WordPress plugin Fitness Park 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress plugin Sitekit 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-26403 · Unknown · Firelight Lightbox

Name of the Vulnerable Software and Affected Versions: Firelight Lightbox versions through 2.3.16 Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored XSS attacks. This means an attacker can inject malicious scripts into the...

Schneider Electric EVLink WallBox Cross-Site Scripting Vulnerability

The Schneider Electric EVLink WallBox is a home charging station from the French company Schneider Electric. A cross-site scripting vulnerability exists in the Schneider Electric EVLink WallBox that stems from improper input neutralization during web page generation, no details of the vulnerabili...

CVE-2025-49871

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Noptin Newsletter Team Noptin newsletter-optin-box allows Stored XSS.This issue affects Noptin: from n/a through = 3.8.7...

CVE-2025-30562

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in wpdistillery Navigation Tree Elementor navigation-tree-elementor allows Blind SQL Injection.This issue affects Navigation Tree Elementor: from n/a through = 1.0.1...

CVE-2025-39508

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NasaTheme Nasa Core nasa-core allows Reflected XSS.This issue affects Nasa Core: from n/a through = 6.4.4...

ROS-20250619-15

A software vulnerability in the Grafana monitoring and surveillance platform is related to a vulnerability in the of the XY Chart plugin to DOM XSS. Exploitation of the vulnerability could allow an attacker acting remotely, execute arbitrary code Grafana monitoring and surveillance platform...

Yirmibes Software MY ERP SQL注入漏洞

Yirmibes Software MY ERP is a business management software from Yirmibes Software, Turkey. A SQL injection vulnerability exists in Yirmibes Software MY ERP versions prior to 1.170, which stems from improper neutralization of special elements in SQL commands, and may lead to SQL injection attacks...

The vulnerability of the Chamilo LMS electronic learning and content management system lies in the lack of measures to neutralize special elements used within the operating system, allowing attackers to execute arbitrary SQL queries.

The vulnerability of the Chamilo LMS, a system for electronic teaching and content management, lies in the lack of measures taken to neutralize special elements used in the operating system. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary SQL...

CVE-2025-5990

An input neutralization vulnerability in the Server Name form and API Key form components of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input...

CVE-2025-48333

CVE-2025-48333 affects WPQuark eForm (WP eForm - WordPress Form Builder) with a Reflected XSS due to improper input neutralization during web page generation. The vulnerability is tracked in CVE-2025-48333 and has a CVSS v3.1 base score of 7.1 (HIGH): Network attack vector, Low confidentiality/In...

CVE-2025-48145

CVE-2025-48145 affects Track, Analyze & Optimize by WP Tao (WordPress plugin). The issue is a Reflected Cross-Site Scripting (XSS) vulnerability arising from improper neutralization of input during web page generation. Affected versions are from n/a through 1.3. The CVSS 3.1 vector is CVSS:3.1/AV...

CVE-2025-48145 WordPress Track, Analyze & Optimize by WP Tao plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Michal Jaworski Track, Analyze & Optimize by WP Tao wp-tao allows Reflected XSS.This issue affects Track, Analyze & Optimize by WP Tao: from n/a through = 1.3...

CVE-2025-49312 WordPress Echo RSS Feed Post Generator Plugin for WordPress plugin <= 5.4.8.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CodeRevolution Echo RSS Feed Post Generator Plugin for WordPress rss-feed-post-generator-echo allows Reflected XSS.This issue affects Echo RSS Feed Post Generator Plugin for WordPress: from n/a...

CVE-2025-49854

CVE-2025-49854 describes an SQL Injection in WordPress Slim SEO (versions n/a through 4.5.4) due to improper neutralization of input in SQL commands. Public sources (NVD, CVE List, Patchstack entry) confirm the vulnerability exists in Slim SEO and has a patch/update path: upgrading to a version l...

CVE-2025-49855 WordPress Meks Flexible Shortcodes plugin <= 1.3.7 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Meks Meks Flexible Shortcodes meks-flexible-shortcodes allows DOM-Based XSS.This issue affects Meks Flexible Shortcodes: from n/a through = 1.3.7...

CVE-2025-49855 WordPress Meks Flexible Shortcodes plugin <= 1.3.7 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Meks Meks Flexible Shortcodes allows DOM-Based XSS. This issue affects Meks Flexible Shortcodes: from n/a through 1.3.7...

CVE-2025-49859 WordPress WP Views Counter plugin <= 2.0.3 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in etruel WP Views Counter wpecounter allows Stored XSS.This issue affects WP Views Counter: from n/a through = 2.0.3...

CVE-2025-49859

CVE-2025-49859 is a stored XSS vulnerability in the WordPress plugin WP Views Counter (versions up to and including 2.0.3). The issue arises from improper input neutralization during web page generation, permitting stored cross-site scripting. Affected software is the WP Views Counter plugin for ...