CVE-2025-23718 WordPress Mancx AskMe Widget plugin <= 0.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in mancx Mancx AskMe Widget mancx-askme-widget allows Reflected XSS.This issue affects Mancx AskMe Widget: from n/a through = 0.3...

CVE-2025-23670 WordPress 4 author cheer up donate plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NotFound 4 author cheer up donate allows Reflected XSS. This issue affects 4 author cheer up donate: from n/a through 1.3...

CVE-2025-23579

CVE-2025-23579 affects the WordPress plugin DZS Ajaxer Lite (versions up to 1.04). The vulnerability is a Stored Cross-Site Scripting flaw caused by improper neutralization of input during web page generation. Multiple sources (NVD, Red Hat advisory, CVE listings, and Patchstack) uniformly descri...

CVE-2025-23587 WordPress all-in-one-box-login plugin <= 2.0.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ashek Al Mahmud all-in-one-box-login all-in-one-login allows Reflected XSS.This issue affects all-in-one-box-login: from n/a through = 2.0.1...

CVE-2025-23576 WordPress WP Intro.JS Plugin plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in cfuze WP Intro.JS wp-intro-js-tours allows Reflected XSS.This issue affects WP Intro.JS: from n/a through = 1.1...

CVE-2025-23563

CVE-2025-23563 is a reflected XSS in the WordPress Explore pages plugin (versions

CVE-2025-23570

CVE-2025-23570 is a Reflected XSS in the WordPress WP Social Links plugin (

CVE-2025-23526 WordPress Swift Calendar Online Appointment Scheduling plugin <= 1.3.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NotFound Swift Calendar Online Appointment Scheduling allows Reflected XSS. This issue affects Swift Calendar Online Appointment Scheduling: from n/a through 1.3.3...

CVE-2025-23518

CVE-2025-23518 is a reflected XSS in the WordPress GoogleMapper plugin (versions up to and including 2.0.3). The vulnerability arises from improper neutralization of input during web page generation, enabling script injection. Affected software is the GoogleMapper plugin for WordPress; no exploit...

CVE-2025-23490

CVE-2025-23490 affects the WordPress Browser-Update-Notify plugin (versions

CVE-2025-23493

CVE-2025-23493 affects the WordPress Google Transliteration plugin (versions up to 1.7.2). The issue is a Reflected XSS caused by improper input neutralization during web page generation. Root cause: improper input handling; affected component: plugin’s rendering pathway. Impact per source: poten...

CVE-2025-23472 WordPress Flexo Slider plugin <= 1.0013 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in flexostudio Flexo Slider flexo-slider allows Reflected XSS.This issue affects Flexo Slider: from n/a through = 1.0013...

CVE-2025-23439

CVE-2025-23439 affects the WordPress plugin willshouse TinyMCE Extended Config, version

CVE-2025-23447

CVE-2025-23447 affects the WordPress plugin NotFound Smooth Dynamic Slider (Smooth Dynamic Slider) up to version 1.0. The issue is a Reflected XSS caused by improper input neutralization during web page generation. The CVSS v3.1 base score is 7.1 (HIGH). No explicit fix version is provided in the...

CVE-2025-23437

CVE-2025-23437 describes a reflected cross-site scripting vulnerability in the WordPress plugin ntp-header-images (NotFound) versions up to and including 1.2 . The issue stems from improper input neutralization during web page generation, enabling reflected XSS when processing input. Public docum...

CVE-2025-0475 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1. A proxy feature could potentially allow unintended content rendering leading to XSS under specific circumstances...

WordPress plugin Authors Autocomplete Meta Box 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPre...

WordPress plugin Contexto 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripti...

WordPress plugin wp-xintaoke 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripti...

WordPress plugin Google Map on Post/Page 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...