16140 matches found
PT-2025-17290 · WordPress · La-Studio Element Kit For Elementor
Name of the Vulnerable Software and Affected Versions: LA-Studio Element Kit for Elementor plugin for WordPress versions up to, and including, 1.4.9 Description: The issue is related to Stored Cross-Site Scripting via the plugin's Table of Contents widget due to insufficient input sanitization an...
CVE-2025-23448 WordPress visualslider Sldier plugin <= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in dastan800 visualslider Sldier visual-slider allows Reflected XSS.This issue affects visualslider Sldier: from n/a through = 1.1.1...
CVE-2025-24550 WordPress Job Manager plugin <= 2.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in JobScore Job Manager job-manager-by-jobscore allows Stored XSS.This issue affects Job Manager: from n/a through = 2.2...
CVE-2025-24553 WordPress Shipping with Venipak for WooCommerce plugin <= 1.22.3 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Akadrama Shipping with Venipak for WooCommerce wc-venipak-shipping allows Reflected XSS.This issue affects Shipping with Venipak for WooCommerce: from n/a through = 1.22.3...
CVE-2025-24583 WordPress 12 Step Meeting List plugin <= 3.16.5 - Settings Change vulnerability
Missing Authorization vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 12 Step Meeting List: from n/a through = 3.16.5...
CVE-2025-24624
The CVE-2025-24624 entry applies to the WordPress HT Event (WordPress Event Manager Plugin for Elementor) plugin. Affected versions are 1.4.6 and earlier, with the root cause described as improper neutralization of input during web page generation, enabling a reflected Cross-Site Scripting (XSS) ...
CVE-2025-24624 WordPress HT Event – WordPress Event Manager Plugin for Elementor Plugin <= 1.4.6 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in DevItems HT Event ht-event allows Reflected XSS.This issue affects HT Event: from n/a through = 1.4.6...
CVE-2025-24745
The CVE-2025-24745 entry concerns the RadiusTheme Classified Listing WordPress plugin (versions n/a through 4.0.1) with a Reflected Cross-Site Scripting (XSS) flaw arising from improper input neutralization during web page generation. The vulnerability enables XSS where user-supplied input is not...
CVE-2025-27286
CVE-2025-27286 is a WordPress plugin vulnerability in Saoshyant Slider (versions
CVE-2025-27285 WordPress Easy Form by AYS Plugin <= 2.6.9 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ays Pro Easy Form easy-form allows Reflected XSS.This issue affects Easy Form: from n/a through = 2.6.9...
CVE-2025-27289 WordPress Restrict Taxonomies Plugin <= 1.3.3 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Antoine Guillien Restrict Taxonomies restrict-taxonomies allows Reflected XSS.This issue affects Restrict Taxonomies: from n/a through = 1.3.3...
CVE-2025-27308
CVE-2025-27308 : WordPress WP Video Posts plugin is affected (versions up to 3.5.1) by a Reflected Cross-Site Scripting vulnerability caused by improper neutralization of input during web page generation. Public details consistently reference WP Video Posts in this CVE; exploitation status and fi...
CVE-2025-27302 WordPress CHATLIVE plugin <= 2.0.1 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Claudio Adrian Marrero CHATLIVE chatlive allows SQL Injection.This issue affects CHATLIVE: from n/a through = 2.0.1...
CVE-2025-32522
CVE-2025-32522 affects License Manager for WooCommerce (WordPress plugin) up to version 3.0.9, with a Reflected Cross-Site Scripting vulnerability caused by improper input neutralization during web page generation. CVSSv3.1 base score 7.1 (HIGH), attack vector NETWORK, user interaction REQUIRED. ...
CVE-2025-32530 WordPress Wallet System for WooCommerce plugin <= 2.6.8 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Swings Wallet System for WooCommerce wallet-system-for-woocommerce allows Reflected XSS.This issue affects Wallet System for WooCommerce: from n/a through = 2.6.8...
CVE-2025-32546 WordPress All push notification for WP Plugin <= 1.5.3 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability
Cross-Site Request Forgery CSRF vulnerability in gtlwpdev All push notification for WP allows Reflected XSS. This issue affects All push notification for WP: from n/a through 1.5.3...
CVE-2025-32561
CVE-2025-32561 : Reflected Cross-Site Scripting in the WordPress plugin WP_DEBUG Toggle (plugins.wp_debug_toggle) occurs due to improper input neutralization during web page generation. Affected versions are reported as n/a through 1.1. The connected documents do not provide a published patch or ...
CVE-2025-32572 WordPress Kata Plus Plugin <= 1.5.3 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Climax Themes Kata Plus kata-plus allows Object Injection.This issue affects Kata Plus: from n/a through = 1.5.3...
CVE-2025-32578 WordPress Coming Soon Countdown Plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Mapro Collins Coming Soon Countdown allows Reflected XSS. This issue affects Coming Soon Countdown: from n/a through 2.2...