CVE-2025-40627

Reflected Cross-Site Scripting XSS vulnerability in AbanteCart v1.4.0, that could allow an attacker to execute JavaScript code in a victim's browser by sending the victim a malicious URL. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform...

CVE-2025-40627

CVE-2025-40627 affects AbanteCart v1.4.0. It describes a Reflected Cross‑Site Scripting (XSS) vulnerability in the /eyes? endpoint that lets an attacker deliver JavaScript to a victim’s browser, potentially stealing session cookies or acting on behalf of the user. The vulnerability is documented ...

PT-2025-13153

Name of the Vulnerable Software and Affected Versions SecuPress Free versions 2.2.5.3 and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. Specifically, it is a DOM-Based XSS vulnerability. This means that...

PT-2024-30258

Name of the Vulnerable Software and Affected Versions RWS MultiTrans versions 7.0.23324.2 and earlier Description The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload, due to multiple stored cross-site scripting XSS vulnerabilities. This enables attackers to...

PT-2024-28011

Name of the Vulnerable Software and Affected Versions ExpressionEngine versions prior to 7.4.11 Description The issue allows for cross-site scripting XSS, which is a type of attack where an attacker can inject malicious scripts into a website, potentially allowing them to steal user data or take...

PT-2024-24520

Name of the Vulnerable Software and Affected Versions WonderCMS version 3.4.3 Description Multiple cross-site scripting XSS vulnerabilities in the Home page of WonderCMS allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into any of the parameters. This issue...

PT-2023-31590

Name of the Vulnerable Software and Affected Versions EyouCMS version 1.6.5-UTF8-SP1 Description A stored cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Public Security Registration Number parameter. This enables...

PT-2023-23678

Name of the Vulnerable Software and Affected Versions Booking Ultra Pro Appointments Booking Calendar Plugin versions 1.1.8 and earlier Description The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a...

PT-2023-23031

Name of the Vulnerable Software and Affected Versions Maxim Glazunov XML for Google Merchant Center plugin versions = 3.0.1 Description The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially...

PT-2023-23026

Name of the Vulnerable Software and Affected Versions PT Woo Plugins by Webdados Stock Exporter for WooCommerce plugin versions 1.1.0 and earlier Description The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into the...

PT-2023-22725

Name of the Vulnerable Software and Affected Versions I Thirteen Web Solution Email Subscription Popup plugin versions 1.2.16 and earlier Description The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website,...

PT-2023-26781

Name of the Vulnerable Software and Affected Versions WebBoss.io CMS version 3.7.0.1 Description The issue is related to a stored cross-site scripting XSS vulnerability. This means that an attacker can inject malicious scripts into the website, which are then stored and executed by the website,...

PT-2023-22588

Name of the Vulnerable Software and Affected Versions mkucej/i-librarian-free versions prior to 5.10.4 Description The issue is related to Cross-site Scripting XSS - Stored. This means that an attacker can inject malicious scripts into the application, which are then stored and executed by the...

PT-2023-19290

Name of the Vulnerable Software and Affected Versions YIKES, Inc. Easy Forms for Mailchimp plugin versions = 6.8.8 Description The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowing th...

PT-2023-18646

Name of the Vulnerable Software and Affected Versions Webcodin WCP Contact Form plugin versions prior to 3.1.0 Description The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into the website, potentially...

PT-2023-15317

Name of the Vulnerable Software and Affected Versions Charitable Donations & Fundraising Team Donation Forms by Charitable plugin versions = 1.7.0.10 Description The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into...

PT-2023-15307

Name of the Vulnerable Software and Affected Versions Tussendoor internet & marketing Open RDW kenteken voertuiginformatie plugin versions = 2.0.14 Description The issue is a Reflected Cross-Site Scripting XSS vulnerability. This means an attacker can inject malicious scripts into a website,...

PT-2023-14637

Name of the Vulnerable Software and Affected Versions Vsourz Digital Advanced Contact form 7 DB versions 1.7.2 through 1.9.1 Description The issue is related to Cross Site Scripting XSS, which is a type of attack where an attacker injects malicious scripts into a website, allowing them to steal...

PT-2023-16532

Name of the Vulnerable Software and Affected Versions thorsten/phpmyfaq versions prior to 3.1.11 Description The issue is related to Cross-site Scripting XSS - Stored. This type of attack occurs when an application stores user input that contains malicious scripts, which are then executed by the...

PT-2022-16811

Name of the Vulnerable Software and Affected Versions microweber/microweber versions prior to 1.2.21 Description The issue is related to Cross-site Scripting XSS - Reflected. This means an attacker can inject malicious scripts into a website, potentially allowing them to steal user data or take...