PT-2025-1734 · WordPress · The Prime Slider – Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Prime Slider – Addons For Elementor plugin for WordPress versions up to, and including, 3.16.5 Description: The issue concerns a Stored Cross-Site Scripting vulnerability. It is caused by insufficient input sanitization and output escaping,...

CVE-2025-23809

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Sunil Nanda Blue Wrench Video Widget blue-wrench-videos-widget allows Reflected XSS.This issue affects Blue Wrench Video Widget: from n/a through = 2.1.0...

CVE-2025-23809

CVE-2025-23809 describes a Reflected XSS in the NotFound Blue Wrench Video Widget (affecting Blue Wrench Video Widget: from n/a through 2.1.0). The vulnerability arises from improper neutralization of input during web page generation. CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L with bas...

Cross-site Scripting (XSS)

Overview prestashop/pscontactinfo is a package for displaying additional information about your store's customer service. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the getWidgetVariables function, due to the use of the nofilter tag, which allows malicious...

CVE-2025-23809: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Sunil Nanda Blue Wrench Video Widget blue-wrench-videos-widget allows Reflected XSS.This issue affects Blue Wrench Video Widget: from n/a through = 2.1.0...

WordPress plugin Blue Wrench Video Widget has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2023-45908

Homarr before v0.14.0 was discovered to contain a stored cross-site scripting XSS vulnerability via the Notebook widget...

CVE-2025-22722

Missing Authorization vulnerability in Marketing Fire Widget Options widget-options allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Widget Options: from n/a through = 4.0.8...

CVE-2025-22722 WordPress Widget Options plugin <= 4.0.8 - Broken Access Control to Notice Dimissal vulnerability

Missing Authorization vulnerability in Marketing Fire Widget Options widget-options allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Widget Options: from n/a through = 4.0.8...

CVE-2025-22722 WordPress Widget Options plugin <= 4.0.8 - Broken Access Control to Notice Dimissal vulnerability

Missing Authorization vulnerability in Marketing Fire Widget Options widget-options allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Widget Options: from n/a through = 4.0.8...

CVE-2025-22722

Technical details about CVE-2025-22722 are not provided in the connected documents. The initial entry notes a Missing Authorization issue in Widget Options plugin versions up to 4.0.8, but no technical specifics or affected product/version data are disclosed here. Monitor for updates.

PT-2025-3857 · WordPress · Jetelements

Name of the Vulnerable Software and Affected Versions: JetElements plugin for WordPress versions up to, and including, 2.7.2.1 Description: The JetElements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets due to insufficient input sanitization and output...

CVE-2023-45908

Homarr before v0.14.0 was discovered to contain a stored cross-site scripting XSS vulnerability via the Notebook widget...

PT-2025-1498 · Homarr · Homarr

Name of the Vulnerable Software and Affected Versions: Homarr versions prior to 0.14.0 Description: The issue is related to a stored cross-site scripting XSS vulnerability. This vulnerability can be exploited via the Notebook widget. Recommendations: For versions prior to 0.14.0, update to versio...

PT-2025-4649

Name of the Vulnerable Software and Affected Versions Widget Options versions n/a through 4.0.8 Description The issue is related to a Missing Authorization vulnerability in Widget Options Team Widget Options, which allows exploiting incorrectly configured access control security levels...

WordPress plugin Widget Options has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2023-45908

The Homarr customizable browser homepage (versions prior to v0.14.0 ) is vulnerable to a stored cross-site scripting (XSS) vulnerability. The flaw exists within the Notebook widget , where improper neutralization of input during web page generation allows for malicious script execution. To remedi...

CVE-2023-45908: Improper Neutralization of Input During Web Page Generation

Homarr before v0.14.0 was discovered to contain a stored cross-site scripting XSS vulnerability via the Notebook widget...

CVE-2025-22722: Missing Authorization

Missing Authorization vulnerability in Marketing Fire Widget Options widget-options allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Widget Options: from n/a through = 4.0.8...

Homarr cross-site scripting vulnerabilities

homarr is a customizable browser homepage by Thomas Camlong, an individual developer, that is used to interact with Docker containers on the main server. A security vulnerability exists in homarr versions prior to v0.14.0 that stems from the inclusion of a stored cross-site scripting XSS...