CVE-2025-49891

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in uxper Uxper Booking uxper-booking allows Blind SQL Injection.This issue affects Uxper Booking: from n/a through = 1.3.3...

CVE-2025-49893

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in uxper Nuss nuss allows Reflected XSS.This issue affects Nuss: from n/a through = 1.3.3...

CVE-2025-49400

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in osama.esh WP Visitor Statistics Real Time Traffic allows Stored XSS. This issue affects WP Visitor Statistics Real Time Traffic: from n/a through 8.2...

CVE-2025-48297

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in quantumcloud Simple Link Directory qc-simple-link-directory allows Reflected XSS.This issue affects Simple Link Directory: from n/a through 14.8.1...

CVE-2025-49395

CVE-2025-49395 affects Themify Icons plugin for WordPress (versions up to 2.0.3). The issue is a Stored Cross-Site Scripting (XSS) caused by improper neutralization of user-supplied input during web page generation. Exploitation could allow an attacker to inject and execute script in an admin/use...

CVE-2025-49395 WordPress Themify Icons Plugin <= 2.0.3 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in themifyme Themify Icons themify-icons allows Stored XSS.This issue affects Themify Icons: from n/a through = 2.0.3...

CVE-2025-49397

CVE-2025-49397 is a stored XSS in the WordPress plugin Colorbox Lightbox (also referred to as WP Colorbox) up to version 1.1.5. The vulnerability stems from improper input neutralization during web page generation, enabling cross-site scripting payloads to be stored and served in pages. Public so...

CVE-2025-49409

CVE-2025-49409 refers to a stored XSS vulnerability in brewlabs SensorPress (WordPress plugin). The issue arises from improper neutralization of input during web page generation, allowing stored Cross‑Site Scripting. Affected versions are reported as SensorPress: from n/a through 1.0. The Connect...

CVE-2025-49410

CVE-2025-49410- WordPress Portfolio Manager Pro Plugin &lt;= 3.8 – Unauthenticated Arbitrary File Upload vulnerability. According to Patchstack and CVE records, it allows uploading a dangerous file (e.g., web shell) due to improper file handling, enabling potential remote code execution on affect...

CVE-2025-49411

CVE-2025-49411 affects the WordPress iFrame Block plugin, with vulnerable versions up to 0.1.1. The issue is a stored XSS caused by improper input neutralization during web page generation, enabling script injection when pages are viewed. Affected software: iFrame Block. Root cause: improper sani...

CVE-2025-49413 WordPress Super Store Finder Plugin <= 7.6 - Reflected Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in highwarden Super Store Finder superstorefinder-wp allows Reflected XSS.This issue affects Super Store Finder: from n/a through = 7.6...

CVE-2025-49420

CVE-2025-49420 concerns the WordPress plugin * Ultra Portfolio* (WordPress plugin) with a Cross-Site Scripting (XSS) vulnerability. According to the connected Patchstack/NVD entries, the issue is an improper neutralization of input during web page generation that enables XSS, affecting Ultra Port...

CVE-2025-49893 WordPress Elizaibots plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in liseperu Elizaibots allows Stored XSS. This issue affects Elizaibots: from n/a through 1.0.2...

CVE-2025-49894 WordPress Nuss Theme <= 1.3.3 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in uxper Nuss nuss allows PHP Local File Inclusion.This issue affects Nuss: from n/a through = 1.3.3...

CVE-2025-49894 WordPress WP Emmet plugin <= 0.3.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in rewish WP Emmet allows Stored XSS. This issue affects WP Emmet: from n/a through 0.3.4...

CVE-2025-48162

CVE-2025-48162 is a Reflected Cross-Site Scripting vulnerability in WordPress Simple Business Directory Pro

CVE-2025-48162 WordPress Simple Business Directory Pro <= 15.5.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in quantumcloud Simple Business Directory Pro simple-business-directory-pro allows Reflected XSS.This issue affects Simple Business Directory Pro: from n/a through = 15.5.1...

CVE-2025-48296 WordPress UpStore <= 1.7.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in skygroup UpStore upstore allows Reflected XSS.This issue affects UpStore: from n/a through = 1.7.0...

CVE-2025-53194 WordPress JetEngine <= 3.7.0 - Remote Code Execution (RCE) Vulnerability

Deserialization of Untrusted Data vulnerability in Crocoblock JetEngine jet-engine allows Code Injection.This issue affects JetEngine: from n/a through = 3.7.0...

CVE-2025-53226 WordPress Comments Capcha Box Plugin <= 1.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in digitalzoomstudio Comments Capcha Box comments-capcha-box allows Reflected XSS.This issue affects Comments Capcha Box: from n/a through = 1.1...