CVE-2025-6977 ProfileGrid – User Profiles, Groups and Communities <= 5.9.5.4 - Reflected Cross-Site Scripting via 'pm_get_messenger_notification' function

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘pmgetmessengernotification’ function in all versions up to, and including, 5.9.5.4 due to insufficient input sanitization and output escaping. This makes it possib...

CVE-2025-6977 ProfileGrid – User Profiles, Groups and Communities <= 5.9.5.4 - Reflected Cross-Site Scripting via 'pm_get_messenger_notification' function

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘pmgetmessengernotification’ function in all versions up to, and including, 5.9.5.4 due to insufficient input sanitization and output escaping. This makes it possib...

WordPress plugin Pay with Contact Form 7 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in WordPress Pay with Contact Form 7, which stems from improper input neutralization, and can be exploited by an attacker to...

PT-2025-29706 · WordPress · Brandfolder

Name of the Vulnerable Software and Affected Versions: Brandfolder plugin for WordPress versions prior to 5.0.20 Description: The Brandfolder plugin for WordPress is susceptible to Stored Cross-Site Scripting through the id parameter. Insufficient input sanitization and output escaping allow...

CVE-2025-5284: Improper Neutralization of Input During Web Page Generation

The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS extension in all versions up to, and including, 2.0.8.2 due to insufficient capability restriction, and...

WordPress plugin JetPopup 跨站脚本漏洞

WordPress JetPopup is an Elementor plugin designed for WordPress, which is mainly used to create various popups e.g. subscription forms, offer banners, etc., and supports a variety of triggers and template customization. WordPress JetPopup suffers from a cross-site scripting vulnerability that...

PT-2025-29707 · WordPress · Affiliate Reviews

Name of the Vulnerable Software and Affected Versions: Affiliate Reviews plugin for WordPress versions up to and including 1.0.6 Description: The Affiliate Reviews plugin for WordPress is susceptible to Stored Cross-Site Scripting through the numColumns parameter. Insufficient input sanitization...

CVE-2025-53903

CVE-2025-53903 affects The Scratch Channel’s web application, with a cross-site scripting (XSS) vulnerability stemming from unsanitized input in /api/users.js. The issue is addressed by commit 90b39eb56b27b2bac29001abb1a3cac0964b8ddb. Public documents describe the vulnerability and fix; exploitat...

CVE-2025-53903

The Scratch Channel is a news website that is under development as of time of this writing. The file "/api/users.js" doesn't properly sanitize text box inputs, leading to a potential vulnerability to cross-site scripting attacks. Commit 90b39eb56b27b2bac29001abb1a3cac0964b8ddb addresses this issu...

CVE-2025-53903 The Scratch Channel Has Potential Cross-Site Scripting (XSS) Vulnerability

The Scratch Channel is a news website that is under development as of time of this writing. The file /api/users.js doesn't properly sanitize text box inputs, leading to a potential vulnerability to cross-site scripting attacks. Commit 90b39eb56b27b2bac29001abb1a3cac0964b8ddb addresses this issue...

CVE-2025-52377

Command injection vulnerability in Nexxt Solutions NCM-X1800 Mesh Router versions UV1.2.7 and below, allowing authenticated attackers to execute arbitrary commands on the device. The vulnerability is present in the web management interface's ping and traceroute functionality, specifically in the...

CVE-2025-4369

The Companion Auto Update plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘updatedelaydays’ parameter in all versions up to, and including, 3.9.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-4369 Companion Auto Update <= 3.9.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via update_delay_days parameter

The Companion Auto Update plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘updatedelaydays’ parameter in all versions up to, and including, 3.9.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-7367

The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Testimonial Custom Fields in all versions up to, and including, 3.2.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-leve...

CVE-2025-7367 Strong Testimonials <= 3.2.11 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Fields

The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Testimonial Custom Fields in all versions up to, and including, 3.2.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-leve...

PT-2025-29593 · Unknown · Scratch Channel

Name of the Vulnerable Software and Affected Versions: The Scratch Channel affected versions not specified Description: The application does not properly sanitize text box inputs in the /api/users.js file, potentially leading to cross-site scripting attacks. Recommendations: At the moment, there ...

CVE-2025-53903: Improper Neutralization of Input During Web Page Generation

The Scratch Channel is a news website that is under development as of time of this writing. The file /api/users.js doesn't properly sanitize text box inputs, leading to a potential vulnerability to cross-site scripting attacks. Commit 90b39eb56b27b2bac29001abb1a3cac0964b8ddb addresses this issue...

PT-2025-29539 · WordPress · Strong Testimonials

Name of the Vulnerable Software and Affected Versions: Strong Testimonials versions prior to 3.2.12 Description: The Strong Testimonials plugin for WordPress is susceptible to Stored Cross-Site Scripting via the Testimonial Custom Fields due to insufficient input sanitization and output escaping...

CVE-2025-52377

The Nexxt Solutions NCM-X1800 Mesh Router (versions UV1.2.7 and below ) is vulnerable to a command injection flaw in its web management interface. The vulnerability exists in the ping and traceroute functionality, specifically within the /web/um_ping_set.cgi endpoint. Because the application fail...

PT-2025-29449 · Code Projects · Job Diary

Name of the Vulnerable Software and Affected Versions: code-projects Job Diary version 1.0 Description: A critical issue exists in code-projects Job Diary 1.0. The manipulation of the ID argument in the /view-emp.php file leads to a SQL injection. The attack can be initiated remotely, and the...