit is publicly available a...