CVE-2025-53237 WordPress WP Wizard Cloak Plugin <= 1.0.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Soflyy WP Wizard Cloak wp-wizard-cloak allows Reflected XSS.This issue affects WP Wizard Cloak: from n/a through = 1.0.1...

CVE-2025-53237

CVE-2025-53237 affects the Soflyy WP Wizard Cloak plugin for WordPress, specifically the wp-wizard-cloak component, with versions up to and including 1.0.1. The root cause is improper neutralization of input during web page generation, enabling a Reflected XSS vulnerability. Impact per the entry ...

CVE-2025-53237 WordPress WP Wizard Cloak Plugin <= 1.0.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Soflyy WP Wizard Cloak wp-wizard-cloak allows Reflected XSS.This issue affects WP Wizard Cloak: from n/a through = 1.0.1...

CVE-2025-53233 WordPress Storyform plugin <= 0.6.14 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in RylanH Storyform storyform allows Reflected XSS.This issue affects Storyform: from n/a through = 0.6.14...

CVE-2025-53228

The CVE-2025-53228 issue affects WordPress bbpress Simple Advert Units (plugin) up to and including version 0.41. It is a Reflected Cross‑Site Scripting (XSS) vulnerability caused by improper input neutralization during web page generation. Affected component: bbpress-simple-advert-units. Impact ...

CVE-2026-2736

Reflected Cross-site Scripting XSS in Alkacon's OpenCms v18.0, which allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL containing the ‘q’ parameter in ‘/search/index.html’. This vulnerability can be exploited to steal sensitive user...

CVE-2025-14452

The WP Customer Reviews plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpcr3fname' parameter in all versions up to, and including, 3.7.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-26987

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are vulnerable to Reflected XSS attacks via email field. This issue has been fixed in version 26.2.0...

CVE-2026-27176

MajorDoMo aka Major Domestic Module contains a reflected cross-site scripting XSS vulnerability in command.php. The $qry parameter is rendered directly into the HTML page without sanitization via htmlspecialchars, both in an input field value attribute and in a paragraph element. An attacker can...

CVE-2026-26987

CVE-2026-26987 affects LibreNMS up to version 25.12.0 with a Reflected XSS vulnerability in the email field of alerting settings. The issue is fixed in version 26.2.0. Multiple sources (NVD, Red Hat, OSV, GHSA) corroborate that user-input in the email field can be reflected, potentially allowing ...

WordPress plugin Prague 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...

PT-2026-21077

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in faraz sms افزونه پیامک حرفه ای فراز اس ام اس farazsms allows Reflected XSS.This issue affects افزونه پیامک حرفه ای فراز اس ام اس: from n/a through = 2.7.3...

PT-2026-21165

Name of the Vulnerable Software and Affected Versions wpdiscover Timeline Event History versions through 3.2 Description The Timeline Event History component of wpdiscover is susceptible to a Reflected Cross-site Scripting issue. This occurs due to improper neutralization of input during web page...

PT-2026-21117

Name of the Vulnerable Software and Affected Versions iContact for Gravity Forms versions through 1.3.2 Description The software contains a flaw related to improper input handling during web page generation, which can lead to Reflected Cross-site Scripting XSS. This allows an attacker to inject...

PT-2026-21124

Name of the Vulnerable Software and Affected Versions GhostPool Aardvark versions through 4.6.3 Description A Reflected Cross-site Scripting XSS issue exists in GhostPool Aardvark. This allows for improper neutralization of input during web page generation. The issue could potentially allow an...

PT-2026-21106

Name of the Vulnerable Software and Affected Versions DaleAB Membee Login versions through 2.3.6 Description The Membee Login widget contains a flaw related to improper input handling during web page generation, which allows for Reflected Cross-site Scripting XSS. This issue could potentially all...

PT-2026-21118

Name of the Vulnerable Software and Affected Versions Simple Archive Generator versions through 5.2 Description The Simple Archive Generator software contains a flaw related to improper handling of user-supplied data when creating web pages, potentially leading to Reflected Cross-site Scripting...

PT-2026-21236

Name of the Vulnerable Software and Affected Versions fox-themes Whizz Plugins versions through 1.9 Description The software contains a flaw due to improper handling of user-supplied data when creating web pages, leading to a potential Reflected Cross-Site Scripting XSS issue. This allows an...

PT-2026-21087

Name of the Vulnerable Software and Affected Versions Mollie Payments for WooCommerce versions through 8.1.1 Description The software contains a flaw due to improper neutralization of input during web page generation, leading to a Reflected Cross-site Scripting condition. The issue allows for the...

PT-2026-21109

Name of the Vulnerable Software and Affected Versions itex iSape versions through 0.72 Description The software contains a flaw due to improper neutralization of input during web page generation, leading to a Reflected Cross-Site Scripting XSS condition. This allows for the injection of malicious...