CVE-2025-49420

CVE-2025-49420 concerns the WordPress plugin * Ultra Portfolio* (WordPress plugin) with a Cross-Site Scripting (XSS) vulnerability. According to the connected Patchstack/NVD entries, the issue is an improper neutralization of input during web page generation that enables XSS, affecting Ultra Port...

CVE-2025-49893 WordPress Elizaibots plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in liseperu Elizaibots allows Stored XSS. This issue affects Elizaibots: from n/a through 1.0.2...

CVE-2025-49894 WordPress WP Emmet plugin <= 0.3.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in rewish WP Emmet allows Stored XSS. This issue affects WP Emmet: from n/a through 0.3.4...

CVE-2025-49894 WordPress Nuss Theme <= 1.3.3 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in uxper Nuss nuss allows PHP Local File Inclusion.This issue affects Nuss: from n/a through = 1.3.3...

CVE-2025-48162 WordPress Simple Business Directory Pro <= 15.5.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in quantumcloud Simple Business Directory Pro simple-business-directory-pro allows Reflected XSS.This issue affects Simple Business Directory Pro: from n/a through = 15.5.1...

CVE-2025-48162

CVE-2025-48162 is a Reflected Cross-Site Scripting vulnerability in WordPress Simple Business Directory Pro

CVE-2025-48296 WordPress UpStore <= 1.7.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in skygroup UpStore upstore allows Reflected XSS.This issue affects UpStore: from n/a through = 1.7.0...

CVE-2025-53194 WordPress JetEngine <= 3.7.0 - Remote Code Execution (RCE) Vulnerability

Deserialization of Untrusted Data vulnerability in Crocoblock JetEngine jet-engine allows Code Injection.This issue affects JetEngine: from n/a through = 3.7.0...

CVE-2025-53226 WordPress Comments Capcha Box Plugin <= 1.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in digitalzoomstudio Comments Capcha Box comments-capcha-box allows Reflected XSS.This issue affects Comments Capcha Box: from n/a through = 1.1...

CVE-2025-53319

CVE-2025-53319 is a reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Raptive Ads (adthrive-ads) , affecting versions from unspecified up to and including 3.8.0 . The issue stems from improper input neutralization during web page generation, enabling a reflected XSS paylo...

CVE-2025-53559

CVE-2025-53559 : Reflected Cross-Site Scripting in the LambertGroup Universal Video Player - Addon for WPBakery Page Builder (versions

CVE-2025-54027 WordPress Support Board <= 3.8.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Schiocco Support Board allows Reflected XSS. This issue affects Support Board: from n/a through 3.8.0...

CVE-2025-54046

CVE-2025-54046 affects the WordPress Cost Calculator plugin (QuanticaLabs) for versions up to 7.4. It is a Stored Cross‑Site Scripting (XSS) vulnerability caused by improper input neutralization during web page generation. Exploitation could occur when a user with access to crafted input is able ...

CVE-2025-54670 WordPress oik Plugin <= 4.15.2 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bobbingwide oik oik allows Reflected XSS.This issue affects oik: from n/a through = 4.15.2...

CVE-2025-54726 WordPress JS Archive List Plugin < 6.1.6 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Miguel Useche JS Archive List allows SQL Injection. This issue affects JS Archive List: from n/a through n/a...

PT-2025-33979 · Unknown · Raptive Ads

Name of the Vulnerable Software and Affected Versions: Raptive Ads versions through 3.8.0 Description: Raptive Ads is susceptible to a reflected cross-site scripting XSS issue due to improper neutralization of input during web page generation. Recommendations: Update Raptive Ads to a version late...

PT-2025-33955 · Unknown · Thiudis Custom Menu

Name of the Vulnerable Software and Affected Versions: thiudis Custom Menu versions through 1.8 Description: Improper neutralization of input during web page generation allows for stored cross-site scripting XSS. Recommendations: Update thiudis Custom Menu to a version later than 1.8...

PT-2025-33948 · Unknown · Wishloop Terms Of Service & Privacy Policy Generator

Name of the Vulnerable Software and Affected Versions: Wishloop Terms of Service & Privacy Policy Generator versions through 1.0 Description: The software contains an Improper Neutralization of Input During Web Page Generation issue, leading to Stored Cross-site Scripting XSS. This allows for the...

WordPress plugin Elite Video Player has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress plugin oik cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...