CVE-2025-41056

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataAddonlayouts' and 'dataAddonlayoutsexcept' parameters in /apprain/developer/addons/update/hysontable...

CVE-2025-41051

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataAddonlayouts' and 'dataAddonlayoutsexcept' parameters in /apprain/developer/addons/update/bootstrap...

PT-2025-35910

Name of the Vulnerable Software and Affected Versions: appRain CMF version 4.0.5 Description: A stored authenticated cross-site scripting XSS issue exists due to insufficient validation of user-supplied input. The vulnerability is present in the following parameters within the...

CVE-2025-58596 WordPress MailOptin Plugin <= 1.2.75.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in properfraction MailOptin mailoptin allows Stored XSS.This issue affects MailOptin: from n/a through = 1.2.75.0...

CVE-2025-9378 Vayu Blocks <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Block Attributes

The Vayu Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple attributes in the Lottie block in all versions up to, and including, 1.3.9 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-56761

Memos 0.22 is vulnerable to Stored Cross site scripting XSS vulnerabilities by the upload attachment and user avatar features. Memos does not verify the content type of the uploaded data and serve it back as is. An authenticated attacker can use this to elevate their privileges when the stored XS...

CVE-2025-8150

The Events Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Typewriter and Countdown widgets in all versions up to, and including, 2.2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2025-48304

Cross-Site Request Forgery CSRF vulnerability in Gary Illyes Google XML News Sitemap plugin gn-xml-sitemap allows Stored XSS.This issue affects Google XML News Sitemap plugin: from n/a through = 0.02...

CVE-2025-8619

The CVE-2025-8619 issue concerns the WordPress OSM Map Widget for Elementor plugin. A stored cross-site scripting flaw exists in the Map Block URL handling for all versions up to 1.3.0, caused by insufficient input sanitization and output escaping of user-supplied attributes. Authenticated attack...

CVE-2025-8290

CVE-2025-8290 affects the WordPress plugin List Sub Pages (List Subpages) up to version 1.0.6. The vulnerability is a Stored Cross-Site Scripting flaw in the title parameter caused by insufficient input sanitization and output escaping, allowing authenticated attackers with at least Contributor-l...

CVE-2025-48325

Cross-Site Request Forgery CSRF vulnerability in shmish111 WP Admin Theme wp-admin-theme allows Stored XSS.This issue affects WP Admin Theme: from n/a through = 1.0...

CVE-2025-48309

Cross-Site Request Forgery CSRF vulnerability in web-able BetPress betpress allows Stored XSS.This issue affects BetPress: from n/a through = 1.0.1 Lite...

CVE-2025-48354 WordPress Better Post & Filter Widgets for Elementor plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Smart Widgets Better Post & Filter Widgets for Elementor allows Stored XSS. This issue affects Better Post & Filter Widgets for Elementor: from n/a through 1.6.0...

CVE-2025-48343 WordPress WPMU Ldap Authentication plugin <= 5.0.1 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Aaron Axelsen WPMU Ldap Authentication wpmuldap allows Stored XSS.This issue affects WPMU Ldap Authentication: from n/a through = 5.0.1...

CVE-2025-48320

CVE-2025-48320 describes a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin 百度分享按钮 (WordPress Baidu Share Button) that enables stored XSS. The issue affects the plugin versions from at least the earliest public disclosure up to version 1.0.6 . The CVE notes the vulnerabilit...

CVE-2025-48311 WordPress Invisible Optin plugin <= 1.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in OffClicks Invisible Optin invisible-optin allows Stored XSS.This issue affects Invisible Optin: from n/a through = 1.0...

CVE-2025-48311 WordPress Invisible Optin plugin <= 1.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in OffClicks Invisible Optin invisible-optin allows Stored XSS.This issue affects Invisible Optin: from n/a through = 1.0...

CVE-2025-48309 WordPress BetPress plugin <= 1.0.1 Lite - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in web-able BetPress allows Stored XSS. This issue affects BetPress: from n/a through 1.0.1 Lite...

CVE-2025-48308 WordPress Newsletter subscription optin module plugin <= 1.2.9 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in nonletter Newsletter subscription optin module newsletter-subscription-widget-for-sendblaster allows Stored XSS.This issue affects Newsletter subscription optin module: from n/a through = 1.2.9...

CVE-2025-48309 WordPress BetPress plugin <= 1.0.1 Lite - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in web-able BetPress betpress allows Stored XSS.This issue affects BetPress: from n/a through = 1.0.1 Lite...