CVE-2025-1505

The Advanced AJAX Product Filters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nonce' parameter in all versions up to, and including, 1.6.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2024-2259

This vulnerability exists in InstaRISPACS software due to insufficient validation of user supplied input for the loginTo parameter in user login module of the web interface of the application. A remote attacker could exploit this vulnerability by sending a specially crafted input to the vulnerabl...

CVE-2024-2242

The Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘active-tab’ parameter in all versions up to, and including, 5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2024-2738

The Permalink Manager Lite and Pro plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the ‘s’ parameter in multiple instances in all versions up to, and including, 2.4.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate...

CVE-2024-2325

The Link Library plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the searchll parameter in all versions up to, and including, 7.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

WordPress HBLPAY Payment Gateway for WooCommerce plugin <= 5.0.0 - Reflected Cross-Site Scripting via 'cusdata' Parameter vulnerability

Reflected Cross-Site Scripting via 'cusdata' Parameter vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan - Knight Squad in WordPress Plugin HBLPAY Payment Gateway for WooCommerce versions = 5.0.0...

CVE-2025-13369 Premmerce WooCommerce Customers Manager <= 1.1.14 - Reflected Cross-Site Scripting

The Premmerce WooCommerce Customers Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'moneyspentfrom', 'moneyspentto', 'registeredfrom', and 'registeredto' parameters in all versions up to, and including, 1.1.14 due to insufficient input sanitization and output...

CVE-2025-14835 WP Photo Album Plus <= 9.1.05.008 - Reflected Cross-Site Scripting

The WP Photo Album Plus plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘shortcode’ parameter in all versions up to, and including, 9.1.05.008 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

PT-2026-1647

Name of the Vulnerable Software and Affected Versions Frenify Arlo versions through 6.0.3 Description A flaw exists in Frenify Arlo that allows for Reflected Cross-site Scripting XSS. This issue arises from improper input validation during web page generation. The vulnerability could potentially...

PT-2026-1627

Name of the Vulnerable Software and Affected Versions Testimonial Master plugin for WordPress versions up to and including 0.2.1 Description The Testimonial Master plugin for WordPress is susceptible to Reflected Cross-Site Scripting. This is due to insufficient input sanitization and output...

WordPress plugin Arlo 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site...

PT-2026-1628

Name of the Vulnerable Software and Affected Versions Stumble! for WordPress plugin versions up to and including 1.1.1 Description The Stumble! for WordPress plugin is susceptible to Reflected Cross-Site Scripting. This is due to insufficient input sanitization and output escaping of the $...

📄 mrrb.bg Cross Site Scripting

The site at mrrb.bg suffers from a cross site scripting issue. The researcher has waited over a year after reporting this to make public, so hopefully this will encourage them to fix it. Titles: mrrb.bg-APP - XSS-Reflected Author: nu11secur1ty Date: 01/06/2026 Vendor: mrrb.bg Software: mrrb.bg...

PT-2026-1624

Name of the Vulnerable Software and Affected Versions Starred Review plugin for WordPress versions up to and including 1.4.2 Description The Starred Review plugin for WordPress is susceptible to Reflected Cross-Site Scripting. This is due to insufficient input sanitization and output escaping...

PT-2026-1643

Name of the Vulnerable Software and Affected Versions Digital zoom studio DZS Video Gallery versions through 12.25 Description The software contains a flaw related to improper input handling during web page generation, leading to a Reflected Cross-site Scripting XSS condition. This allows for the...

CVE-2025-31642

CVE-2025-31642 – WPCHURCH Reflected XSS is confirmed in multiple sources for WordPress WPCHURCH up to version 2.7.0. The vulnerability arises from improper input neutralization during web page generation, enabling a reflected cross-site scripting attack. Affected software: Dasinfomedia WPCHURCH

CVE-2025-31642 WordPress WPCHURCH plugin <= 2.7.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Dasinfomedia WPCHURCH allows Reflected XSS.This issue affects WPCHURCH: from n/a through 2.7.0...

CVE-2025-30631 Reflected Cross Site Scripting (XSS) vulnerability in AA-Team WordPress plugins

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in AA-Team Woocommerce Sales Funnel Builder, AA-Team Amazon Affiliates Addon for WPBakery Page Builder formerly Visual Composer allows Reflected XSS.This issue affects Woocommerce Sales Funnel Builder...

CVE-2025-69085

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in e-plugins JobBank jobbank allows Reflected XSS.This issue affects JobBank: from n/a through = 1.2.2...

CVE-2025-69084

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in gt3themes Photo Gallery gt3-photo-video-gallery allows Reflected XSS.This issue affects Photo Gallery: from n/a through = 2.7.7.26...