CVE-2025-67952

CVE-2025-67952 is a reflected XSS in the WordPress ThemeGoods Grand Tour theme prior to version 5.6.2. The initial record confirms the vulnerability and affected version, with remediation via upgrading to 5.6.2 or later (patched). The connected sources also catalog the same CVE across multiple fe...

CVE-2025-67949

CVE-2025-67949 is a WordPress Hostiko theme

CVE-2025-67947

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in scriptsbundle AdForest Elementor adforest-elementor allows Reflected XSS.This issue affects AdForest Elementor: from n/a through = 3.0.11...

CVE-2025-67614

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in foreverpinetree TheNa thena allows Reflected XSS.This issue affects TheNa: from n/a through = 1.5.5...

CVE-2025-53240 WordPress WordPress Photo Gallery plugin <= 1.1.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in adamlabs WordPress Photo Gallery photo-gallery-portfolio allows Reflected XSS.This issue affects WordPress Photo Gallery: from n/a through = 1.1.0...

CVE-2025-50006

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jthemes xSmart xsmart allows Reflected XSS.This issue affects xSmart: from n/a through = 1.2.9.4...

CVE-2025-49249

CVE-2025-49249 refers to a reflected XSS in the WordPress theme Drone (ApusTheme Drone) affecting Drone theme versions up to and including 1.40. The issue arises from improper neutralization/handling of user-supplied input during web page generation, enabling an attacker to inject malicious scrip...

CVE-2025-49249 WordPress Drone theme <= 1.40 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ApusTheme Drone drone allows Reflected XSS.This issue affects Drone: from n/a through = 1.40...

CVE-2025-48094 WordPress Magic Slider plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LambertGroup Magic Slider magicslider allows Reflected XSS.This issue affects Magic Slider: from n/a through = 2.2...

CVE-2025-47500

CVE-2025-47500 : Stored XSS in Stackable – Page Builder Gutenberg Blocks (Stackable) for WordPress plugins up to version 3.19.5. The issue stems from improper neutralization of input during web page generation, enabling an attacker to inject malicious scripts viewed by other users. Affected produ...

CVE-2025-4763

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Aida Computer Information Technology Inc. Hotel Guest Hotspot allows Reflected XSS. This issue affects Hotel Guest Hotspot: through 22012026. NOTE: The vendor was contacted early about this...

CVE-2025-4763 XSS in Aida Computer's Hotspot

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Aida Computer Information Technology Inc. Hotel Guest Hotspot allows Reflected XSS.This issue affects Hotel Guest Hotspot: through 22012026. NOTE: The vendor was contacted early about this...

PT-2026-3962

Name of the Vulnerable Software and Affected Versions Stackable versions through 3.19.5 Description A flaw exists in Benjamin Intal Stackable stackable-ultimate-gutenberg-blocks that allows for Stored Cross-site Scripting XSS. This issue is due to improper neutralization of input during web page...

PT-2026-3967

Name of the Vulnerable Software and Affected Versions Magic Responsive Slider and Carousel WordPress versions prior to 1.6 Description The software contains a flaw due to improper neutralization of input during web page generation, which allows for Reflected Cross-site Scripting XSS. This means a...

PT-2026-4049

Name of the Vulnerable Software and Affected Versions Kapil Chugh My Post Order versions through 1.2.1.1 Description The software contains a flaw due to improper neutralization of input during web page generation, leading to a Cross-site Scripting XSS issue. This specific instance is a Reflected...

WordPress plugin Enfold has a cross-site scripting vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

TP-Link Omada controllers have security vulnerabilities

TP-Link Omada Controllers are a series of centralized management platforms developed by TP-Link Corporation. The TP-Link Omada Controllers have security vulnerabilities, which stem from improper parameter input handling. These vulnerabilities may lead to cross-site scripting attacks...

WordPress plugin wpCAS has a cross-site scripting vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The wpCA...

WordPress plugin ShoutOut has a cross-site scripting vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

PT-2026-4040

Name of the Vulnerable Software and Affected Versions purethemes WorkScout-Core versions through 1.7.06 Description The software contains a flaw related to improper input handling during web page creation, specifically a Reflected Cross-Site Scripting XSS issue. This allows for the injection of...