CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

25461 matches found

NVD•added 2025/10/04 3:15 a.m.•15 views

CVE-2025-8726

The WP Photo Album Plus plugin for WordPress is vulnerable to Cross-Site Scripting in all versions up to, and including, 9.0.11.006 due to insufficient input sanitization and output escaping in the wppauserupload function. This makes it possible for authenticated attackers, with Subscriber-level...

5.4CVSS0.0021EPSS

SaveExploits0References3

CVE•added 2025/10/04 2:24 a.m.•36 views

CVE-2025-8726

CVE-2025-8726 affects the WordPress plugin WP Photo Album Plus (versions up to and including 9.0.11.006). The vulnerability is a stored XSS in the wppa_user_upload function, exploitable by authenticated users with Subscriber+ privileges, allowing injection of scripts that run in victims’ browsers...

5.4CVSS5.1AI score0.0021EPSS

SaveExploits0References3

Positive Technologies•added 2025/10/04 12:00 a.m.•22 views

PT-2025-40625

Name of the Vulnerable Software and Affected Versions Trinity Audio – Text to Speech AI audio player versions prior to 5.20.2 Description The software is susceptible to Reflected Cross-Site Scripting due to inadequate input sanitization and output escaping. This allows unauthenticated attackers t...

6.1CVSS6AI score0.00275EPSS

SaveExploits0References9

Positive Technologies•added 2025/10/04 12:00 a.m.•19 views

PT-2025-40623

Name of the Vulnerable Software and Affected Versions The Contest Gallery – Upload, Vote & Sell with PayPal and Stripe plugin for WordPress versions prior to 27.0.3 Description The software is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping of...

6.4CVSS5.5AI score0.00249EPSS

SaveExploits0References12

Snyk•added 2025/10/03 9:48 p.m.•15 views

Cross-site Scripting (XSS)

Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Cross-site Scripting XSS via the chat logs, due to improper input sanitization. An attacker can access sensitive information or impersonate an administrator by injecting malicious HTML or scripts into chat...

8.2CVSS5.3AI score0.1404EPSS

SaveExploits1References2