CVE-2025-7810

The StreamWeasels Kick Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'data-uuid' attribute in all versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fo...

CVE-2025-7811

The CVE-2025-7811 is for the WordPress plugin StreamWeasels YouTube Integration. It is a Stored Cross-Site Scripting (XSS) vulnerability via the data-uuid attribute in all versions up to 1.4.0, exploitable by authenticated attackers with contributor-level access and above. The impact is that arbi...

CVE-2025-7811 StreamWeasels YouTube Integration <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The StreamWeasels YouTube Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'data-uuid' attribute in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

CVE-2025-7810 StreamWeasels Kick Integration <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

The StreamWeasels Kick Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'data-uuid' attribute in all versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fo...

CVE-2025-7810

CVE-2025-7810 concerns the StreamWeasels Kick Integration plugin for WordPress (versions up to and including 1.1.4). The vulnerability is a Stored Cross-Site Scripting flaw via the plugin’s data-uuid attribute caused by insufficient input sanitization and output escaping. Exploitation requires au...

CVE-2025-7809 StreamWeasels Twitch Integration <= 1.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

The StreamWeasels Twitch Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'data-uuid' attribute in all versions up to, and including, 1.9.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

CVE-2025-7810 StreamWeasels Kick Integration <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

The StreamWeasels Kick Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'data-uuid' attribute in all versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fo...

CVE-2025-51970

A SQL Injection vulnerability exists in the action.php endpoint of PuneethReddyHC Online Shopping System Advanced 1.0 due to improper sanitization of user-supplied input in the keyword POST parameter...

PT-2025-31166 · WordPress · Elementor Website Builder

Name of the Vulnerable Software and Affected Versions: Elementor Website Builder – More Than Just a Page Builder plugin for WordPress versions prior to 3.30.3 Description: The Elementor Website Builder plugin for WordPress is susceptible to Stored Cross-Site Scripting via the data-text DOM elemen...

PT-2025-31189 · WordPress · Appzend

Name of the Vulnerable Software and Affected Versions: Appzend versions prior to 1.2.7 Description: The Appzend theme for WordPress is susceptible to Stored Cross-Site Scripting through the progressbarLayout parameter. Insufficient input sanitization and output escaping allow authenticated...

PT-2025-31162 · WordPress · Streamweasels Kick Integration

Name of the Vulnerable Software and Affected Versions: StreamWeasels Kick Integration plugin for WordPress versions through 1.1.4 Description: The StreamWeasels Kick Integration plugin for WordPress is susceptible to Stored Cross-Site Scripting through the plugin’s data-uuid attribute. Insufficie...

PT-2025-31218

Name of the Vulnerable Software and Affected Versions PuneethReddyHC Online Shopping System Advanced version 1.0 Description A SQL Injection issue exists due to improper sanitization of user-supplied input in the keyword POST parameter of the /action.php API endpoint. Recommendations Apply input...

PT-2025-31188 · WordPress +1 · Sky Addons For Elementor +1

Name of the Vulnerable Software and Affected Versions: Sky Addons for Elementor plugin versions up to and including 3.1.4 Description: The Sky Addons for Elementor plugin for WordPress is susceptible to Stored Cross-Site Scripting XSS through multiple widgets. Insufficient input sanitization and...

CVE-2025-8216: Improper Neutralization of Input During Web Page Generation

The Sky Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Multiple widgets in all versions up to, and including, 3.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacker...

PT-2025-31164 · WordPress · Elementor Website Builder

Name of the Vulnerable Software and Affected Versions: Elementor Website Builder – More Than Just a Page Builder plugin for WordPress versions prior to 3.29.1 Description: The Elementor Website Builder plugin for WordPress is susceptible to Stored Cross-Site Scripting via the elementor-element...

PT-2025-31262 · Elementor +1 · Elementor +1

Name of the Vulnerable Software and Affected Versions: MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress versions up to and including 4.0.1 Description: The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress ...

PT-2025-31195 · Unknown · Human Resource Management System Version 1.0

Name of the Vulnerable Software and Affected Versions: Human Resource Management System version 1.0 Description: This issue allows an attacker to execute JavaScript code in a victim’s browser. This is achieved by sending a malicious URL through the employeeid parameter. The vulnerable location is...

CVE-2025-51970

A SQL Injection vulnerability exists in the action.php endpoint of PuneethReddyHC Online Shopping System Advanced 1.0 . The root cause is the improper sanitization of user-supplied input within the keyword POST parameter. This flaw allows attackers to perform unauthorized data access or database ...

PT-2025-31187 · WordPress · Magical Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Magical Addons For Elementor plugin versions prior to 1.3.9 Description: The Magical Addons For Elementor plugin for WordPress is susceptible to Stored Cross-Site Scripting through the plugin’s Custom Attributes. Insufficient input sanitizati...

CVE-2025-29534

An authenticated remote code execution vulnerability in PowerStick Wave Dual-Band Wifi Extender V1.0 allows an attacker with valid credentials to execute arbitrary commands with root privileges. The issue stems from insufficient sanitization of user-supplied input in the /cgi-bin/cgivista.cgi...