CVE-2025-8619 OSM Map Widget for Elementor <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button URL

The OSM Map Widget for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Map Block URL in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-8619

The CVE-2025-8619 issue concerns the WordPress OSM Map Widget for Elementor plugin. A stored cross-site scripting flaw exists in the Map Block URL handling for all versions up to 1.3.0, caused by insufficient input sanitization and output escaping of user-supplied attributes. Authenticated attack...

PT-2025-35247

Name of the Vulnerable Software and Affected Versions: O2OA versions prior to 10.0-410 Description: A cross-site scripting issue exists in O2OA’s Personal Profile Page component. The issue is related to an unknown function within the /x portal assemble designer/jaxrs/widget file. Successful...

PT-2025-35189

Name of the Vulnerable Software and Affected Versions: OSM Map Widget for Elementor plugin for WordPress versions prior to 1.3.1 Description: The OSM Map Widget for Elementor plugin for WordPress is susceptible to Stored Cross-Site Scripting through the Map Block URL due to inadequate input...

O2OA 安全漏洞

O2OA is an enterprise application development platform from O2OA Open Source. A security vulnerability exists in O2OA version 10.0-410 and earlier, which originates from cross-site scripting due to incorrect manipulation of parameters in the file /xportalassembledesigner/jaxrs/widget...

WordPress OSM Map Widget for Elementor plugin <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button URL vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Button URL vulnerability discovered by zer0gh0st in WordPress Plugin OSM Map Widget for Elementor versions = 1.3.0...

CVE-2025-53289

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jason Theme Blvd Widget Areas theme-blvd-widget-areas allows Reflected XSS.This issue affects Theme Blvd Widget Areas: from n/a through = 1.3.0...

CVE-2025-48359

Cross-Site Request Forgery CSRF vulnerability in thaihavnn07 ATT YouTube Widget att-youtube allows Stored XSS.This issue affects ATT YouTube Widget: from n/a through = 1.0...

CVE-2025-48322

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Finn Dohrn Statify Widget statify-widget allows Stored XSS.This issue affects Statify Widget: from n/a through = 1.4.6...

CVE-2025-48321

Cross-Site Request Forgery CSRF vulnerability in dyiosah Ultimate twitter profile widget ultimate-twitter-profile-widget allows Stored XSS.This issue affects Ultimate twitter profile widget: from n/a through = 1.0...

CVE-2025-48319

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in gslauraspeck Mesa Mesa Reservation Widget mesa-mesa-reservation-widget allows Stored XSS.This issue affects Mesa Mesa Reservation Widget: from n/a through = 1.0.0...

CVE-2025-53289 WordPress Theme Blvd Widget Areas Plugin <= 1.3.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jason Theme Blvd Widget Areas theme-blvd-widget-areas allows Reflected XSS.This issue affects Theme Blvd Widget Areas: from n/a through = 1.3.0...

CVE-2025-53289

CVE-2025-53289 : Reflected XSS in the WordPress plugin Theme Blvd Widget Areas (versions

CVE-2025-53289 WordPress Theme Blvd Widget Areas Plugin <= 1.3.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jason Theme Blvd Widget Areas theme-blvd-widget-areas allows Reflected XSS.This issue affects Theme Blvd Widget Areas: from n/a through = 1.3.0...

CVE-2025-48359

CVE-2025-48359 describes a CSRF to Stored XSS in the WordPress ATT YouTube Widget (versions up to and including 1.0). The root cause is CSRF protection gaps that permit stored XSS when the widget is interacted with or data is submitted, potentially enabling an attacker to inject script that is st...

CVE-2025-48359 WordPress ATT YouTube Widget plugin <= 1.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in thaihavnn07 ATT YouTube Widget att-youtube allows Stored XSS.This issue affects ATT YouTube Widget: from n/a through = 1.0...

CVE-2025-48322 WordPress Statify Widget plugin <= 1.4.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Finn Dohrn Statify Widget statify-widget allows Stored XSS.This issue affects Statify Widget: from n/a through = 1.4.6...

CVE-2025-48322 WordPress Statify Widget plugin <= 1.4.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Finn Dohrn Statify Widget statify-widget allows Stored XSS.This issue affects Statify Widget: from n/a through = 1.4.6...

CVE-2025-48322

CVE-2025-48322 – WordPress Statify Widget stored XSS Affected: Statify Widget (WordPress plugin) up to and including version 1.4.6.Root cause: Improper neutralization of input during web page generation, enabling stored XSS.Impact: Stored Cross-Site Scripting vulnerability; exact user impact depe...

CVE-2025-48321 WordPress Ultimate twitter profile widget plugin <= 1.0 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in dyiosah Ultimate twitter profile widget ultimate-twitter-profile-widget allows Stored XSS.This issue affects Ultimate twitter profile widget: from n/a through = 1.0...