CVE-2025-67971 WordPress FluentCart plugin < 1.3.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPManageNinja FluentCart fluent-cart allows Reflected XSS.This issue affects FluentCart: from n/a through 1.3.0...

CVE-2025-53237 WordPress WP Wizard Cloak Plugin <= 1.0.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Soflyy WP Wizard Cloak wp-wizard-cloak allows Reflected XSS.This issue affects WP Wizard Cloak: from n/a through = 1.0.1...

CVE-2025-53237

CVE-2025-53237 affects the Soflyy WP Wizard Cloak plugin for WordPress, specifically the wp-wizard-cloak component, with versions up to and including 1.0.1. The root cause is improper neutralization of input during web page generation, enabling a Reflected XSS vulnerability. Impact per the entry ...

CVE-2025-53233 WordPress Storyform plugin <= 0.6.14 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in RylanH Storyform storyform allows Reflected XSS.This issue affects Storyform: from n/a through = 0.6.14...

CVE-2025-53237 WordPress WP Wizard Cloak Plugin <= 1.0.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Soflyy WP Wizard Cloak wp-wizard-cloak allows Reflected XSS.This issue affects WP Wizard Cloak: from n/a through = 1.0.1...

CVE-2025-53233

CVE-2025-53233 concerns the WordPress Storyform plugin (versions

CVE-2025-53228

The CVE-2025-53228 issue affects WordPress bbpress Simple Advert Units (plugin) up to and including version 0.41. It is a Reflected Cross‑Site Scripting (XSS) vulnerability caused by improper input neutralization during web page generation. Affected component: bbpress-simple-advert-units. Impact ...

CVE-2026-2736

Reflected Cross-site Scripting XSS in Alkacon's OpenCms v18.0, which allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL containing the ‘q’ parameter in ‘/search/index.html’. This vulnerability can be exploited to steal sensitive user...

CVE-2025-14452

The WP Customer Reviews plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpcr3fname' parameter in all versions up to, and including, 3.7.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-26987

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are vulnerable to Reflected XSS attacks via email field. This issue has been fixed in version 26.2.0...

CVE-2026-27176

MajorDoMo aka Major Domestic Module contains a reflected cross-site scripting XSS vulnerability in command.php. The $qry parameter is rendered directly into the HTML page without sanitization via htmlspecialchars, both in an input field value attribute and in a paragraph element. An attacker can...

CVE-2026-26987

CVE-2026-26987 affects LibreNMS up to version 25.12.0 with a Reflected XSS vulnerability in the email field of alerting settings. The issue is fixed in version 26.2.0. Multiple sources (NVD, Red Hat, OSV, GHSA) corroborate that user-input in the email field can be reflected, potentially allowing ...

CVE-2025-68848: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in anmari amr cron manager amr-cron-manager allows Reflected XSS.This issue affects amr cron manager: from n/a through = 2.3...

CVE-2025-68842: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in totalbounty Widget Logic Visual widget-logic-visual allows Reflected XSS.This issue affects Widget Logic Visual: from n/a through = 1.52...

CVE-2025-67991: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Reflected XSS.This issue affects User Extra Fields: from n/a through = 16.8...

CVE-2025-68037: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Atlas Gondal Export Media URLs export-media-urls allows Reflected XSS.This issue affects Export Media URLs: from n/a through = 2.2...

CVE-2025-67978: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in FixBD Educare educare allows Reflected XSS.This issue affects Educare: from n/a through = 1.6.1...

WordPress plugin Link Whisper Free 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

PT-2026-21170

Name of the Vulnerable Software and Affected Versions Hugh Mungus Visitor Maps Extended Referer Field versions through 1.2.6 Description The software contains a flaw due to improper neutralization of input during web page generation, leading to a Reflected Cross-site Scripting XSS condition. This...

PT-2026-21118

Name of the Vulnerable Software and Affected Versions Simple Archive Generator versions through 5.2 Description The Simple Archive Generator software contains a flaw related to improper handling of user-supplied data when creating web pages, potentially leading to Reflected Cross-site Scripting...