CVE-2025-5720

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘author’ parameter in all versions up to, and including, 5.80.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2025-8400

CVE-2025-8400 concerns the Image Gallery WordPress plugin (Bee-Quick-Gallery) with a reflected Cross-Site Scripting vulnerability. The issue affects all versions up to 1.0.0 due to insufficient input sanitization and output escaping, enabling unauthenticated attackers to inject scripts that execu...

PT-2025-31730 · WordPress · The Magic Edge – Lite

Name of the Vulnerable Software and Affected Versions: The Magic Edge – Lite plugin for WordPress versions up to and including 1.1.6 Description: The Magic Edge – Lite plugin for WordPress is susceptible to Stored Cross-Site Scripting via the height parameter due to insufficient input sanitizatio...

PT-2025-31731 · WordPress · Mmm Unity Loader

Name of the Vulnerable Software and Affected Versions: Mmm Unity Loader plugin for WordPress versions prior to 1.0 Description: The Mmm Unity Loader plugin for WordPress is susceptible to Stored Cross-Site Scripting via the attributes parameter due to insufficient input sanitization and output...

PT-2025-31723 · WordPress · 360 Photo Spheres

Name of the Vulnerable Software and Affected Versions: 360 Photo Spheres plugin for WordPress versions up to and including 1.3 Description: The 360 Photo Spheres plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'sphere' shortcode. Insufficient input sanitization and...

PT-2025-31729 · WordPress · All In One Time Clock Lite – Tracking Employee Time Has Never Been Easier

Name of the Vulnerable Software and Affected Versions: All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier plugin for WordPress versions up to and including 2.0 Description: The plugin is susceptible to Reflected Cross-Site Scripting due to insufficient input sanitization an...

PT-2025-31737 · WordPress · Ocean Social Sharing

Name of the Vulnerable Software and Affected Versions: Ocean Social Sharing plugin for WordPress versions prior to 2.2.2 Description: The Ocean Social Sharing plugin for WordPress is susceptible to Stored Cross-Site Scripting through social icon titles due to insufficient input sanitization and...

The vulnerability of the MFlash secure data exchange platform lies in the lack of a mechanism to protect the output data used in generating CSV files. This allows attackers to influence the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the MFlash secure data exchange platform lies in the lack of a mechanism for shielding the output data used in generating CSV files. Exploiting this vulnerability allows an attacker, operating remotely, to compromise the confidentiality, integrity, and accessibility of the...

The vulnerability of P-Net’s input/output devices, related to writing beyond buffer boundaries, allows a intruder to cause a service failure.

The vulnerability of P-Net’s input/output devices is related to writing beyond the buffer boundaries. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

PT-2025-31616 · WordPress · Sureforms

Name of the Vulnerable Software and Affected Versions: SureForms WordPress plugin versions prior to 1.7.2 Description: The SureForms WordPress plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting issue. This can be...

Improper Output Neutralization for Logs

Overview ms-swift is a Swift: Scalable lightWeight Infrastructure for Fine-Tuning Affected versions of this package are vulnerable to Improper Output Neutralization for Logs via the train method. An attacker can execute arbitrary system commands by injecting malicious input into parameters that a...

CVE-2025-5587

The Appzend theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘progressbarLayout’ parameter in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2025-6681

The Fan Page plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2025-8216

The Sky Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Multiple widgets in all versions up to, and including, 3.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacker...

SUSE CVE-2025-54656

UNSUPPORTED WHEN ASSIGNED Improper Output Neutralization for Logs vulnerability in Apache Struts. This issue affects Apache Struts Extras: before 2. When using LookupDispatchAction, in some cases, Struts may print untrusted input to the logs without any filtering. Specially-crafted input may lead...

GHSA-CX25-XG7C-XFM5 Apache Struts Extras Before 2 has an Improper Output Neutralization for Logs Vulnerability

UNSUPPORTED WHEN ASSIGNED Improper Output Neutralization for Logs vulnerability in Apache Struts. This issue affects Apache Struts Extras: before 2. When using LookupDispatchAction, in some cases, Struts may print untrusted input to the logs without any filtering. Specially-crafted input may lead...

Improper Output Neutralization for Logs

Overview Affected versions of this package are vulnerable to Improper Output Neutralization for Logs via the LookupDispatchAction function. An attacker can manipulate log output by submitting specially crafted input, causing parts of the log message to appear as separate log lines and potentially...

CVE-2025-54656

UNSUPPORTED WHEN ASSIGNED Improper Output Neutralization for Logs vulnerability in Apache Struts. This issue affects Apache Struts Extras: before 2. When using LookupDispatchAction, in some cases, Struts may print untrusted input to the logs without any filtering. Specially-crafted input may lead...

CVE-2025-54656

UNSUPPORTED WHEN ASSIGNED Improper Output Neutralization for Logs vulnerability in Apache Struts. This issue affects Apache Struts Extras: before 2. When using LookupDispatchAction, in some cases, Struts may print untrusted input to the logs without any filtering. Specially-crafted input may lead...

CVE-2025-54656 Apache Struts Extras: Improper Output Neutralization for Logs

UNSUPPORTED WHEN ASSIGNED Improper Output Neutralization for Logs vulnerability in Apache Struts. This issue affects Apache Struts Extras: before 2. When using LookupDispatchAction, in some cases, Struts may print untrusted input to the logs without any filtering. Specially-crafted input may lead...