CVE-2025-54687 WordPress JetTabs Plugin plugin <= 2.2.9.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetTabs jet-tabs allows DOM-Based XSS.This issue affects JetTabs: from n/a through = 2.2.9.1...

CVE-2025-54687

CVE-2025-54687 affects WordPress Crocoblock JetTabs up to version 2.2.9.1. The issue is a DOM-based Cross-Site Scripting vulnerability caused by improper neutralization of input during web page generation. CVSS v3.1 base score is 6.5 (Medium); attack vector Network, privileges Low, user interacti...

CVE-2025-29014 WordPress FoodMenu <= 1.20 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ZoomIt FoodMenu allows Reflected XSS. This issue affects FoodMenu: from n/a through 1.20...

CVE-2025-49051 WordPress Hide Text Shortcode plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in biscia7 Hide Text Shortcode allows Stored XSS. This issue affects Hide Text Shortcode: from n/a through 1.1...

CVE-2025-49057

CVE-2025-49057: Reflected XSS in WordPress plugin WP Voting (versions n/a through 1.8). The vulnerability arises from improper input neutralization during web page generation, enabling cross-site scripting. Affected software: WP Voting

CVE-2025-49433 WordPress Supermalink <= 1.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThanhD Supermalink supermalink allows DOM-Based XSS.This issue affects Supermalink: from n/a through = 1.1...

CVE-2025-52730 WordPress WordPress Event Manager, Event Calendar and Booking Plugin Plugin <= 4.0.24 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in themefunction WordPress Event Manager, Event Calendar and Booking Plugin eventin-pro allows Stored XSS.This issue affects WordPress Event Manager, Event Calendar and Booking Plugin: from n/a throug...

PT-2025-33180 · Digitalocean · Digitalocean Spaces Sync

Name of the Vulnerable Software and Affected Versions: DigitalOcean Spaces Sync versions through 2.2.1 Description: The software contains an improper neutralization of input during web page generation, leading to a stored cross-site scripting issue. Recommendations: Update to a version later than...

WordPress plugin SoundSt SEO Search 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A cross-site scripting...

CVE-2025-6060

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in DECE Software Geodi allows Cross-Site Scripting XSS. This issue affects Geodi: before GEODI Setup 9.0.146...

Improper Neutralization of Input Used for LLM Prompting

Overview @google/gemini-cli is a Gemini CLI Affected versions of this package are vulnerable to Improper Neutralization of Input Used for LLM Prompting due to an improper implementation of the getCommandRoot and isCommandAllowed functions. An attacker can inject malicious commands by leveraging...

CVE-2025-5254

CVE-2025-5254 describes a Stored XSS flaw in Kron Technologies’ Kron PAM (pre-3.7) caused by improper neutralization of input during web page generation. Affected: Kron PAM versions before 3.7. Impact: potential execution of malicious scripts in a user’s browser when data is stored and later rend...

CVE-2025-41681 Persistent Cross-Site Scripting via POST Requests Due to Improper Neutralization of Input

A high privileged remote attacker can gain persistent XSS via POST requests due to improper neutralization of special elements used to create dynamic content...

CVE-2025-41675 Remote Command Injection via GET in Cloud Server Communication Script Due to Improper Input Neutralization

A high privileged remote attacker can execute arbitrary system commands via GET requests in the cloud server communication script due to improper neutralization of special elements used in an OS command...

CVE-2025-41674

The CVE-2025-41674 entry matches an OS command injection in MB CONNECT LINE mbNET.mini (industrial router) and Helmholz REX100/mbNET.mini family where improper neutralization of special elements in OS commands enables remote execution of commands via POST to a diagnostic action. Connected sources...

CVE-2025-41674 Remote Command Injection in diagnostic Action Due to Improper Input Neutralization

A high privileged remote attacker can execute arbitrary system commands via POST requests in the diagnostic action due to improper neutralization of special elements used in an OS command...

CVE-2025-41673

CVE-2025-41673 affects MB CONNECT LINE mbNET.mini (industrial router). The vulnerability is an OS command-injection in the send_sms operation caused by improper neutralization of special elements, enabling remote execution of system commands via POST requests. Vulnerable versions are prior to 2.3...

CVE-2025-41673 Remote Command Injection in send_sms Action Due to Improper Input Neutralization

A high privileged remote attacker can execute arbitrary system commands via POST requests in the sendsms action due to improper neutralization of special elements used in an OS command...

WordPress plugin Bold Page Builder 跨站脚本漏洞

WordPress Bold Page Builder is a free and open source page builder plugin that allows users to quickly create custom page layouts through a drag and drop interface without writing code. WordPress Bold Page Builder suffers from a cross-site scripting vulnerability that originates from improper inp...

WordPress plugin JetElements For Elementor 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...