CVE-2025-47946 symfony/ux-live-component and symfony/ux-twig-component vulnerable to unsanitized HTML attribute injection via ComponentAttributes

Symfony UX is an initiative and set of libraries to integrate JavaScript tools into applications. Prior to version 2.25.1, rendering attributes or using any method that returns a ComponentAttributes instance e.g. only, defaults, without ouputs attribute values directly without escaping. If these...

WordPress Coupons & Add to Cart by URL Links for WooCommerce plugin <= 1.7.7 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin Coupons & Add to Cart by URL Links for WooCommerce versions = 1.7.7...

WordPress Sitewide Discount for WooCommerce: Apply Discount to All Products plugin <= 2.2.1 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin Sitewide Discount for WooCommerce: Apply Discount to All Products versions = 2.2.1...

PT-2025-21964 · Unknown · Back Button Widget

Name of the Vulnerable Software and Affected Versions: Back Button Widget versions 1.6.8 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can injec...

PT-2025-22105 · Unknown · Mojoomla Hospital Management System

Name of the Vulnerable Software and Affected Versions: mojoomla Hospital Management System versions prior to 47.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential...

PT-2025-22000 · Asmedia · Asmedia Tuaug4

Name of the Vulnerable Software and Affected Versions: Asmedia Tuaug4 versions 1.4 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to inject...

PT-2025-21884 · WordPress · Qi Blocks

Name of the Vulnerable Software and Affected Versions: Qi Blocks WordPress plugin versions prior to 1.4 Description: The issue concerns a Stored Cross-Site Scripting attack. It is caused by the Qi Blocks WordPress plugin not validating and escaping some of its Countdown block options before...

PT-2025-22005 · Unknown · Duwasai Flashy

Name of the Vulnerable Software and Affected Versions: duwasai Flashy versions 1.2.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to inject...

PT-2025-22081 · Gardener · Gardener

Name of the Vulnerable Software and Affected Versions: Gardener versions prior to 1.116.4 Gardener versions prior to 1.117.5 Gardener versions prior to 1.118.2 Gardener versions prior to 1.119.0 Description: A security issue was discovered in the gardenlet component of Gardener. This issue could...

PT-2025-21948 · Unknown · Ultimate Blocks

Name of the Vulnerable Software and Affected Versions: Ultimate Blocks versions n/a through 3.3.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for DOM-Based XSS attacks. Recommendations: For...

PT-2025-22088 · WordPress · Themegoods Grand Restaurant

Name of the Vulnerable Software and Affected Versions: ThemeGoods Grand Restaurant WordPress versions n/a through 7.0 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal'. This allows for Path Traversal in ThemeGoods...

PT-2025-22071

Name of the Vulnerable Software and Affected Versions: Mikado-Themes Foton versions n/a through 2.5.2 Description: The issue is related to improper control of filename for include/require statement in PHP program, also known as 'PHP Remote File Inclusion' vulnerability. This allows PHP Local File...

PT-2025-21885 · WordPress · Qi Blocks

Name of the Vulnerable Software and Affected Versions: Qi Blocks WordPress plugin versions prior to 1.4 Description: The issue concerns the Qi Blocks WordPress plugin, which does not properly validate and escape some of its block options before outputting them in a page or post. This could allow...

PT-2025-21981 · WordPress · Wp Job Portal

Name of the Vulnerable Software and Affected Versions: WP Job Portal versions 2.3.2 and earlier Description: The issue is related to a Missing Authorization vulnerability, allowing the exploitation of incorrectly configured access control security levels. Recommendations: For WP Job Portal versio...

PT-2025-22044 · Unknown · Name Directory

Name of the Vulnerable Software and Affected Versions: Name Directory versions 1.30.0 and earlier Description: The issue is related to a Missing Authorization vulnerability. This vulnerability affects the Name Directory, allowing unauthorized access. Recommendations: For versions 1.30.0 and...

PT-2025-22093 · Project · Project

Name of the Vulnerable Software and Affected Versions: wProject versions prior to 5.8.0 Description: The issue is related to a Missing Authorization vulnerability. This means that there is a lack of proper authorization checks, potentially allowing unauthorized access to certain features or data...

PT-2025-21979 · WordPress · Wpadverts

Name of the Vulnerable Software and Affected Versions: WPAdverts versions through 2.2.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows DOM-Based XSS. This enables potential attackers to inject...

PT-2025-22077 · WordPress · Wordpress Video Robot - The Ultimate Video Importer

Name of the Vulnerable Software and Affected Versions: WordPress Video Robot - The Ultimate Video Importer versions 1.20.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for malicious...

PT-2025-22092 · Potenzaglobalsolutions · Ciyashop

Name of the Vulnerable Software and Affected Versions: Potenzaglobalsolutions CiyaShop versions n/a through 4.18.0 Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. Recommendations: For versions n/a through 4.18.0, update to a version later tha...

PT-2025-21982 · Unknown · Visual Composer Website Builder

Name of the Vulnerable Software and Affected Versions: Visual Composer Website Builder versions through 45.11.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS in Visual Composer Website...