WordPress plugin WP DataTable has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripti...

WordPress plugin Leyka has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress plugin Popup addon for Ninja Forms – Cross-site scripting vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress plugin My Resume Builder has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-27078 · Woocommerce · Specfit-Virtual Try On Woocommerce

Name of the Vulnerable Software and Affected Versions: SpecFit-Virtual Try On Woocommerce versions 7.0.6 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an...

PT-2025-27114 · Unknown · Flexo Counter

Name of the Vulnerable Software and Affected Versions: Flexo Counter versions 1.0001 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to inject...

WordPress plugin Omnipress has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A cross-site scripting...

PT-2025-27189 · Unknown · Thumbnail Editor

Name of the Vulnerable Software and Affected Versions: Thumbnail Editor versions through 2.3.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This enables potential attackers to inject...

WordPress plugin Responsive Blocks: Cross-site Scripting vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2025-6674

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal CKEditor5 Youtube allows Cross-Site Scripting XSS.This issue affects CKEditor5 Youtube: from 0.0.0 before 1.0.3...

CVE-2025-6677

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Paragraphs table allows Cross-Site Scripting XSS.This issue affects Paragraphs table: from 2.0.0 before 2.0.5...

CVE-2025-48923

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Toc.Js allows Cross-Site Scripting XSS.This issue affects Toc.Js: from 0.0.0 before 3.2.1...

CVE-2025-48922

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal GLightbox allows Cross-Site Scripting XSS.This issue affects GLightbox: from 0.0.0 before 1.0.16...

CVE-2025-6674

The Drupal CKEditor5 Youtube video integration plugin is vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. The root cause is that the module fails to sufficiently validate iframe sources when a user embeds a video. This issue affects vers...

CVE-2025-5682

The Klaro Cookie & Consent Management module for Drupal is vulnerable to a Cross-Site Scripting (XSS) flaw due to the improper neutralization of input during web page generation. Specifically, the module fails to sufficiently sanitize certain HTML attributes , which can lead to persistent XSS att...

CVE-2025-48923 Toc.js - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-077

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Toc.Js allows Cross-Site Scripting XSS.This issue affects Toc.Js: from 0.0.0 before 3.2.1...

Drupal Toc.Js security vulnerability

Drupal Toc.js is a directory generation plugin for the Drupal community. A security vulnerability exists in Drupal Toc.Js versions prior to 3.2.1 that stems from improper input neutralization and could lead to a cross-site scripting attack...

Drupal CKEditor5 YouTube security vulnerability

Drupal CKEditor5 Youtube is a video integration plugin for the Drupal community. A security vulnerability exists in Drupal CKEditor5 Youtube versions prior to 1.0.3, which stems from improper input neutralization and could lead to cross-site scripting attacks...

Drupal GLightbox security vulnerabilities

Drupal GLightbox is a JavaScript image and video displayer for the Drupal community. A security vulnerability exists in Drupal GLightbox versions prior to 1.0.16 that stems from improper input neutralization and could lead to a cross-site scripting attack...

CVE-2025-50021

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Robert Peake Better Random Redirect better-random-redirect allows Stored XSS.This issue affects Better Random Redirect: from n/a through = 1.3.20...