CVE-2025-4054

The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the highlights functionality in all versions up to, and including, 4.24.3 Free and = 2.27.4 Premium, due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-3860

The CarDealerPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘saleclass' parameter in all versions up to, and including, 6.8.2505.00 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-lev...

CVE-2025-4054 Relevanssi <= 4.24.3 (Free) and <= 2.27.4 (Premium) - Unauthenticated Stored Cross-Site Scripting via Search Highlights

The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the highlights functionality in all versions up to, and including, 4.24.3 Free and = 2.27.4 Premium, due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-4054

The CVE-2025-4054 affects Relevanssi – A Better Search (WordPress) in versions up to and including 4.24.3, where insufficient input sanitization and output escaping in the highlights feature allows stored XSS. This enables unauthenticated attackers to inject scripts that execute when users view a...

CVE-2025-4220 Xavin's List Subpages <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Xavins List Subpages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'xls' shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-4220 Xavin's List Subpages <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Xavins List Subpages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'xls' shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-4220

CVE-2025-4220 affects the WordPress plugin Xavin’s List Subpages. The issue is a Stored Cross-Site Scripting via the plugin’s 'xls' shortcode caused by insufficient input sanitization and output escaping of user-supplied attributes. Attack requires authenticated access at contributor level or hig...

CVE-2025-4055

CVE-2025-4055 affects the WordPress plugin Multiple Post Type Order (versions up to and including 1.10.0). It is a Stored Cross-Site Scripting flaw in the mpto shortcode caused by insufficient input sanitization and output escaping of user-supplied attributes. Exploitation requires authenticated ...

CVE-2025-4055 Multiple Post Type Order <= 1.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mpto Shortcode

The Multiple Post Type Order plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mpto' shortcode in all versions up to, and including, 1.10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-4055 Multiple Post Type Order <= 1.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mpto Shortcode

The Multiple Post Type Order plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mpto' shortcode in all versions up to, and including, 1.10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-3860 CarDealerPress <= 6.8.2505.00 - Authenticated (Contributor+) Stored Cross-Site Scripting via saleclass Parameter

The CarDealerPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘saleclass' parameter in all versions up to, and including, 6.8.2505.00 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-lev...

CVE-2025-3860

The CVE-2025-3860 entry concerns the CarDealerPress WordPress plugin. A Stored Cross-Site Scripting vulnerability exists in the saleclass parameter across all versions up to 6.7.2504.00, enabling an authenticated attacker with Contributor-level access or higher to inject scripts that run on pages...

USN-7497-1: CarrierWave vulnerabilities

Rikita Ishikawa discovered that CarrierWave did not correctly sanitize certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. CVE-2021-21305 Norihide Saito discovered that CarrierWave did not correctly...

PT-2025-19915 · WordPress · Multiple Post Type Order

Name of the Vulnerable Software and Affected Versions: Multiple Post Type Order plugin for WordPress versions up to and including 1.10.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'mpto' shortcode due to insufficient input sanitization and output escaping on...

PT-2025-19910 · Unknown · Cardealerpress

Name of the Vulnerable Software and Affected Versions: CarDealerPress versions up to, and including, 6.7.2504.00 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level...

PT-2025-19914

Name of the Vulnerable Software and Affected Versions Relevanssi – A Better Search plugin for WordPress versions up to, and including, 4.24.3 Description The issue is related to Stored Cross-Site Scripting via the highlights functionality due to insufficient input sanitization and output escaping...

PT-2025-19922 · WordPress · Xavin'S List Subpages

Name of the Vulnerable Software and Affected Versions: Xavin's List Subpages plugin for WordPress versions up to and including 1.3 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the 'xls' shortcode. This allows authenticated...

Cisco Catalyst SD-WAN Manager Stored XSS (cisco-sa-vmanage-xss-xhN8M5jt)

According to its self-reported version, Cisco SD-WAN Viptela Software is affected by a vulnerability. - A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD- WAN vManage, could allow an authenticated, remote attacker to conduct a stored...

PT-2025-20249 · Cisco · Cisco Catalyst Sd-Wan Manager

Name of the Vulnerable Software and Affected Versions: Cisco Catalyst SD-WAN Manager versions affected versions not specified Description: A stored cross-site scripting attack XSS could be conducted by an authenticated, remote attacker on an affected system due to improper sanitization of user...

Cisco Catalyst SD-WAN Manager Reflected HTML Injection (cisco-sa-vmanage-html-inj-GxVtK6zj)

According to its self-reported version, Cisco SD-WAN Viptela Software is affected by a vulnerability. - A vulnerability in the web interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an unauthenticated, remote attacker to inject HTML into the browser of an...