CVE-2025-12471 Hubbub Lite <= 1.36.0 - Reflected Cross-Site Scripting

The Hubbub Lite – Fast, free social sharing and follow buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dpsplistattentionsearch' parameter in all versions up to, and including, 1.36.0 due to insufficient input sanitization and output escaping. This makes it...

CVE-2025-12471

CVE-2025-12471 (Hubbub Lite) : WordPress Hubbub Lite plugin versions up to and including 1.36.0 are vulnerable to Reflected Cross-Site Scripting via the dpsp_list_attention_search parameter due to insufficient input sanitization and output escaping. The vulnerability can be exploited by unauthent...

CVE-2025-12471 Hubbub Lite <= 1.36.0 - Reflected Cross-Site Scripting

The Hubbub Lite – Fast, free social sharing and follow buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dpsplistattentionsearch' parameter in all versions up to, and including, 1.36.0 due to insufficient input sanitization and output escaping. This makes it...

CVE-2025-12580

The SMS for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'paged' parameter in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

PT-2025-45179

Name of the Vulnerable Software and Affected Versions Hubbub Lite versions up to and including 1.36.0 Description The Hubbub Lite – Fast, free social sharing and follow buttons plugin for WordPress is susceptible to Reflected Cross-Site Scripting due to inadequate input sanitization and output...

WordPress plugin Booking and Rental Manager has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2025-52764: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in marielav flexoslider flexoslider allows Reflected XSS.This issue affects flexoslider: from n/a through = 1.0004...

CVE-2025-12471: Improper Neutralization of Input During Web Page Generation

The Hubbub Lite – Fast, free social sharing and follow buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dpsplistattentionsearch' parameter in all versions up to, and including, 1.36.0 due to insufficient input sanitization and output escaping. This makes it...

WordPress Plugin Range Slider Addon for Gravity Forms Cross-Site Script Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which provides the ability to host personal blog sites on PHP and MySQL-based...

WordPress plugin Doliconnect has a cross-site scripting vulnerability

WordPress Doliconnect plugin is a WordPress plugin that is mainly used to connect ERP systems such as Dolibarr with WordPress websites for data synchronization and functional integration. WordPress Doliconnect plugin suffers from a cross-site scripting vulnerability that stems from the...

WordPress plugin Easy Social Share Buttons has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform has the ability to host personal blogging sites on PHP and MySQL based servers.WordPress plugin is an application plugin... A security...

PT-2025-45225

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jhainey Milevis Dropify wc-dropi-integration allows Reflected XSS.This issue affects Dropify: from n/a through = 4.6.9...

CVE-2025-54737: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NooTheme Jobmonster noo-jobmonster allows Reflected XSS.This issue affects Jobmonster: from n/a through = 4.7.8...

PT-2025-45230

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ptibogxiv Doliconnect doliconnect allows Reflected XSS.This issue affects Doliconnect: from n/a through = 9.3.2...

PT-2025-45333

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Pluggabl Booster for WooCommerce woocommerce-jetpack allows Reflected XSS.This issue affects Booster for WooCommerce: from n/a through = 7.2.5...

CVE-2025-58964: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in skygroup Enzy enzy allows Reflected XSS.This issue affects Enzy: from n/a through 1.6.4...

Pi-hole Web Interface < 6.3 Multiple Vulnerabilities

The Pi-hole Web Interface previously AdminLTE is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2025-45229

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in jegtheme Epic Review epic-review allows Reflected XSS.This issue affects Epic Review: from n/a through = 1.0.2...

CVE-2025-63589

A reflected XSS vulnerability exists in CMSimpleXH 1.8's index.php router when attacker-controlled path segments are not sanitized or encoded before being inserted into the generated HTML navigation links, breadcrumbs, search form action, footer links. An attacker-controlled string placed in the...

CVE-2025-63589

A reflected XSS vulnerability exists in CMSimpleXH 1.8's index.php router when attacker-controlled path segments are not sanitized or encoded before being inserted into the generated HTML navigation links, breadcrumbs, search form action, footer links. An attacker-controlled string placed in the...