AhnLab EPP 1.0.15 is vulnerable to SQL Injection via the "preview parameter.". Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Path traversal in Apache Tomcat versions 9.x through 11.x allows authenticated attackers to bypass security constraints protecting /WEB-INF/ and /META-INF/ directories when URL rewriting rules manipulate query parameters. Successful exploitation combined with enabled PUT requests enables remote code execution through malicious file upload. Apache Security Team confirms publicly available exploit code exists. The vulnerability stems from a regression in the fix for bug 60013, where URL normalization occurs before decoding, creating an exploitable window in specific rewrite configurations.
Buffer overflow in Tenda CH22 router firmware 1.0.0.1 allows authenticated attackers on the adjacent network to execute arbitrary code with high impact to confidentiality, integrity, and availability. The vulnerability exists in the fromSetIpBind function accessible via /goform/SetIpBind endpoint when processing the 'page' parameter. A public proof-of-concept exploit has been published on GitHub, lowering the barrier to exploitation, though no active exploitation has been confirmed by CISA KEV at time of analysis.
ANSI escape sequence injection in Apache Tomcat log messages enables console manipulation and social engineering attacks against administrators on Windows systems. Attackers can craft malicious URLs that inject escape sequences into Tomcat logs, potentially manipulating console output and clipboard contents to trick administrators into executing attacker-controlled commands. This affects Tomcat 9.0.40-9.0.108, 10.1.0-M1-10.1.44, and 11.0.0-M1-11.0.10, with highest risk when Tomcat runs in ANSI-capable Windows consoles. Despite the 9.6 CVSS score, real-world risk is lower as exploitation requires user interaction (administrator viewing logs in console), scope change indicating console compromise beyond Tomcat process, and specific Windows deployment configuration. No active exploitation confirmed (not in CISA KEV), and EPSS data not available at time of analysis.
Unrestricted file upload in code-projects Simple Food Ordering System 1.0 allows remote attackers to upload arbitrary files through the photo parameter of /editproduct.php, exploiting improper access control (CWE-284) that effectively bypasses authentication on the upload endpoint. The Authentication Bypass tag alongside CWE-284 signals that the product-editing endpoint - which should be access-controlled - can be reached without valid credentials, enabling file placement on the server. A public proof-of-concept is disclosed on GitHub; EPSS sits at 0.06% (17th percentile), indicating minimal observed exploitation at time of analysis, and this CVE does not appear in the CISA KEV catalog.
SQL injection in AMTT Hotel Broadband Operation System (HiBOS) 1.0 exposes hotel network management infrastructure to unauthenticated remote attackers via the `uid` parameter in `/user/portal/get_expiredtime.php`. An attacker with network access to the management portal can manipulate the parameter to read, modify, or partially disrupt the underlying database without any credentials. A public proof-of-concept exploit has been disclosed on GitHub; the vendor did not respond to coordinated disclosure, and no patch has been released.
SQL injection in projectworlds Advanced Library Management System 1.0 exposes the application's database through the unsanitized `keywords` parameter on `/index.php`, exploitable by any unauthenticated remote attacker. The CVSS 4.0 score is 5.5 (Medium), with low-level confidentiality, integrity, and availability impact against the vulnerable system and no scope change to subsequent systems. A public proof-of-concept exploit exists (E:P in the provided vector), though EPSS sits at just 0.03% (9th percentile), consistent with the highly niche deployment footprint of this product; no public exploit identified at time of analysis for widespread campaigns.
SQL injection in projectworlds Online Shopping System 1.0 exposes database contents to unauthenticated remote attackers via the `keywords` parameter in `/login_submit.php`. The attack requires no credentials, no user interaction, and carries low access complexity, making it trivially scriptable against any exposed instance. Publicly available exploit code exists per a GitHub proof-of-concept, though the EPSS score of 0.03% (9th percentile) reflects the product's limited real-world deployment footprint; no confirmed active exploitation (CISA KEV) has been observed at time of analysis.
SQL injection in SourceCodester Online Student Result System 1.0 exposes remote unauthenticated attackers a direct path to manipulate backend database queries via the unsanitized `id` parameter in `/view_result.php`. Successful exploitation can yield unauthorized access to student result records, partial data modification, and limited availability disruption. A public proof-of-concept exploit exists (referenced via GitHub), though EPSS at 0.03% (8th percentile) signals negligible observed exploitation activity, consistent with the product's narrow educational/demo deployment footprint rather than any technical barrier to exploitation.
