WordPress Wibiya Toolbar plugin <= 2.0 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by Abdi Pranata in WordPress Plugin Wibiya Toolbar versions = 2.0...

CVE-2024-13456 Easy Quiz Maker <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Easy Quiz Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wqt-question' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

EulerOS 2.0 SP11 : subversion (EulerOS-SA-2025-1167)

According to the versions of the subversion packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Insufficient validation of filenames against control characters in Apache Subversion repositories served via moddavsvn allows authenticated...

CVE-2025-25075

Cross-Site Request Forgery CSRF vulnerability in Venugopal Show notice or message on admin area show-notice-or-message-on-admin-area allows Stored XSS.This issue affects Show notice or message on admin area: from n/a through = 2.0...

CVE-2025-25145

CVE-2025-25145 is a CSRF vulnerability in the WordPress Infusionsoft Analytics plugin (versions n/a through 2.0). The available sources in the connected docs describe the issue and impact but do not specify a fixed version or patch. CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L. Exploitation stat...

CVE-2025-25075

CVE-2025-25075 affects the WordPress plugin Show notice or message on admin area (

CVE-2025-23872

Cross-Site Request Forgery CSRF vulnerability in payform PayForm payform allows Stored XSS.This issue affects PayForm: from n/a through = 2.0...

CVE-2025-22567

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in trustist TRUSTist REVIEWer trustist-reviewer allows Reflected XSS.This issue affects TRUSTist REVIEWer: from n/a through = 2.0...

PT-2025-5838 · Phpjabbers · Phpjabbers Cinema Booking System

Name of the Vulnerable Software and Affected Versions: PHPJabbers Cinema Booking System version 2.0 Description: A cross-site request forgery CSRF vulnerability in the pjActionUpdate function allows remote attackers to escalate privileges by tricking an authenticated admin into submitting an...

CVE-2020-26218

touchbase.ai before version 2.0 is vulnerable to Cross-Site Scripting. The vulnerability allows an attacker to inject HTML payloads which could result in defacement, user redirection to a malicious webpage/website etc. The issue is patched in version 2.0...

CVE-2020-26221

touchbase.ai before version 2.0 is vulnerable to Cross-Site Scripting XSS. The vulnerability allows an attacker to send malicious JavaScript code which could result in hijacking of the user's cookie/session tokens, redirecting the user to a malicious webpage and performing unintended browser...

CVE-2024-25634

alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, an attacker can access data from other organizers. The attacker can use a specially crafted request to receive the e-mail log sent by other events. Version 2.0-M4-2402 fixes this issue...

CVE-2024-52421

Cross-Site Request Forgery CSRF vulnerability in wp-buy WP Popup Window Maker easy-popup-lightbox-maker allows Stored XSS.This issue affects WP Popup Window Maker: from n/a through = 2.0...

CVE-2024-50534

Cross-Site Request Forgery CSRF vulnerability in techdabang World Prayer Time world-prayer-time allows Stored XSS.This issue affects World Prayer Time: from n/a through = 2.0...

CVE-2024-49313

Cross-Site Request Forgery CSRF vulnerability in rudestan VKontakte Wall Post vkontakte-wall-post allows Stored XSS.This issue affects VKontakte Wall Post: from n/a through = 2.0...

CVE-2024-45300

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5, a race condition allows the user to bypass the limit on the number of promo codes and use the discount coupon multiple times. In "alf.io", an event organizer can apply...

CVE-2025-24534

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in dinamiko DPortfolio dportfolio allows Reflected XSS.This issue affects DPortfolio: from n/a through = 2.0...

IBM Analytics Content Hub 安全漏洞

IBM Analytics Content Hub is a clean streaming experience from International Business Machines IBM that visualizes relevant analytics by extracting content from IBM and other analytics providers. A security vulnerability exists in IBM Analytics Content Hub version 2.0. An attacker exploiting this...

PT-2025-2222 · WordPress · Simple Gallery With Filter

Name of the Vulnerable Software and Affected Versions: Simple Gallery with Filter plugin for WordPress versions up to, and including, 2.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'c2tw sgwf' shortcode due to insufficient input sanitization and output...

CVE-2025-22553

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in dhananjaysingh Multiple Carousel multicarousel allows SQL Injection.This issue affects Multiple Carousel: from n/a through = 2.0...