PT-2025-31188 · WordPress +1 · Sky Addons For Elementor +1

Name of the Vulnerable Software and Affected Versions: Sky Addons for Elementor plugin versions up to and including 3.1.4 Description: The Sky Addons for Elementor plugin for WordPress is susceptible to Stored Cross-Site Scripting XSS through multiple widgets. Insufficient input sanitization and...

CVE-2025-51970

A SQL Injection vulnerability exists in the action.php endpoint of PuneethReddyHC Online Shopping System Advanced 1.0 due to improper sanitization of user-supplied input in the keyword POST parameter...

CVE-2025-51970

A SQL Injection vulnerability exists in the action.php endpoint of PuneethReddyHC Online Shopping System Advanced 1.0 due to improper sanitization of user-supplied input in the keyword POST parameter...

CVE-2025-51970

CVE-2025-51970 affects PuneethReddyHC Online Shopping System Advanced v1.0 with an SQL Injection in the action.php endpoint, caused by improper sanitization of the keyword POST parameter. Exploitation details in connected documents show PoCs and tooling (e.g., sqlmap usage) that illustrate how an...

PT-2025-31166 · WordPress · Elementor Website Builder

Name of the Vulnerable Software and Affected Versions: Elementor Website Builder – More Than Just a Page Builder plugin for WordPress versions prior to 3.30.3 Description: The Elementor Website Builder plugin for WordPress is susceptible to Stored Cross-Site Scripting via the data-text DOM elemen...

PT-2025-31187 · WordPress · Magical Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Magical Addons For Elementor plugin versions prior to 1.3.9 Description: The Magical Addons For Elementor plugin for WordPress is susceptible to Stored Cross-Site Scripting through the plugin’s Custom Attributes. Insufficient input sanitizati...

PT-2025-31218 · Unknown · Puneethreddyhc Online-Shopping-System-Advanced

Name of the Vulnerable Software and Affected Versions: PuneethReddyHC Online Shopping System Advanced version 1.0 Description: A SQL Injection issue exists due to improper sanitization of user-supplied input in the keyword POST parameter of the /action.php API endpoint. Recommendations: Apply inp...

PT-2025-31262 · Elementor +1 · Elementor +1

Name of the Vulnerable Software and Affected Versions: MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress versions up to and including 4.0.1 Description: The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress ...

PT-2025-31189 · WordPress · Appzend

Name of the Vulnerable Software and Affected Versions: Appzend versions prior to 1.2.7 Description: The Appzend theme for WordPress is susceptible to Stored Cross-Site Scripting through the progressbarLayout parameter. Insufficient input sanitization and output escaping allow authenticated...

PT-2025-31162 · WordPress · Streamweasels Kick Integration

Name of the Vulnerable Software and Affected Versions: StreamWeasels Kick Integration plugin for WordPress versions through 1.1.4 Description: The StreamWeasels Kick Integration plugin for WordPress is susceptible to Stored Cross-Site Scripting through the plugin’s data-uuid attribute. Insufficie...

PT-2025-31164 · WordPress · Elementor Website Builder

Name of the Vulnerable Software and Affected Versions: Elementor Website Builder – More Than Just a Page Builder plugin for WordPress versions prior to 3.29.1 Description: The Elementor Website Builder plugin for WordPress is susceptible to Stored Cross-Site Scripting via the elementor-element...

PT-2025-31195 · Unknown · Human Resource Management System Version 1.0

Name of the Vulnerable Software and Affected Versions: Human Resource Management System version 1.0 Description: This issue allows an attacker to execute JavaScript code in a victim’s browser. This is achieved by sending a malicious URL through the employeeid parameter. The vulnerable location is...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via improper sanitization of multimedia tags in music files, including m3u files. An attacker can execute arbitrary JavaScript code in a victim's browser by tricking the victim into opening a crafted file. Detai...

CVE-2025-54423

copyparty is a portable file server. In versions up to and including versions 1.18.4, an unauthenticated attacker is able to execute arbitrary JavaScript code in a victim's browser due to improper sanitization of multimedia tags in music files, including m3u files. This is fixed in version 1.18.5...

CVE-2025-29534

An authenticated remote code execution vulnerability in PowerStick Wave Dual-Band Wifi Extender V1.0 allows an attacker with valid credentials to execute arbitrary commands with root privileges. The issue stems from insufficient sanitization of user-supplied input in the /cgi-bin/cgivista.cgi...

CVE-2025-54418

CodeIgniter is a PHP full-stack web framework. A command injection vulnerability present in versions prior to 4.6.2 affects applications that use the ImageMagick handler for image processing imagick as the image library and either allow file uploads with user-controlled filenames and process...

Cross-Site Scripting (XSS)

aim is vulnerable to Cross-site Scripting XSS. The vulnerability is due to the lack of sanitization or sandboxing in the /api/reports endpoint, which allows an attacker to execute arbitrary JavaScript in victims' browsers through malicious Python code interpreted by pyodide.code.runjs when the...

CVE-2025-7501

The Wonder Slider Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image title and description DOM in all versions up to, and including, 14.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-5529

The Educenter theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Circle Counter Block in all versions up to, and including, 1.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2025-6987

The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advancediframe' shortcode in all versions up to, and including, 2025.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...