CVE-2025-32560 WordPress WP-Hijri Plugin <= 1.5.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Mohammad I. Okfie WP-Hijri allows Reflected XSS. This issue affects WP-Hijri: from n/a through 1.5.3...

CVE-2025-32564 WordPress Stop Registration Spam Plugin <= 1.24 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in tomroyal Stop Registration Spam stop-registration-spam allows Reflected XSS.This issue affects Stop Registration Spam: from n/a through = 1.24...

CVE-2025-32590

CVE-2025-32590 refers to a Reflected XSS in Web2application plugin (WordPress) up to version 5.7/5.6 depending on listing. The description states improper neutralization of input during web page generation leading to cross-site scripting. Connected records confirm the vulnerability is tied to Web...

CVE-2025-32602

CVE-2025-32602 — WooMS Reflected XSS Affected software: WordPress plugin WooMS (versions up to 9.12). Vulnerability: Reflected Cross-Site Scripting due to improper neutralization of input during web page generation. Impact: The vulnerability enables injection of script via input that is reflected...

CVE-2025-32604

CVE-2025-32604 describes a reflected Cross-Site Scripting (XSS) vulnerability in the AWSA Shipping plugin for WordPress/WooCommerce (AWSA Shipping – Advanced Shipping for WooCommerce and Dokan). Affected Software: AWSA Shipping versions n/a through 1.3.0. Root cause: improper neutralization of in...

CVE-2025-32622 WordPress OTP-less one tap Sign in Plugin <= 2.0.58 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in OTP-less OTP-less one tap Sign in allows Reflected XSS. This issue affects OTP-less one tap Sign in: from n/a through 2.0.58...

CVE-2025-32634

CVE-2025-32634 describes a Reflected XSS in the WordPress plugin Run Contests, Raffles, and Giveaways with ContestsWP (versions n/a through 2.0.6). The vulnerability arises from improper input neutralization during web page generation. Affected software is ContestsWP communications for Run Contes...

CVE-2025-32646 WordPress Question Answer plugin <= 1.2.70 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PickPlugins Question Answer question-answer allows Reflected XSS.This issue affects Question Answer: from n/a through = 1.2.70...

CVE-2025-32653

CVE-2025-32653 is a Reflected XSS in WordPress Cart66 Cloud (Lee Blue Cart66 Cloud) affecting Cart66 Cloud versions up to 2.3.7. The issue arises from improper input neutralization during web page generation, enabling reflected script execution. Public sources (NVD/Red Hat/ CVE lists) corroborate...

CVE-2025-39558 WordPress CRM Perks plugin <= 1.1.7 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CRM Perks CRM Perks support-x allows Reflected XSS.This issue affects CRM Perks: from n/a through = 1.1.7...

CVE-2025-39562

CVE-2025-39562 concerns the WordPress plugin Payment Form for PayPal Pro (codepeople) with a stored XSS vulnerability due to improper input neutralization during web page generation. Public records reference affected versions: 1.1.72 and earlier. Red Hat and CVE databases confirm the flaw and lin...

CVE-2025-39428

CVE-2025-39428 : Cross-Site Scripting in Gravity Forms CSS Themes with Fontawesome and Placeholders (WordPress plugin) allows stored XSS. Affected: Gravity Forms CSS Themes with Fontawesome and Placeholders, versions n/a through 8.5. Root cause: improper input neutralization during web page gener...

CVE-2025-39432 WordPress bbPress2 shortcode whitelist plugin <= 2.2.1 - CSRF to XSS vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in antonchanning bbPress2 shortcode whitelist bbpress2-shortcode-whitelist allows Stored XSS.This issue affects bbPress2 shortcode whitelist: from n/a through = 2.2.1...

CVE-2025-26954

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in 1pluginjquery ZooEffect 1-jquery-photo-gallery-slideshow-flash allows Reflected XSS.This issue affects ZooEffect: from n/a through = 1.11...

WordPress plugin Mobile Pages 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

WordPress plugin DN Shipping by Weight for WooCommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2025-17022 · Unknown · Visualslider

Name of the Vulnerable Software and Affected Versions: visualslider Sldier versions n/a through 1.1.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an attacker can...

WordPress plugin Empty Tags Remover 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in...

WordPress plugin Shipment Tracker for Woocommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in...

PT-2025-17184 · Unknown · Shamalli Web Directory Free

Name of the Vulnerable Software and Affected Versions: Shamalli Web Directory Free versions 1.7.8 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential...