WordPress Wishlist plugin <= 2.1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao KhanhVCI - VNPT in WordPress Plugin Wishlist versions = 2.1.0...

WordPress Stock Locations for WooCommerce plugin <= 2.8.6 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by LVT-tholv2k in WordPress Plugin Stock Locations for WooCommerce versions = 2.8.6...

WordPress MC Woocommerce Wishlist plugin <= 1.9.1 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Peter Thaleikis in WordPress Plugin MC Woocommerce Wishlist versions = 1.9.1...

WordPress Backup and Staging by WP Time Capsule plugin <= 1.22.23 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Backup and Staging by WP Time Capsule versions = 1.22.23...

CVE-2025-48958

Froxlor is open source server administration software. Prior to version 2.2.6, an HTML Injection vulnerability in the customer account portal allows an attacker to inject malicious HTML payloads in the email section. This can lead to phishing attacks, credential theft, and reputational damage by...

WordPress Soho Hotel Theme <= 4.2.5 is vulnerable to Cross Site Scripting (XSS)

Software Soho Hotel Type Theme Vulnerable versions = 4.2.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2025-39539 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID f1eee5277067 Credits Bonds Required privilege Unauthenticated...

WordPress Bit File Manager plugin <= 6.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Uploads vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting via SVG File Uploads vulnerability discovered by TANG Cheuk Hei siunam in WordPress Plugin Bit File Manager versions = 6.7...

WordPress FancyBox for WordPress plugin < 3.3.6 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Pierre Rudloff, Marc Montpas in WordPress Plugin FancyBox for WordPress versions 3.3.6...

WordPress ZoomSounds plugin <= 6.91 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao KhanhVCI - VNPT in WordPress Plugin ZoomSounds versions = 6.91...

WordPress WooCommerce Photo Reviews plugin <= 1.3.13 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Seb in WordPress Plugin WooCommerce Photo Reviews versions = 1.3.13...

WordPress Universal Video Player plugin <= 3.8.3 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao KhanhVCI - VNPT in WordPress Plugin Universal Video Player versions = 3.8.3...

WordPress Revolution Video Player plugin <= 2.9.2 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao KhanhVCI - VNPT in WordPress Plugin Revolution Video Player versions = 2.9.2...

WordPress Sticky Radio Player plugin <= 3.4 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao KhanhVCI - VNPT in WordPress Plugin Sticky Radio Player versions = 3.4...

WordPress WC MyParcel Belgium plugin <= 4.5.5-beta - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Ryan Novotny in WordPress Plugin WC MyParcel Belgium versions = 4.5.5-beta...

WordPress Universal Video Player plugin <= 1.4.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao KhanhVCI - VNPT in WordPress Plugin Universal Video Player versions = 1.4.0...

WordPress Shared Files plugin <= 1.7.48 - Unauthenticated Stored Cross-Site Scripting via sanitize_file Function vulnerability

Unauthenticated Stored Cross-Site Scripting via sanitizefile Function vulnerability discovered by Martin Martin in WordPress Plugin Shared Files versions = 1.7.48...

WordPress wpForo Advanced Attachments plugin <= 3.1.3 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Christie BOUTIER in WordPress Plugin wpForo Advanced Attachments versions = 3.1.3...

WordPress WordPress Comments Import & Export plugin <= 2.4.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Missing Authorization to Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Jorgson in WordPress Plugin Comments Import & Export versions = 2.4.3...

WordPress Uncanny Automator plugin <= 6.4.0.2 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Denver Jackson in WordPress Plugin Uncanny Automator versions = 6.4.0.2...

CVE-2025-48958 Froxlor has an HTML Injection Vulnerability

Froxlor is open source server administration software. Prior to version 2.2.6, an HTML Injection vulnerability in the customer account portal allows an attacker to inject malicious HTML payloads in the email section. This can lead to phishing attacks, credential theft, and reputational damage by...