PT-2025-16960 · Liferay · Liferay Dxp +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.2.0 through 7.4.3.129 Liferay DXP versions 2024.Q4.1 through 2024.Q4.7 Liferay DXP versions 2024.Q3.1 through 2024.Q3.9 Liferay DXP versions 2024.Q2.0 through 2024.Q2.13 Liferay DXP versions 2024.Q1.1 through...

PT-2025-17084 · WordPress · Websitedefender Wp Secure

Name of the Vulnerable Software and Affected Versions: WebsiteDefender wp secure versions 1.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

CVE-2025-2161

Pega Platform versions 7.2.1 to Infinity 24.2.1 are affected by an XSS issue with Mashup...

CVE-2025-2160

Pega Platform versions 8.4.3 to Infinity 24.2.1 are affected by an XSS issue with Mashup...

CVE-2025-2161

Pega Platform versions 7.2.1 to Infinity 24.2.1 are affected by an XSS issue with Mashup...

CVE-2025-2160

Pega Platform versions 8.4.3 to Infinity 24.2.1 are affected by an XSS issue with Mashup...

CVE-2025-2161

Pega Platform versions 7.2.1 to Infinity 24.2.1 are affected by an XSS issue with Mashup...

CVE-2025-2161

Pega Platform versions 7.2.1 to Infinity 24.2.1 are affected by an XSS issue with Mashup...

CVE-2025-2160

Pega Platform versions 8.4.3 to Infinity 24.2.1 are affected by an XSS issue with Mashup...

CVE-2025-2160

Pega Platform versions 8.4.3 to Infinity 24.2.1 are affected by an XSS issue with Mashup...

CVE-2025-2160

Pega Platform versions 8.4.3 through Infinity 24.2.1 are affected by a Mashup-related XSS vulnerability (CVE-2025-2160). The issue arises from improper neutralization of input during web page generation, enabling cross-site scripting. Affected component: Mashup functionality within Pega Platform;...

PT-2025-16243 · Pegasystems · Pega Platform

Name of the Vulnerable Software and Affected Versions: Pega Platform versions 8.4.3 through Infinity 24.2.1 Description: The issue is related to an XSS problem with Mashup, which is caused by improper neutralization of input during web page generation, also known as cross-site scripting. This is...

CVE-2025-31032 WordPress Pagopar – WooCommerce Gateway plugin <= 2.7.1 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Pagopar - Grupo M S.A. Pagopar – WooCommerce Gateway pagopar-woocommerce-gateway allows Stored XSS.This issue affects Pagopar – WooCommerce Gateway: from n/a through = 2.7.1...

PT-2025-15792 · Woocommerce · Chillpay Woocommerce

Name of the Vulnerable Software and Affected Versions: ChillPay WooCommerce versions through 2.5.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This enables potential attackers to inject...

BIT-JOOMLA-2023-23754 [20230501] - Core - Open Redirect and XSS within the mfa select

An issue was discovered in Joomla! 4.2.0 through 4.3.1. Lack of input validation caused an open redirect and XSS issue within the new mfa selection screen...

Gitlab -- Vulnerabilities

Gitlab reports: Cross-site Scripting XSS through merge-request error messages Cross-site Scripting XSS through improper rendering of certain file types Admin Privileges Persists After Role is Revoked External user can access internal projects Prompt injection in Amazon Q integration may allow...

CVE-2025-30342

An XSS issue was discovered in OpenSlides before 4.2.5. When submitting descriptions such as Moderator Notes or Agenda Topics, an editor is shown that allows one to format the submitted text. This allows insertion of various HTML elements. When trying to insert a SCRIPT element, it is properly...

PT-2025-11189 · Modx · Modx

Name of the Vulnerable Software and Affected Versions: MODX versions prior to 3.1.0 Description: A cross-site scripting XSS issue has been identified. The issue allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets executed in victims'...

CVE-2025-27825

An XSS issue was discovered in the Bootstrap 5 Lite theme before 1.x-1.0.3 for Backdrop CMS. It doesn't sufficiently sanitize certain class names...

CVE-2025-27824

An XSS issue was discovered in the Link iframe formatter module before 1.x-1.1.1 for Backdrop CMS. It doesn't sufficiently sanitize input before displaying results to the screen. This vulnerability is mitigated by the fact that an attacker must have the ability to create content containing an...