CVE-2025-3878

The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's saverify shortcode in all versions up to, and including, 3.8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

Cross-site Scripting (XSS)

com.liferay:com.liferay.marketplace.app.manager.web is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper input sanitization due to failure to properly escape user-supplied input in the Marketplace App Manager Web module, allowing injection of JavaScript by unauthenticat...

Cross-site Scripting (XSS)

mobsf is vulnerable to Stored Cross-Site Scripting XSS. The vulnerability is due to improper input sanitization during SVG file handling in the Android APK analysis workflow, which allows malicious scripts to be embedded in the SVG files...

CVE-2025-2944

The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Video Button and Countdown Widgets in all versions up to, and including, 2.6.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible f...

Remote Code Execution (RCE)

craftcms/cms is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper sanitization of user input, allowing attackers to inject malicious code if they have administrator access and the ALLOWADMINCHANGES setting is enabled...

PT-2025-20721 · Schweitzer Engineering Laboratories · Sel Blueframe Os

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: An issue exists where an authenticated user can submit scripting to fields that lack proper input and output sanitization, leading to subsequent client-side script execution. Recommendations...

PT-2025-20794 · Apple · Ipados +8

Name of the Vulnerable Software and Affected Versions: watchOS versions prior to 11.5 macOS Sonoma versions prior to 14.7.6 tvOS versions prior to 18.5 iPadOS versions prior to 17.7.7 iOS versions prior to 18.5 iPadOS versions prior to 18.5 macOS Sequoia versions prior to 15.5 visionOS versions...

About the security content of iPadOS 17.7.7

About the security content of iPadOS 17.7.7 This document describes the security content of iPadOS 17.7.7. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are...

About the security content of macOS Ventura 13.7.6

About the security content of macOS Ventura 13.7.6 This document describes the security content of macOS Ventura 13.7.6. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or...

About the security content of macOS Sonoma 14.7.6

About the security content of macOS Sonoma 14.7.6 This document describes the security content of macOS Sonoma 14.7.6. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or release...

About the security content of visionOS 2.5

About the security content of visionOS 2.5 This document describes the security content of visionOS 2.5. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are availabl...

About the security content of tvOS 18.5

About the security content of tvOS 18.5 This document describes the security content of tvOS 18.5. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...

PT-2025-20779 · Apple · Ipados +8

Name of the Vulnerable Software and Affected Versions: watchOS versions prior to 11.5 macOS Sonoma versions prior to 14.7.6 tvOS versions prior to 18.5 iPadOS versions prior to 17.7.7 iOS versions prior to 18.5 iPadOS versions prior to 18.5 macOS Sequoia versions prior to 15.5 visionOS versions...

PT-2025-20799 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 15.5 Description: The issue was addressed with improved input sanitization. An app may be able to gain elevated privileges. Recommendations: For versions prior to 15.5, update to macOS Sequoia 15.5 to resolve the issue...

CVE-2025-3794

The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the starttimestamp parameter in all versions up to, and including, 1.9.5 due to insufficient input sanitization and output escaping...

CVE-2025-4434

The Remote Images Grabber plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 0.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...

CVE-2025-3878

The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's saverify shortcode in all versions up to, and including, 3.8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2025-3468

The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the cleanhtml and formfields parameters in all versions up to, and including, 8.9.1 due to insufficient input sanitization and output escaping. This makes it...

CVE-2025-2806

The tagDiv Composer plugin for WordPress, used by the Newspaper theme, is vulnerable to Reflected Cross-Site Scripting via the ‘data’ parameter in all versions up to, and including, 5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacker...

CVE-2025-3862

Contest Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 26.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...