CVE-2023-45908

The Homarr customizable browser homepage (versions prior to v0.14.0 ) is vulnerable to a stored cross-site scripting (XSS) vulnerability. The flaw exists within the Notebook widget , where improper neutralization of input during web page generation allows for malicious script execution. To remedi...

Homarr cross-site scripting vulnerabilities

homarr is a customizable browser homepage by Thomas Camlong, an individual developer, that is used to interact with Docker containers on the main server. A security vulnerability exists in homarr versions prior to v0.14.0 that stems from the inclusion of a stored cross-site scripting XSS...

CVE-2023-45908

Homarr before v0.14.0 was discovered to contain a stored cross-site scripting XSS vulnerability via the Notebook widget...

CVE-2023-45908

Homarr before v0.14.0 was discovered to contain a stored cross-site scripting XSS vulnerability via the Notebook widget...

CVE-2024-12203 RSS Icon Widget <= 5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting

The RSS Icon Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘linkcolor’ parameter in all versions up to, and including, 5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2024-12203 RSS Icon Widget <= 5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting

The RSS Icon Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘linkcolor’ parameter in all versions up to, and including, 5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2024-12203: Improper Neutralization of Input During Web Page Generation

The RSS Icon Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘linkcolor’ parameter in all versions up to, and including, 5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

WordPress Plugin RSS Icon Widget Cross-Site Script Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-1776

Name of the Vulnerable Software and Affected Versions RSS Icon Widget plugin for WordPress versions up to, and including, 5.2 Description The issue is related to Stored Cross-Site Scripting via the link color parameter due to insufficient input sanitization and output escaping. This allows...

CVE-2025-23941

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in meinturnierplan MeinTurnierplan.de Widget Viewer meinturnierplande-widget-viewer allows Stored XSS.This issue affects MeinTurnierplan.de Widget Viewer: from n/a through = 1.1...

CVE-2025-23844

Cross-Site Request Forgery CSRF vulnerability in Jamsheer K Custom Widget Classes custom-widget-classes allows Cross Site Request Forgery.This issue affects Custom Widget Classes: from n/a through = 1.1...

CVE-2025-23783

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in carrotbits Greek Namedays Widget From Eortologio.Net greek-namedays-widget allows Stored XSS.This issue affects Greek Namedays Widget From Eortologio.Net: from n/a through = 20191113...

CVE-2025-23532

Cross-Site Request Forgery CSRF vulnerability in Regios MyAnime Widget myanime-widget allows Privilege Escalation.This issue affects MyAnime Widget: from n/a through = 1.0...

CVE-2025-23941

CVE-2025-23941 details (connected RH/CVE and EUVD sources): Stored XSS in MeinTurnierplan.de Widget Viewer due to improper input neutralization during web page generation. Affected software: MeinTurnierplan.de Widget Viewer (versions up to 1.1). The issue is described as cross-site scripting with...

CVE-2025-23844

CVE-2025-23844 is a Cross-Site Request Forgery (CSRF) vulnerability affecting wellwisher Custom Widget Classes (Custom Widget Classes) with affected versions up to 1.1. The entry lists a CVSS v3.1 base score of 7.1 (HIGH) and notes that the issue is a CSRF, but the connected Red Hat entry does no...

CVE-2025-23844 WordPress Custom Widget Classes plugin <= 1.1 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Jamsheer K Custom Widget Classes custom-widget-classes allows Cross Site Request Forgery.This issue affects Custom Widget Classes: from n/a through = 1.1...

CVE-2025-23844 WordPress Custom Widget Classes plugin <= 1.1 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Jamsheer K Custom Widget Classes custom-widget-classes allows Cross Site Request Forgery.This issue affects Custom Widget Classes: from n/a through = 1.1...

CVE-2025-23783

CVE-2025-23783: Stored XSS in Greek Namedays Widget From Eortologio.Net (WordPress plugin). Root cause: Improper neutralization of input during web page generation. Affected: Greek Namedays Widget From Eortologio.Net (likely pre-2019-11-13). Impact per posted metrics: potential client-side script...

CVE-2025-23783 WordPress Greek Namedays Widget Plugin <= 20191113 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in carrotbits Greek Namedays Widget From Eortologio.Net greek-namedays-widget allows Stored XSS.This issue affects Greek Namedays Widget From Eortologio.Net: from n/a through = 20191113...

CVE-2025-23783 WordPress Greek Namedays Widget Plugin <= 20191113 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in carrotbits Greek Namedays Widget From Eortologio.Net greek-namedays-widget allows Stored XSS.This issue affects Greek Namedays Widget From Eortologio.Net: from n/a through = 20191113...