PT-2025-35189

Name of the Vulnerable Software and Affected Versions: OSM Map Widget for Elementor plugin for WordPress versions prior to 1.3.1 Description: The OSM Map Widget for Elementor plugin for WordPress is susceptible to Stored Cross-Site Scripting through the Map Block URL due to inadequate input...

O2OA 安全漏洞

O2OA is an enterprise application development platform from O2OA Open Source. A security vulnerability exists in O2OA version 10.0-410 and earlier, which originates from cross-site scripting due to incorrect manipulation of parameters in the file /xportalassembledesigner/jaxrs/widget...

WordPress OSM Map Widget for Elementor plugin <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button URL vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Button URL vulnerability discovered by zer0gh0st in WordPress Plugin OSM Map Widget for Elementor versions = 1.3.0...

CVE-2025-53289

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jason Theme Blvd Widget Areas theme-blvd-widget-areas allows Reflected XSS.This issue affects Theme Blvd Widget Areas: from n/a through = 1.3.0...

CVE-2025-48359

Cross-Site Request Forgery CSRF vulnerability in thaihavnn07 ATT YouTube Widget att-youtube allows Stored XSS.This issue affects ATT YouTube Widget: from n/a through = 1.0...

CVE-2025-48322

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Finn Dohrn Statify Widget statify-widget allows Stored XSS.This issue affects Statify Widget: from n/a through = 1.4.6...

CVE-2025-48321

Cross-Site Request Forgery CSRF vulnerability in dyiosah Ultimate twitter profile widget ultimate-twitter-profile-widget allows Stored XSS.This issue affects Ultimate twitter profile widget: from n/a through = 1.0...

CVE-2025-48319

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in gslauraspeck Mesa Mesa Reservation Widget mesa-mesa-reservation-widget allows Stored XSS.This issue affects Mesa Mesa Reservation Widget: from n/a through = 1.0.0...

CVE-2025-53289 WordPress Theme Blvd Widget Areas Plugin <= 1.3.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jason Theme Blvd Widget Areas theme-blvd-widget-areas allows Reflected XSS.This issue affects Theme Blvd Widget Areas: from n/a through = 1.3.0...

CVE-2025-53289

CVE-2025-53289 : Reflected XSS in the WordPress plugin Theme Blvd Widget Areas (versions

CVE-2025-53289 WordPress Theme Blvd Widget Areas Plugin <= 1.3.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jason Theme Blvd Widget Areas theme-blvd-widget-areas allows Reflected XSS.This issue affects Theme Blvd Widget Areas: from n/a through = 1.3.0...

CVE-2025-48359

CVE-2025-48359 describes a CSRF to Stored XSS in the WordPress ATT YouTube Widget (versions up to and including 1.0). The root cause is CSRF protection gaps that permit stored XSS when the widget is interacted with or data is submitted, potentially enabling an attacker to inject script that is st...

CVE-2025-48359 WordPress ATT YouTube Widget plugin <= 1.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in thaihavnn07 ATT YouTube Widget att-youtube allows Stored XSS.This issue affects ATT YouTube Widget: from n/a through = 1.0...

CVE-2025-48322 WordPress Statify Widget plugin <= 1.4.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Finn Dohrn Statify Widget statify-widget allows Stored XSS.This issue affects Statify Widget: from n/a through = 1.4.6...

CVE-2025-48322 WordPress Statify Widget plugin <= 1.4.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Finn Dohrn Statify Widget statify-widget allows Stored XSS.This issue affects Statify Widget: from n/a through = 1.4.6...

CVE-2025-48322

CVE-2025-48322 – WordPress Statify Widget stored XSS Affected: Statify Widget (WordPress plugin) up to and including version 1.4.6.Root cause: Improper neutralization of input during web page generation, enabling stored XSS.Impact: Stored Cross-Site Scripting vulnerability; exact user impact depe...

CVE-2025-48321 WordPress Ultimate twitter profile widget plugin <= 1.0 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in dyiosah Ultimate twitter profile widget ultimate-twitter-profile-widget allows Stored XSS.This issue affects Ultimate twitter profile widget: from n/a through = 1.0...

CVE-2025-48321

CVE-2025-48321 describes a CSRF to Stored XSS vulnerability in the WordPress plugin Ultimate Twitter Profile Widget (versions up to 1.0). Affected: Ultimate Twitter Profile Widget from n/a through 1.0. CVSS 3.1 base score 7.1 (HIGH). Root cause/impact: CSRF condition enables stored XSS via the wi...

CVE-2025-48321 WordPress Ultimate twitter profile widget plugin <= 1.0 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in dyiosah Ultimate twitter profile widget allows Stored XSS. This issue affects Ultimate twitter profile widget: from n/a through 1.0...

CVE-2025-48319

CVE-2025-48319 corresponds to a stored XSS in the WordPress plugin “Mesa Mesa Reservation Widget” (versions up to 1.0.0). The root cause is improper input neutralization during web page generation, enabling attacker-supplied payloads to persist in the widget. Reported as affecting Mesa Mesa Reser...