CVE-2025-31450

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in phantom.omaga Toggle Box toggle-box allows Stored XSS.This issue affects Toggle Box: from n/a through = 1.6...

CVE-2025-31433

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Miguel Sirvent Magic Embeds wp-embed-facebook allows Stored XSS.This issue affects Magic Embeds: from n/a through = 3.1.2...

CVE-2025-31434

CVE-2025-31434 is an authenticated Stored XSS affecting FormLift for Infusionsoft Web Forms (WordPress plugin). Affected: FormLift for Infusionsoft Web Forms versions up to 7.5.19. Root cause: improper neutralization/handling of user input during web page generation leads to stored cross-site scr...

CVE-2025-31473 WordPress WP Database Optimizer plugin <= 1.2.1.3 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in matthewprice1178 WP Database Optimizer wp-database-optimizer allows Stored XSS.This issue affects WP Database Optimizer: from n/a through = 1.2.1.3...

CVE-2025-31473

CVE-2025-31473 describes a stored XSS in the WordPress plugin WP Database Optimizer (author: matthewprice1178) affecting versions up to 1.2.1.3. The issue arises from improper neutralization of input during web page generation, enabling injection of malicious scripts in pages generated by the plu...

CVE-2025-31102

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Bob Hostel hostel allows Reflected XSS.This issue affects Hostel: from n/a through = 1.1.5.5...

CVE-2025-31094

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in teastudio.pl WP Posts Carousel wp-posts-carousel allows Stored XSS.This issue affects WP Posts Carousel: from n/a through = 1.3.8...

CVE-2019-16149

An Improper Neutralization of Input During Web Page Generation in FortiClientEMS version 6.2.0 may allow a remote attacker to execute unauthorized code by injecting malicious payload in the user profile of a FortiClient instance being managed by the vulnerable system...

WordPress plugin Leaky Paywall 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress plugin Click to Chat – WP Support All-in-One Floating Widget 跨站脚本漏洞

WordPress and the WordPress plugin are products of the WordPress Foundation, a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. WordPress plugin Click to Chat - WP Support All-in-One Floating Widget A...

WordPress plugin PostX 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...

WordPress plugin Hostel 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2025-31101

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Vault Group Pty Ltd VaultRE Contact Form 7 allows Stored XSS.This issue affects VaultRE Contact Form 7: from n/a through 1.0...

CVE-2025-31101

CVE-2025-31101 corresponds to a stored Cross-Site Scripting (XSS) vulnerability in the VaultRE Contact Form 7 plugin for WordPress (VaultRE Contact Form 7). The description notes improper input neutralization during web page generation, enabling stored XSS. The connected Wordfence/WordPress vulne...

CVE-2025-26874 WordPress MemberSpace plugin <= 2.1.13 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in memberspace MemberSpace memberspace allows Reflected XSS.This issue affects MemberSpace: from n/a through = 2.1.13...

CVE-2025-22659

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Themeisle Orbit Fox by ThemeIsle themeisle-companion allows Stored XSS.This issue affects Orbit Fox by ThemeIsle: from n/a through = 2.10.44...

CVE-2025-22640 WordPress Paytm Payment Donation Plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Paytm Paytm Payment Donation allows Stored XSS.This issue affects Paytm Payment Donation: from n/a through 2.3.3...

CVE-2025-26734 WordPress Hester plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in peregrinethemes Hester hester allows Stored XSS.This issue affects Hester: from n/a through = 1.1.10...

CVE-2025-26738

CVE-2025-26738 is a DOM-based XSS vulnerability in the Quick Interest Slider WordPress plugin. The vulnerability is described as Improper Neutralization of Input During Web Page Generation (XSS) and is associated with Quick Interest Slider versions from n/a through 3.1.3. The connected Wordfence ...

CVE-2025-0811 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 17.7 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. Improper rendering of certain file types leads to cross-site scripting...