Cross-site Scripting (XSS)

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Cross-site Scripting XSS through the manipulation of the Title/Body source fields. An attacker can inject malicious scripts by crafting malicious input to these fields. Details...

Cross-site Scripting (XSS)

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Cross-site Scripting XSS through the manipulation of the Navigation/Title Text/Description Source argument due to improper sanitization. Details Cross-site scripting or XSS is a code...

PT-2025-13642

Name of the Vulnerable Software and Affected Versions ConcreteCMS versions up to 9.3.9 Description A problematic issue affects the Save function of the Feature Link Block Handler component. The manipulation of the Title/Body Source/Button Text argument leads to cross-site scripting. This issue ca...

PT-2025-13637

Name of the Vulnerable Software and Affected Versions ConcreteCMS versions up to 9.3.9 Description A vulnerability has been found in the function Save of the component Accordion Block Handler. The manipulation of the argument Title/Body Source leads to cross-site scripting. The attack can be...

PT-2025-13636

Name of the Vulnerable Software and Affected Versions ConcreteCMS versions up to 9.3.9 Description A problematic issue was found in the function Save of the component FAQ Block Handler. The manipulation of the argument Navigation/Title Text/Description Source leads to cross-site scripting. It is...

PT-2025-13645

Name of the Vulnerable Software and Affected Versions ConcreteCMS versions up to 9.3.9 Description A problematic issue has been found in ConcreteCMS, affecting some unknown functionality of the component Page Attribute Display Block Handler. The manipulation of the Title argument leads to...

CVE-2025-2252 Easy Digital Downloads – eCommerce Payments and Subscriptions made easy <= 3.3.6.1 - Unauthenticated Private Post Title Disclosure

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.6.1 via the eddajaxgetdownloadtitle function. This makes it possible for unauthenticated attackers to extract...

Dolphin Pro 7.4.2 Cross Site Scripting

Dolphin Pro version 7.4.2 suffers from a persistent cross site scripting vulnerability. Exploit Title: Stored XSS via Send Message Functionality - dolphin.prov7.4.2 Date: 03/2025 Exploit Author: Andrey Stoykov Version: 7.4.2 Date: 03/2025 Tested on: Debian 12 Blog:...

PT-2025-12768 · WordPress · Easy Digital Downloads

Name of the Vulnerable Software and Affected Versions: Easy Digital Downloads – eCommerce Payments and Subscriptions plugin for WordPress versions up to, and including, 3.3.6.1 Description: The issue allows unauthenticated attackers to extract private post titles of downloads via the edd ajax get...

WordPress Easy Digital Downloads plugin <= 3.3.6.1 - Unauthenticated Private Post Title Disclosure vulnerability

Unauthenticated Private Post Title Disclosure vulnerability discovered by Françoa Taffarel in WordPress Plugin Easy Digital Downloads versions = 3.3.6.1...

CVE-2025-2623: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in westboy CicadasCMS 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /system/cms/content/save. The manipulation of the argument title/content/laiyuan leads to cross site scripting. The attack can be launch...

PT-2025-12498

Name of the Vulnerable Software and Affected Versions westboy CicadasCMS version 1.0 Description A vulnerability was found in the software, affecting an unknown functionality of the file /system/cms/content/save. The manipulation of the argument title/content/laiyuan leads to cross-site scripting...

CVE-2025-2108

The CVE CVE-2025-2108 affects the WordPress plugin “140+ Widgets | Xpro Addons For Elementor – FREE”. It is a Stored Cross-Site Scripting vulnerability in the Site Title widget via the title_tag and html_tag parameters, exploitable by authenticated users with Contributor-level access and above. A...

PT-2025-12013

Name of the Vulnerable Software and Affected Versions The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress versions up to, and including, 1.4.6.8 Description The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in the...

WordPress plugin Xpro Addons For Elementor 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2025-12328

Name of the Vulnerable Software and Affected Versions HT Mega – Absolute Addons For Elementor plugin for WordPress versions up to, and including, 2.8.3 Description The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows...

CVE-2025-2340

A vulnerability was found in otale Tale Blog 2.0.5. It has been declared as problematic. This vulnerability affects the function saveOptions of the file /options/save of the component Site Settings. The manipulation of the argument Site Title leads to cross site scripting. The attack can be...

CVE-2025-2366

A vulnerability, which was classified as problematic, was found in gougucms 4.08.18. This affects the function add of the file /admin/department/add of the component Add Department Page. The manipulation of the argument title leads to cross site scripting. It is possible to initiate the attack...

PT-2025-11456

Name of the Vulnerable Software and Affected Versions gougucms version 4.08.18 Description A problematic issue was found in the Add Department Page component, specifically affecting the add function of the /admin/department/add file. The manipulation of the title argument leads to cross-site...

CVE-2025-2366: Improper Neutralization of Input During Web Page Generation

A vulnerability, which was classified as problematic, was found in gougucms 4.08.18. This affects the function add of the file /admin/department/add of the component Add Department Page. The manipulation of the argument title leads to cross site scripting. It is possible to initiate the attack...