WordPress Twitter Post plugin <= 0.1 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by SOPROBRO in WordPress Plugin Twitter Post versions = 0.1...

WordPress Rename Author Slug plugin <= 1.2.0 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by SOPROBRO in WordPress Plugin Rename Author Slug versions = 1.2.0...

WordPress Simple Project Manager plugin <= 1.2.2 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

CSRF to Stored Cross Site Scripting XSS vulnerability discovered by SOPROBRO in WordPress Plugin Simple Project Manager versions = 1.2.2...

WordPress Easy Tynt plugin <= 0.2.5.1 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

CSRF to Stored Cross Site Scripting XSS vulnerability discovered by SOPROBRO in WordPress Plugin Easy Tynt versions = 0.2.5.1...

PT-2025-4900 · Niklas Olsson · Universal Analytics Injector

Name of the Vulnerable Software and Affected Versions: Niklas Olsson Universal Analytics Injector versions 1.0.3 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can perform actions on behalf of a user without the...

PT-2025-4999 · Unknown · Kreg Steppe Auphonic Importer

Name of the Vulnerable Software and Affected Versions: Kreg Steppe Auphonic Importer versions 1.5.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

PT-2025-4945 · Unknown · Shortcode In Comment

Name of the Vulnerable Software and Affected Versions: Shortcode in Comment versions prior to 1.1.1 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

PT-2025-4977 · Unknown · Andrea Brandi Twitter Shortcode

Name of the Vulnerable Software and Affected Versions: Andrea Brandi Twitter Shortcode versions 0.9 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions o...

PT-2025-4896 · Unknown · Ect Add To Cart Button

Name of the Vulnerable Software and Affected Versions: ECT Add to Cart Button versions 1.4 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

PT-2025-4888 · WordPress · Wp Vtiger Synchronization

Name of the Vulnerable Software and Affected Versions: WP VTiger Synchronization versions 1.1.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

PT-2025-5033 · WordPress · Wp Custom Google Search

Name of the Vulnerable Software and Affected Versions: WP Custom Google Search versions n/a through 1.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application...

PT-2025-5228 · Unknown · Divengine Gallery

Name of the Vulnerable Software and Affected Versions: DivEngine Gallery: Hybrid – Advanced Visual Gallery versions 1.4.0.2 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows stored Cross-site Scripting XSS. This means an...

PT-2025-5026 · Unknown · Send To Twitter

Name of the Vulnerable Software and Affected Versions: Send to Twitter versions 1.7.2 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

Fortinet FortiSOAR 跨站脚本漏洞

Fortinet FortiSOAR is a Security Orchestration, Automation and Response SOAR solution from Fortinet, Inc. A cross-site scripting vulnerability exists in Fortinet FortiSOAR that stems from improper input invalidation during web page generation. An authenticated attacker can exploit this...

SAP NetWeaver AS 代码问题漏洞

SAP NetWeaver AS is an SAP web application server from SAP, Germany. It not only provides web services, but is also the basic platform for SAP software. A code issue vulnerability exists in SAP NetWeaver AS, which stems from susceptibility to a stored cross-site scripting attack that allows an...

PT-2025-1877 · WordPress · 3Dvieweronline

Name of the Vulnerable Software and Affected Versions: 3DVieweronline plugin for WordPress versions up to, and including, 2.2.2 Description: The issue is related to Stored Cross-Site Scripting via the plugin's '3Dvo-model' shortcode due to insufficient input sanitization and output escaping on...

WordPress plugin Easy Form Builder 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...

CVE-2024-12495

CVE-2024-12495 – Bootstrap Blocks for WP Editor (WordPress) Stored XSS Affected product: Bootstrap Blocks for WP Editor plugin, WordPress. Vulnerability type: Stored Cross-Site Scripting in the gtb-bootstrap/column block due to insufficient input sanitization and output escaping. Root cause: lack...

CVE-2024-10102

The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.22 does not sanitise and escape some of its Gallery settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks...

CVE-2024-12464

CVE-2024-12464 (Chatroll Live Chat) is a stored XSS in the Chatroll Live Chat WordPress plugin for versions up to and including 2.5.0, due to insufficient input sanitization and output escaping on shortcode attributes. Exploitation requires authenticated access at contributor level or higher, and...