CVE-2025-28943

CVE-2025-28943 describes a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin “DP ALTerminator – Missing ALT manager.” The issue arises from improper input neutralization during web page generation, allowing stored XSS. Affected versions are up to 1.0.2 (n/a through 1.0.2). C...

CVE-2025-28937

CVE-2025-28937 describes a stored cross‑site scripting (XSS) flaw in the WordPress plugin Lava Ajax Search (versions up to and including 1.1.9). The impact is stored XSS via improper neutralization of input during web page generation. The vulnerability affects Lava Ajax Search as packaged/observe...

CVE-2025-28919

CVE-2025-28919 affects the WordPress plugin Easy Image Display (versions ≤ 1.2.5). The issue is a Stored XSS caused by improper input neutralization during web page generation. Affected scope listed in sources shows vulnerability exists in Easy Image Display: from n/a through 1.2.5. CVSS v3.1 bas...

CVE-2025-28907

CVE-2025-28907 describes a stored XSS in the WordPress plugin WP Last Modified (versions up to 0.1, per the entry). The vulnerability stems from improper input neutralization during web page generation. Public documents in the initial data confirm the CVE and vulnerability class; connected source...

WordPress plugin “Custom Top Bar” has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

WordPress plugin: WordPress login form can be displayed anywhere. Cross-site scripting vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress plugin wordpress login form to...

WordPress plugin Lunar has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripti...

PT-2025-10942

Name of the Vulnerable Software and Affected Versions: Thiago S.F. Skitter Slideshow versions 2.5.2 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that an attacker can injec...

PT-2025-10920

Name of the Vulnerable Software and Affected Versions: Block Spam By Math Reloaded versions through 2.2.4 Description: The issue is related to improper neutralization of input during web page generation, also known as Cross-site Scripting, which allows Stored XSS. Recommendations: For versions...

PT-2025-10941

Name of the Vulnerable Software and Affected Versions: Chaser324 Featured Posts Grid versions 1.7 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that an attacker can inject...

CVE-2025-2209: Improper Neutralization of Input During Web Page Generation

A vulnerability, which was classified as problematic, was found in aitangbao springboot-manager 3.0. Affected is an unknown function of the file /sysDict/add. The manipulation of the argument name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been...

PT-2025-9919

Name of the Vulnerable Software and Affected Versions AtaksAPP Reservation Management System versions prior to 4.2.3 Description The issue affects the AtaksAPP Reservation Management System, allowing Cross-Site Scripting XSS due to improper neutralization of input during web page generation...

CVE-2025-25132

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ravi Singh Visitor Details visitors-details allows Stored XSS.This issue affects Visitor Details: from n/a through = 1.0.1...

CVE-2025-23485

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in richestsoft RS Survey rs-survey allows Reflected XSS.This issue affects RS Survey: from n/a through = 1.0...

CVE-2025-23451

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in titodevera Awesome Twitter Feeds awesome-twitter-feeds allows Reflected XSS.This issue affects Awesome Twitter Feeds: from n/a through = 1.0...

CVE-2025-27269

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Anton Aleksandrov .htaccess Login block htaccess-login-block allows Reflected XSS.This issue affects .htaccess Login block: from n/a through = 0.9a...

CVE-2025-27275

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in andrewfisher WOO Codice Fiscale woo-codice-fiscale allows Reflected XSS.This issue affects WOO Codice Fiscale: from n/a through = 1.6.3...

CVE-2025-26879

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Cristián Lávaque s2Member s2member allows Reflected XSS.This issue affects s2Member: from n/a through = 241216...

CVE-2025-25142

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in The Jake Group WP Less Compiler wp-less-compiler allows Stored XSS.This issue affects WP Less Compiler: from n/a through = 1.3.0...

CVE-2025-25132

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ravi Singh Visitor Details visitors-details allows Stored XSS.This issue affects Visitor Details: from n/a through = 1.0.1...