CVE-2025-46476 WordPress Awesome Wp Image Gallery <= 1.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in nayon46 Awesome Wp Image Gallery allows Stored XSS. This issue affects Awesome Wp Image Gallery: from n/a through 1.0...

CVE-2025-39397

CVE-2025-39397 corresponds to a reflected cross-site scripting vulnerability in the WordPress plugin Anything Popup (versions up to 7.3). The issue arises from improper input neutralization during web page generation, enabling an attacker to inject and execute script in a victim’s browser. The CV...

CVE-2025-46260

CVE-2025-46260 is a stored cross-site scripting (XSS) vulnerability in the WordPress plugin “Sky Addons for Elementor.” The issue arises from improper input neutralization during web page generation, enabling stored XSS. Affected products/versions: Sky Addons for Elementor versions n/a through 3....

PT-2025-17776 · Zoho · Zoho Creator Forms

Name of the Vulnerable Software and Affected Versions: Zoho Creator Forms versions 1.0.0 through 1.0.5 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS in Zoho Creator Forms...

WordPress plugin User Registration 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPre...

WordPress plugin BruteGuard – Brute Force Login Protection 跨站脚本漏洞

WordPress and the WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...

WordPress plugin Peekaboo 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress plugin WP Customize Login Page 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-17793 · Unknown · Bbcode Deluxe

Name of the Vulnerable Software and Affected Versions: BBCode Deluxe versions through 2020.08.01.2 Description: The issue is related to improper neutralization of input during web page generation, which allows for DOM-Based XSS. This can lead to Cross-site Scripting attacks. Recommendations: For...

PT-2025-17766 · Warmwhisky · Warmwhisky Gtdb Guitar Tuners

Name of the Vulnerable Software and Affected Versions: warmwhisky GTDB Guitar Tuners versions n/a through 4.2.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacke...

WordPress plugin Confirm User Registration 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress plugin Xpert Tab 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress plugin Peadig’s Google +1 Button 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2025-3900

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Colorbox allows Cross-Site Scripting XSS.This issue affects Colorbox: from 0.0.0 before 2.1.3...

CVE-2025-3901 Bootstrap Site Alert - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-042

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Bootstrap Site Alert allows Cross-Site Scripting XSS.This issue affects Bootstrap Site Alert: from 0.0.0 before 1.13.0, from 3.0.0 before 3.0.4...

Drupal Block Class 安全漏洞

Drupal Block Class is a module plugin in the Drupal content management system for the Drupal community. A security vulnerability exists in Drupal Block Class versions prior to 4.0.1 that stems from improper input neutralization and could lead to a cross-site scripting attack...

PT-2025-17657 · Drupal · Drupal Bootstrap Site Alert

Name of the Vulnerable Software and Affected Versions: Drupal Bootstrap Site Alert versions 0.0.0 through 1.12.0 Drupal Bootstrap Site Alert versions 3.0.0 through 3.0.3 Description: The issue affects Drupal Bootstrap Site Alert, allowing Cross-Site Scripting XSS due to improper neutralization of...

Drupal Bootstrap Site Alert 安全漏洞

Drupal Bootstrap Site Alert is a module plugin in the Drupal content management system for the Drupal community. A security vulnerability exists in Drupal Bootstrap Site Alert versions prior to 1.13.0 and 3.0.x versions prior to 3.0.4, which stems from improper input neutralization and could lead...

CVE-2025-23176 Tecnick – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CWE-89: Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection'...

CVE-2025-23176

CVE-2025-23176 corresponds to an SQL Injection weakness (CWE-89) affecting Tecnick TCExam. Multiple connected sources (CNNVD, CVE list, Red Hat entry) confirm the root cause as improper neutralization of special elements in SQL commands. CNNVD specifies the vulnerable product as Tecnick TCExam in...