CVE-2025-6244 Essential Addons for Elementor – Popular Elementor Templates and Widgets <= 6.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via `Calendar` And `Business Reviews` Widgets

The Essential Addons for Elementor – Popular Elementor Templates and Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the via Calendar And Business Reviews Widgets attributes in all versions up to, and including, 6.1.19 due to insufficient input sanitization and outpu...

CVE-2025-6244

CVE-2025-6244 affects the WordPress plugin “Essential Addons for Elementor” (Lite) up to version 6.1.19. The vulnerability is a Stored Cross‑Site Scripting (XSS) flaw in the Calendar and Business Reviews widgets caused by insufficient input sanitization and output escaping. Attacker capability re...

WordPress Magic Buttons for Elementor Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in WordPress Magic Buttons for Elementor that stems from insufficient input cleanup and output escaping of user-supplied...

PT-2025-28337 · WordPress · Woodmart

Name of the Vulnerable Software and Affected Versions: Woodmart theme for WordPress versions up to, and including, 8.2.3 Description: The issue is related to Stored Cross-Site Scripting via the plugin's multiple markers attribute due to insufficient input sanitization and output escaping on...

WordPress plugin Essential Addons for Elementor 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2025-28330 · WordPress · Foobox

Name of the Vulnerable Software and Affected Versions: The Lightbox & Modal Popup WordPress Plugin – FooBox plugin for WordPress versions up to, and including, 2.7.34 Description: The issue is related to Stored Cross-Site Scripting via image alternative texts due to insufficient input sanitizatio...

org.apache.cxf: Apache CXF: Denial of Service vulnerability with temporary files

A flaw was found in Apache CXF. In some edge cases with large data stream caching, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system and trigger a denial of service...

webkitgtk: disclose sensitive information

A flaw was found in WebKitGTK, which exists due to excessive data output in WebKit Process Model. This issue occurs when processing malicious web content, which may lead to sensitive information disclosure to unauthorized attackers...

PT-2025-31075

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw in Comedi subdevice instruction handlers where data elements beyond the first insn-n elements may be accessed in certain cases. The do insn ioctl and do...

CVE-2025-6673

The Easy restaurant menu manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's nsceprmmenulink shortcode in versions up to, and including 2.0.1, due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-6944

The Uncode Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'uncodehltext' and 'uncodetexticon' shortcodes in all versions up to, and including, 2.9.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-9017

The PeepSo Core: Groups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Group Description field in all versions up to, and including, 6.4.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-5944

The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-caption’ attribute in all versions up to, and including, 8.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

Exploit for SQL Injection in Anisha Car_Rental_System

CVE‑2025‑6907 SQLi Exploit Tool File: exploit.c Aut...

CVE-2025-6787

The Smart Docs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'smartdocssearch' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

WordPress plugin Uncode Core 跨站脚本漏洞

WordPress Uncode Core is a creative multipurpose theme for the WordPress platform. WordPress Uncode Core suffers from a cross-site scripting vulnerability that stems from insufficient input cleanup and output escaping, which can be exploited by an attacker to steal user session information by...

WordPress plugin Premium Addons for Elementor 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress plugin Easy restaurant menu manager 跨站脚本漏洞

WordPress Easy restaurant menu manager is a WordPress plugin for managing restaurant menus , the main features include uploading and editing restaurant menus online and embedding them into the website through short codes or links. A cross-site scripting vulnerability exists in WordPress Easy...

PT-2025-27858 · WordPress · Uncode Core

Name of the Vulnerable Software and Affected Versions: Uncode Core plugin for WordPress versions up to, and including, 2.9.4.2 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on user-supplied attributes in the uncode hl...

WordPress plugin Contact Form 7 Database Addon 跨站脚本漏洞

WordPress and WordPress plugin are products of the WordPress Foundation, a blogging platform developed in PHP. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in WordPress plugin Contact Form...