CVE-2024-2361

A vulnerability in the parisneo/lollms-webui allows for arbitrary file upload and read due to insufficient sanitization of user-supplied input. Specifically, the issue resides in the installmodel function within lollmscore/lollms/binding.py, where the application fails to properly sanitize the...

CVE-2025-15000 Page Keys <= 1.3.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'page_key' Parameter

The Page Keys plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pagekey’ parameter in all versions up to, and including, 1.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, ...

CVE-2025-14875 HBLPAY Payment Gateway for WooCommerce <= 5.0.0 - Reflected Cross-Site Scripting via 'cusdata' Parameter

The HBLPAY Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘cusdata’ parameter in all versions up to, and including, 5.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers ...

CVE-2025-14719

CVE-2025-14719 : Relevanssi Free (&lt;4.26.0) and Relevanssi Premium (

PT-2026-1629

Name of the Vulnerable Software and Affected Versions Post Like Dislike plugin for WordPress versions prior to 1.0 Description The Post Like Dislike plugin for WordPress is susceptible to Reflected Cross-Site Scripting. This is due to insufficient input sanitization and output escaping related to...

WordPress plugin AD Sliding FAQ 跨站脚本漏洞

...

PT-2026-1640

Name of the Vulnerable Software and Affected Versions Responsive Pricing Table plugin for WordPress versions up to and including 5.1.12 Description The software contains a flaw due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level...

PT-2026-1630

Name of the Vulnerable Software and Affected Versions WP Widget Changer versions 1.0 through 1.2.5 Description The WP Widget Changer plugin for WordPress is susceptible to Reflected Cross-Site Scripting. This is due to insufficient input sanitization and output escaping of the $ SERVER'PHP SELF'...

WordPress plugin WP Widget Changer 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin.... A cross-site...

PT-2026-1633

Name of the Vulnerable Software and Affected Versions Easy GitHub Gist Shortcodes plugin for WordPress versions prior to 1.0 Description The Easy GitHub Gist Shortcodes plugin for WordPress is susceptible to Stored Cross-Site Scripting through the id parameter of the gist shortcode. Insufficient...

PT-2026-1680

Name of the Vulnerable Software and Affected Versions V-SOL GPON/EPON OLT Platform version 2.03 V-SOL GPON/EPON OLT Platform version 2.03.62R IPv6 Description The V-SOL GPON/EPON OLT Platform is affected by multiple reflected cross-site scripting issues. These issues are caused by insufficient...

PT-2026-1624

Name of the Vulnerable Software and Affected Versions Starred Review plugin for WordPress versions up to and including 1.4.2 Description The Starred Review plugin for WordPress is susceptible to Reflected Cross-Site Scripting. This is due to insufficient input sanitization and output escaping...

WordPress plugin WPCHURCH 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin.... A cross-sit...

CVE-2025-69335 WordPress Team Showcase plugin <= 2.9 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Themepoints Team Showcase team-showcase allows Stored XSS.This issue affects Team Showcase: from n/a through = 2.9...

CVE-2025-12067

The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Cell Content in all versions up to, and including, 1.3.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-15022

Action captions in Vaadin accept HTML by default but were not sanitized, potentially allowing Cross-site Scripting XSS if caption content is derived from user input. In Vaadin Framework 7 and 8, the Action class is a general-purpose class that may be used by multiple components. The fixed version...

CVE-2025-12067 Table Field Add-on for ACF and SCF <= 1.3.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table Cell Content

The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Cell Content in all versions up to, and including, 1.3.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-14124

The Team WordPress plugin before 5.0.11 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2025-13746 ForumWP – Forum & Discussion Board <= 2.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name

The ForumWP – Forum & Discussion Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the User's Display Name in all versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2026-1489

Name of the Vulnerable Software and Affected Versions POSIMYTH UiChemy versions through 4.4.2 Description The software contains a flaw related to improper input handling during web page generation, which allows for Stored Cross-site Scripting XSS. This means malicious scripts can be stored on the...