CVE-2025-26559 WordPress Secure Invites plugin <= 1.2.5 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Chris Taylor Secure Invites wordpress-mu-secure-invites allows Reflected XSS.This issue affects Secure Invites: from n/a through = 1.3...

CVE-2025-26560

CVE-2025-26560 describes a Reflected XSS in the WordPress plugin WP Contact Form III (notFound WP Contact Form III) affecting versions up to 1.6.2d. The root cause is improper input neutralization during web page generation. The connected Red Hat/Reddit Wordfence entries corroborate the vulnerabi...

CVE-2025-26564 WordPress GNUCommerce Plugin <= 1.5.4 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in kagla GNUCommerce gnucommerce allows Reflected XSS.This issue affects GNUCommerce: from n/a through = 1.5.4...

CVE-2025-26560 WordPress WP Contact Form III Plugin <= 1.6.2d - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in KKWangen WP Contact Form III wp-contact-form-iii allows Reflected XSS.This issue affects WP Contact Form III: from n/a through = 1.6.2d...

CVE-2025-26546 WordPress Cookies Pro plugin <= 1.0 - CSRF to Stored XSS vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NotFound Cookies Pro allows Reflected XSS. This issue affects Cookies Pro: from n/a through 1.0...

CVE-2025-26546 WordPress Cookies Pro plugin <= 1.0 - CSRF to Stored XSS vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Pixelpro Cookies Pro cookies-pro allows Reflected XSS.This issue affects Cookies Pro: from n/a through = 1.0...

CVE-2025-26541

CVE-2025-26541 affects the WordPress plugin Bitcoin / AltCoin Payment Gateway for WooCommerce (and Multivendor store)

CVE-2025-26542 WordPress Zalo Live Chat Plugin <= 1.1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NotFound Zalo Live Chat allows Reflected XSS. This issue affects Zalo Live Chat: from n/a through 1.1.0...

CVE-2025-26546

CVE-2025-26546: A CSRF to Stored XSS vulnerability in WordPress Cookies Pro (versions

CVE-2025-26536

CVE-2025-26536 in WordPress plugin Another Events Calendar (versions &lt;= 1.7.0) is a Reflected XSS vulnerability caused by improper input handling during web page generation. The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L with a base score of 7.1 (HIGH). This entry’s conne...

CVE-2025-25134 WordPress Theme Demo Bar Plugin <= 1.6.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in zenverse Theme Demo Bar wordpress-theme-demo-bar allows Reflected XSS.This issue affects Theme Demo Bar: from n/a through = 1.6.3...

CVE-2025-26536 WordPress Another Events Calendar Plugin <= 1.7.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Yendif Player Another Events Calendar another-events-calendar allows Reflected XSS.This issue affects Another Events Calendar: from n/a through = 1.7.0...

CVE-2025-25134 WordPress Theme Demo Bar Plugin <= 1.6.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NotFound Theme Demo Bar allows Reflected XSS. This issue affects Theme Demo Bar: from n/a through 1.6.3...

CVE-2025-25134

CVE-2025-25134 concerns the WordPress plugin WordPress Theme Demo Bar (also referenced as Theme Demo Bar) with versions up to and including 1.6.3 . The vulnerability is described as an improper neutralization of input during web page generation that enables a Reflected Cross-Site Scripting (XSS) ...

CVE-2025-23728 WordPress AuMenu plugin <= 1.1.5 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in atelierhyper AuMenu aumenu allows Reflected XSS.This issue affects AuMenu: from n/a through = 1.1.5...

CVE-2025-23714

CVE-2025-23714 corresponds to a reflected Cross-Site Scripting (XSS) flaw in the WordPress AppReview plugin (versions up to 0.2.9; NotFound AppReview). The root cause is improper input neutralization during web page generation, enabling a reflected XSS payload. Public disclosures and connected so...

CVE-2025-23728

CVE-2025-23728 pertains to the WordPress AuMenu plugin (versions

CVE-2025-23735

CVE-2025-23735 describes a Reflected XSS vulnerability in the WordPress plugin “Infugrator” by Cosmin Schiopu. The issue affects Infugrator versions from unavailable (n/a) up to and including 1.0.3. The root cause is “Improper Neutralization of Input During Web Page Generation” (input not properl...

CVE-2025-23714 WordPress AppReview plugin <= 0.2.9 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NotFound AppReview allows Reflected XSS. This issue affects AppReview: from n/a through 0.2.9...

CVE-2025-23680 WordPress Narnoo Operator plugin <= 2.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Narnoo Narnoo Operator narnoo-shortcodes allows Reflected XSS.This issue affects Narnoo Operator: from n/a through = 2.0.0...