CVE-2025-23651

CVE-2025-23651 is a Reflected Cross-Site Scripting vulnerability in the WordPress Scroll Top plugin (NotFound Scroll Top) affecting versions up to 1.3.3. The issue stems from improper input neutralization during web page generation, enabling XSS in reflected context. Public references in multiple...

CVE-2025-23652

Summary (CVE-2025-23652): A WordPress plugin issue in Add custom content after post (notFound) exhibits Reflected Cross-Site Scripting due to improper input neutralization during web page generation. Affected versions are n/a through 1.0. The Red Hat and PT Security entries explicitly note the vu...

CVE-2025-23647

CVE-2025-23647 is a WordPress WP-Clap plugin vulnerability: an improper neutralization of input leading to Reflected XSS affecting WP-Clap versions up to 1.5. The CVE lists a CVSS v3.1 base score of 7.1 (HIGH) with Network attack vector, Low confidentiality/integrity/availability impacts, and use...

CVE-2025-23571

CVE-2025-23571 is a reflected XSS in WordPress Internal Links Generator (plugin)

PT-2025-6998

Name of the Vulnerable Software and Affected Versions: Contact Form 7 – Paystack Add-on versions 1.2.3 and earlier Description: The issue is related to improper neutralization of input during web page generation, which can lead to Cross-site Scripting XSS, specifically Reflected XSS...

WordPress plugin: Contact Form with Shortcode – Cross-site Script Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists i...

WordPress plugin QMean – WordPress Did You Mean Cross-site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. WordPress plugin QMean - WordPress Did You Mean 2.0 an...

WordPress plugin “Customize My Account for WooCommerce” has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2025-7022 · Wp2Leads · Wp2Leads

Name of the Vulnerable Software and Affected Versions: WP2LEADS versions prior to 3.3.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables attackers to inject malicious scripts...

PT-2025-6985

Name of the Vulnerable Software and Affected Versions: hoststreamsell HSS Embed Streaming Video versions n/a through 3.23 Description: The issue affects hoststreamsell HSS Embed Streaming Video, allowing Reflected XSS due to improper neutralization of input during web page generation. This is a...

CVE-2025-26538 WordPress Prezi Embedder plugin <= 2.1 - Stored Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Dan Rossiter Prezi Embedder prezi-embedder allows Stored XSS.This issue affects Prezi Embedder: from n/a through = 2.1...

CVE-2025-26538

CVE-2025-26538: WordPress Prezi Embedder

CVE-2025-26567

CVE-2025-26567 concerns the Font Awesome WP WordPress plugin. The vulnerability is a DOM-based Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. Affected: Font Awesome WP versions n/a through 1.0. The provided documents do not specify exploit details, ...

CVE-2025-26561

CVE-2025-26561 is a stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Elfsight Yottie Lite (affected versions

CVE-2025-26552 WordPress Naver Syndication V2 plugin <= 0.8.3 - CSRF to Stored Cross-Site Scripting vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in badrHan Naver Syndication V2 allows Stored XSS. This issue affects Naver Syndication V2: from n/a through 0.8.3...

PT-2025-7189

Name of the Vulnerable Software and Affected Versions: Elfsight Yottie Lite versions 1.3.3 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored Cross-site Scripting XSS. This means that an attacker can inject malicio...

PT-2025-7187

Name of the Vulnerable Software and Affected Versions: Naver Syndication V2 versions 0.8.3 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that an attacker can inject malicio...

WordPress plugin Yottie Lite has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-7180

Name of the Vulnerable Software and Affected Versions: petkivim Embed Google Map versions n/a through 3.2 Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting', which allows Stored XSS in petkivim Embed Google Map...

CVE-2025-25105

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in coffeestudios Pop Up popup-seo-optimized allows Stored XSS.This issue affects Pop Up: from n/a through = 0.1...