PT-2025-14428 · Unknown · Vimal Kava Ai Search Bar

Name of the Vulnerable Software and Affected Versions: Vimal Kava AI Search Bar versions n/a through 1.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS in the AI Search Bar...

PT-2025-13710 · Unknown · Wphocus My Auctions Allegro

Name of the Vulnerable Software and Affected Versions: wphocus My auctions allegro versions 3.6.20 and earlier Description: The issue is related to an SQL Injection vulnerability, specifically a Blind SQL Injection, which affects the wphocus My auctions allegro software. This type of vulnerabilit...

PT-2025-5496 · WordPress · Custom Wp Store Locator

Name of the Vulnerable Software and Affected Versions: Custom WP Store Locator versions 1.4.7 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for reflected Cross-site Scripting XSS. This enables attackers to inject malicio...

PT-2025-4411 · Hasthemes · Hash Elements

Name of the Vulnerable Software and Affected Versions: HashThemes Hash Elements versions 1.4.9 and earlier Description: The issue is related to improper neutralization of input during web page generation, which can lead to Cross-site Scripting. This allows attackers to inject malicious scripts in...

PT-2024-35853 · Elementor · Elementor Image Gallery Plugin

Name of the Vulnerable Software and Affected Versions: Elementor Image Gallery Plugin versions 1.0.3 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored Cross-site Scripting XSS. This means an attacker can inject...

PT-2024-35852 · Flickdevs · Flickdevs Countdown Timer For Elementor

Name of the Vulnerable Software and Affected Versions: FlickDevs Countdown Timer for Elementor versions 1.3.6 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows stored Cross-site Scripting XSS. This enables attackers to injec...

PT-2024-9340 · Drupal · Drupal Core

Name of the Vulnerable Software and Affected Versions: Drupal Core versions 7.0 through 7.101 Description: The issue affects Drupal Core, allowing Cross-Site Scripting XSS due to improper neutralization of input during web page generation. This enables an attacker to conduct a cross-site scriptin...

PT-2024-32573 · Leevio · Leevio Happy Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Leevio Happy Addons for Elementor versions prior to 3.12.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks...

PT-2024-32596 · Unknown · Wpcom Member

Name of the Vulnerable Software and Affected Versions: WPCOM Member versions 1.5.4 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows Reflected XSS. Recommendations: For versions 1.5.4 a...

PT-2024-26707 · Unknown · Templatesnext Onepager

Name of the Vulnerable Software and Affected Versions: TemplatesNext OnePager versions 1.3.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS in TemplatesNext OnePager...

PT-2024-25399 · Accessally · Popupally

Name of the Vulnerable Software and Affected Versions: PopupAlly versions n/a through 2.1.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Stored XSS in AccessAlly PopupAlly. Recommendations: For...

PT-2024-23050 · Woocommerce · Venipak For Woocommerce

Name of the Vulnerable Software and Affected Versions: Shipping with Venipak for WooCommerce versions 1.19.5 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables...

PT-2024-23057 · Softlab · Softlab Radio Player

Name of the Vulnerable Software and Affected Versions: SoftLab Radio Player versions 2.0.73 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This means that an attacker can inject...

PT-2024-22193 · Repute Infosystems · Armember

Name of the Vulnerable Software and Affected Versions: Repute Infosystems ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup versions through 4.0.23 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also kno...

PT-2024-18471 · WordPress · Simple Ajax Chat

Name of the Vulnerable Software and Affected Versions: The Simple Ajax Chat WordPress plugin versions prior to 20240223 Description: The issue concerns the reflection of unsanitized input to other users, specifically when visitors use malicious names in the chat. This allows for potential malicio...

PT-2023-28732 · Cockpit · Cockpit

Name of the Vulnerable Software and Affected Versions: cockpit versions prior to 2.4.3 Description: The issue is related to Cross-site Scripting XSS - Stored in the GitHub repository cockpit-hq/cockpit. This type of attack occurs when an application stores user input and later displays it without...

PT-2023-25597 · Cththemes · Cththemes Balkon

Name of the Vulnerable Software and Affected Versions: cththemes Balkon plugin versions 1.3.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for malicious scripts to be injected into web...

PT-2023-25811 · Unknown · Kodexplorer

Name of the Vulnerable Software and Affected Versions: KodExplorer version 4.51 Description: The issue concerns a Cross-Site Scripting XSS vulnerability located in the Description box of the Light App creation feature. An attacker can exploit this by injecting XSS syntax into the Description fiel...

PT-2023-25203 · Outline · Outline

Name of the Vulnerable Software and Affected Versions: outline/outline versions prior to 0.70.1 Description: The issue is related to Cross-site Scripting XSS - Stored, which occurs when an application stores user input and later displays it without proper validation or escaping, allowing an...

Any file can be included with the pymdown-snippets extension

Summary Arbitrary file read when using include file syntax. Details By using the syntax --8--"/etc/passwd" or --8--"/proc/self/environ" the content of these files will be rendered in the generated documentation. Additionally, a path relative to a specified, allowed base path can also be used to...