CVE-2025-58966 WordPress NEX-Forms LITE plugin < 8.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Basix NEX-Forms LITE nex-forms-lite allows Reflected XSS.This issue affects NEX-Forms LITE: from n/a through 8.2...

CVE-2025-58959

The CVE-2025-58959 entry corresponds to a path traversal flaw in WordPress Taskbot (plugin Taskbot) versions up to and including 6.4. The underlying issue is improper limitation of a pathname to a restricted directory, enabling traversal attacks. In affected reports from Red Hat/NVD/CVE listings,...

CVE-2025-58921

CVE-2025-58921 affects Arevico WP Tactical Popup (wp-tactical-popup) with a Reflected XSS in versions through 1.1 due to improper input handling during web page generation. The issue is confirmed in connected sources (e.g., PT-2025-43273) and related vulnerability databases. Remediation: update t...

CVE-2025-53423 WordPress Triss theme <= 2.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in designthemes Triss triss allows Reflected XSS.This issue affects Triss: from n/a through = 2.6...

CVE-2025-53423 WordPress Triss theme <= 2.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in designthemes Triss triss allows Reflected XSS.This issue affects Triss: from n/a through = 2.6...

CVE-2025-53229

CVE-2025-53229 describes a Reflected Cross-Site Scripting (XSS) weakness in the WordPress RockON DJ theme, affecting versions up to 3.3. The root cause is improper input neutralization during web page generation, enabling a reflected XSS payload when users view crafted pages. Connected sources co...

CVE-2025-52770

CVE-2025-52770 concerns the WordPress Hello Followers plugin (versions up to and including 2.5). The vulnerability is a reflected Cross-Site Scripting (XSS) caused by improper input neutralization during web page generation. Affected component: Hellofollowers plugin; root cause: improper handling...

CVE-2025-52736

Summary: CVE-2025-52736 affects the WordPress Finale Lite plugin up to version 2.20.0 and is a reflected XSS caused by improper input handling during web page creation. Multiple connected sources confirm the vulnerable component and version range ( Finale Lite: ≤ 2.20.0) and classify the impact a...

CVE-2025-49956 WordPress Fade Slider plugin <= 2.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Anandaraj Balu Fade Slider fade-slider allows Reflected XSS.This issue affects Fade Slider: from n/a through = 2.5...

CVE-2025-49955 WordPress WP Smart Flexslider Plugin <= 2.5 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Rajan Vijayan WP Smart Flexslider wp-smart-flexslider allows Reflected XSS.This issue affects WP Smart Flexslider: from n/a through = 2.5...

CVE-2025-49956

CVE-2025-49956 concerns WordPress Fade Slider Plugin (

CVE-2025-49936

CVE-2025-49936: WordPress WoodMart theme

CVE-2025-49927

The CVE-2025-49927 issue concerns CrocoBlock JetWooBuilder (jet-woo-builder) for WordPress, with a Stored XSS vulnerability caused by improper neutralization of input during web page generation. Affected versions are up to and including 2.1.20.1. Red Hat and other sources corroborate the same des...

CVE-2025-49921 WordPress JetReviews plugin <= 3.0.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Crocoblock JetReviews jet-reviews allows PHP Local File Inclusion.This issue affects JetReviews: from n/a through = 3.0.0...

CVE-2025-49916 WordPress MultiVendorX plugin <= 4.2.23 - Broken Access Control vulnerability

Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects MultiVendorX: from n/a through = 4.2.23...

CVE-2025-49913 WordPress CoSchedule plugin <= 3.4.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in CoSchedule CoSchedule coschedule-by-todaymade allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CoSchedule: from n/a through = 3.4.0...

CVE-2025-49911 WordPress WooCommerce Vehicle Parts Finder plugin <= 3.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpinstinct WooCommerce Vehicle Parts Finder woo-vehicle-parts-finder allows Reflected XSS.This issue affects WooCommerce Vehicle Parts Finder: from n/a through = 3.7...

CVE-2025-49908

CVE-2025-49908 affects WPClever WPC Countdown Timer for WooCommerce (plugin: wpc-countdown-timer). Versions up to and including 3.1.4 suffer from improper input neutralization during web page generation, enabling Stored Cross-Site Scripting (XSS). Impact per the sources is stored XSS impacting us...

CVE-2025-48093 WordPress Password only login plugin <= 0.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Calvaweb Password only login password-only-login allows Reflected XSS.This issue affects Password only login: from n/a through = 0.2...

CVE-2025-31634 WordPress Insurance theme <= 3.5 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in designthemes Insurance insurance allows Object Injection.This issue affects Insurance: from n/a through = 3.5...