CVE-2025-31401

CVE-2025-31401: MMX – Make Me Christmas plugin contains a CSRF to Stored XSS vulnerability affecting versions up to 1.0.0. The CVE’s base metrics show CVSS 3.1 with a base score of 7.1 (HIGH); attacker vector is NETWORK, with LOW confidentiality/integrity/availability impacts and user interaction...

fashion365.me Cross Site Scripting vulnerability OBB-4042890

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2025-15752 · Unknown · Mmx – Make Me Christmas

Name of the Vulnerable Software and Affected Versions: MMX – Make Me Christmas versions 1.0.0 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

WordPress plugin MMX – Make Me Christmas 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site request forgery vulnerability exists in...

CVE-2025-31864

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Out the Box Beam me up Scotty beam-me-up-scotty allows Stored XSS.This issue affects Beam me up Scotty: from n/a through = 1.0.23...

CVE-2025-31778

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in raphaelheide Donate Me donate-me allows Reflected XSS.This issue affects Donate Me: from n/a through = 1.2.5...

Exploit for CVE-2025-31864

CVE-2025-31864 1️⃣ Component type WordPress plugin 2️...

CVE-2025-31864

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Out the Box Beam me up Scotty beam-me-up-scotty allows Stored XSS.This issue affects Beam me up Scotty: from n/a through = 1.0.23...

CVE-2025-31778

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in raphaelheide Donate Me donate-me allows Reflected XSS.This issue affects Donate Me: from n/a through = 1.2.5...

CVE-2025-31778

CVE-2025-31778 describes a Reflected Cross-Site Scripting vulnerability in the Donate Me WordPress plugin (affected version range: up to 1.2.5). The issue is caused by improper input neutralization during web page construction. The provided materials identify the vulnerability class and affected ...

WordPress plugin Donate Me 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Lunary 授权问题漏洞

lunary is lunary open source a production toolkit for LLM . An improper authorization vulnerability exists in lunary, which stems from an insufficient access control mechanism at the /users/me/org endpoint, and can be exploited by an attacker to obtain sensitive information...

CVE-2025-23480

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in MicahBlu RSVP ME rsvp-me allows Stored XSS.This issue affects RSVP ME: from n/a through = 1.9.9...

CVE-2025-23480 WordPress RSVP ME plugin <= 1.9.9 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in MicahBlu RSVP ME rsvp-me allows Stored XSS.This issue affects RSVP ME: from n/a through = 1.9.9...

CVE-2025-23480

The CVE-2025-23480 issue concerns the WordPress RSVP ME plugin (versions up to and including 1.9.9). The vulnerability is an improper neutralization of input during web page generation, enabling Stored Cross-Site Scripting (XSS). Affected component is the RSVP ME plugin’s input handling, with att...

CVE-2025-23480 WordPress RSVP ME plugin <= 1.9.9 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in MicahBlu RSVP ME rsvp-me allows Stored XSS.This issue affects RSVP ME: from n/a through = 1.9.9...

WordPress plugin NotFound RSVP ME 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerabili...

CVE-2025-1717

The Login Me Now plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.2. This is due to insecure authentication based on an arbitrary transient name in the 'AutoLogin::listen' function. This makes it possible for unauthenticated attackers to log in an...

CVE-2025-1717 Login Me Now <= 1.7.2 - Authentication Bypass

The Login Me Now plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.2. This is due to insecure authentication based on an arbitrary transient name in the 'AutoLogin::listen' function. This makes it possible for unauthenticated attackers to log in an...

CVE-2025-1717 Login Me Now <= 1.7.2 - Authentication Bypass

The Login Me Now plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.2. This is due to insecure authentication based on an arbitrary transient name in the 'AutoLogin::listen' function. This makes it possible for unauthenticated attackers to log in an...