WordPress plugin planetcalc 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2025-9044

The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple fields in versions up to, and including, 1.20.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level permissions and...

CVE-2025-59939

WeGIA is a Web manager for charitable institutions. Prior to version 3.5.0, WeGIA is vulnerable to SQL Injection attacks in the control.php endpoint with the following parameters: nomeClasse=ProdutoControle&metodo=excluir&idproduto=malicious command. It is necessary to apply prepared statements...

PT-2025-39709

Name of the Vulnerable Software and Affected Versions WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin versions through 14.5.4 Description The software is susceptible to Stored Cross-Site Scripting through the User-Agent Header due to inadequate input sanitization and output...

PT-2025-39699

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.5.0 Description WeGIA, a Web manager for charitable institutions, contains a SQL Injection flaw. The issue affects the control.php endpoint, specifically through the id produto parameter. Exploitation can occur via...

GHSA-HVQ2-WF92-J4F3 express-xss-sanitizer has an unbounded recursion depth

Security Advisory: express-xss-sanitizer Overview A vulnerability was discovered in express-xss-sanitizer that allowed unbounded recursion depth during sanitization of nested objects. Affected Versions - All versions prior to 2.0.1 Patched Versions - 2.0.1 and later Description The sanitize...

Arbitrary File Write

github.com/harness/gitness is vulnerable to Arbitrary file write. The vulnerability is due to improper sanitization of the upload path, which allows an attacker to craft a malicious upload request and write arbitrary files to any location on the file system...

CVE-2025-10180

The Markdown Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'markdown' shortcode in all versions up to, and including, 0.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...

CVE-2025-10490 Zephyr Project Manager <= 3.3.202 - Authenticated (Admin+) Stored Cross-Site Scripting

The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.3.202 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2025-10136

CVE-2025-10136 concerns the WordPress plugin TweetThis Shortcode. The TweetThis Shortcode plugin is vulnerable to Stored Cross-Site Scripting via its tweetthis shortcode in all versions up to and including 1.8.0 due to insufficient input sanitization and output escaping on user-supplied attribute...

CVE-2025-10136 TweetThis Shortcode <= 1.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The TweetThis Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tweetthis' shortcode in all versions up to, and including, 1.8.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-9490

The Popup Maker WordPress plugin (up to version 1.20.6) is exposed to a Stored Cross-Site Scripting vulnerability via the title parameter. It requires authentication with Contributor-level access or higher to inject scripts, which can execute when any user visits the page containing the injected ...

CVE-2025-9044

The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple fields in versions up to, and including, 1.20.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level permissions and...

CVE-2025-8200

The Mega Elements – Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown Timer widget in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2025-60249

vulnerability-lookup 2.16.0 allows XSS in bundle.py, comment.py, and user.py, by a user on a vulnerability-lookup instance who can add bundles, comments, or sightings. A cross-site scripting XSS vulnerability was discovered in the handling of user-supplied input in the Bundles, Comments, and...

CVE-2025-57292

CVE-2025-57292 affects Todoist v8484, with a stored cross-site scripting (XSS) flaw in the avatar upload feature. The root cause is improper MIME-type validation and insufficient sanitization of image metadata, enabling script execution through uploaded avatars. Public references from multiple so...

PT-2025-39480

Name of the Vulnerable Software and Affected Versions Widgets for Tiktok Feed plugin for WordPress versions up to and including 1.7.3 Description The Widgets for Tiktok Feed plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'trustindex-feed' shortcode. This is due to...

CVE-2025-57292

Todoist v8484 contains a stored cross-site scripting XSS vulnerability in the avatar upload functionality. The application fails to properly validate the MIME type and sanitize image metadata...

PT-2025-39479

Name of the Vulnerable Software and Affected Versions Mega Elements – Addons for Elementor plugin for WordPress versions up to and including 1.3.2 Description The software contains a Stored Cross-Site Scripting issue within the Countdown Timer widget. Insufficient input sanitization and output...

PT-2025-39516

Name of the Vulnerable Software and Affected Versions Markdown Shortcode plugin for WordPress versions prior to 0.2.2 Description The Markdown Shortcode plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'markdown' shortcode. Insufficient input sanitization and output...