SQL injection in SourceCodester Best Salon Management System 1.0 exposes unauthenticated remote attackers to database manipulation via the `email` parameter in the `/panel/forgot-password.php` password recovery endpoint. A public proof-of-concept exploit has been disclosed, though EPSS at 0.03% (8th percentile) and absence from CISA KEV indicate very low observed real-world exploitation. Impact is partial across confidentiality, integrity, and availability per the CVSS 4.0 scoring, consistent with a restricted database account context rather than full system compromise.
SQL injection in code-projects Courier Management System 1.0 exposes the /courier/edit-courier.php endpoint to unauthenticated remote attackers who can manipulate the OfficeName parameter to execute arbitrary SQL against the backend database. A publicly available exploit exists on GitHub (PoC by Abxery), though the EPSS score of 0.03% at the 8th percentile reflects negligible observed exploitation activity. The vulnerability is not listed in CISA KEV, consistent with the product's extremely limited production deployment footprint.
SQL injection in Nero Social Networking Site 1.0 exposes the /friendprofile.php endpoint to remote unauthenticated database manipulation via an unsanitized ID parameter. The CVSS 4.0 score of 5.5 reflects low-level confidentiality, integrity, and availability impact with no scope change to downstream systems. A public proof-of-concept exploit is available on GitHub, though the EPSS score of 0.03% (8th percentile) indicates negligible observed exploitation activity, consistent with the product's extremely narrow deployment footprint as a PHP demo application.
SQL injection in Nero Social Networking Site 1.0 exposes the `/deletemessage.php` endpoint to unauthenticated remote attackers who can manipulate the `message_id` parameter to execute arbitrary SQL commands against the backend database. The affected product is a PHP-based hobbyist/academic application (CPE: cpe:2.3:a:fabian:nero_social_networking_site:1.0). A public proof-of-concept exploit has been released on GitHub, though EPSS remains at 0.03% (8th percentile), indicating negligible observed exploitation activity consistent with the product's near-zero production deployment footprint.
SQL injection in the /addfriend.php endpoint of Nero Social Networking Site 1.0 allows unauthenticated remote attackers to manipulate the ID parameter and execute arbitrary SQL against the underlying database. A public proof-of-concept exploit is available on GitHub, though EPSS at 0.03% (8th percentile) indicates negligible observed in-the-wild activity. The product is a PHP-based academic demo application from code-projects.org, substantially limiting real-world exposure despite the straightforward attack vector.
SQL injection in Nero Social Networking Site 1.0 exposes the `/acceptoffres.php` endpoint to unauthenticated remote database manipulation via the unsanitized `ID` parameter. The CVSS 4.0 score of 5.5 reflects partial confidentiality, integrity, and availability impact against the vulnerable system only, with no scope change to subsequent systems. A public proof-of-concept exploit is available on GitHub; however, EPSS at 0.03% (8th percentile) and absence from CISA KEV indicate exploitation has not been observed at meaningful scale, likely due to the product's extremely limited deployment footprint.
SQL injection in SourceCodester Point of Sales 1.0 (by janobe) via the Category parameter in /category.php allows remote, unauthenticated attackers to manipulate backend database queries with no user interaction required. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation is straightforward and requires no privileges, though impact is limited (VC:L/VI:L/VA:L), indicating partial data exposure and manipulation rather than full system compromise. A publicly available proof-of-concept exists - reflected in the E:P threat modifier - yet the very low EPSS score of 0.03% (8th percentile) and absence from CISA KEV indicate no public exploit identified at time of analysis has driven widespread automated attacks.
SQL injection in SourceCodester Point of Sales 1.0 exposes the login endpoint (/index.php) to unauthenticated remote exploitation via a malicious Username parameter, enabling database query manipulation. A public proof-of-concept exploit has been disclosed on GitHub (CVE/issues/2), confirming the attack is reproducible. EPSS sits at 0.03% (8th percentile), indicating limited observed exploitation in the wild despite POC availability - consistent with a niche, low-footprint product; no CISA KEV listing.
SQL injection in SourceCodester Best House Rental Management System 1.0 allows unauthenticated remote attackers to manipulate the Username parameter in the login2 function of /admin_class.php, enabling authentication bypass or database enumeration. A public proof-of-concept exploit has been published on GitHub, confirming exploitability. No KEV listing and a low EPSS score (0.03%, 8th percentile) suggest exploitation remains opportunistic and low-volume, consistent with the niche deployment footprint of this PHP script.
SQL injection in RUET OJ's /process.php POST request handler allows remote unauthenticated attackers to manipulate the 'un' parameter to interact with the underlying database. The affected codebase, maintained by shawon100 on GitHub, uses no formal versioning - all commits up to 18fa45b0a669fa1098a0b8fc629cf6856369d9a5 are affected. A public exploit has been disclosed via VulDB, though the EPSS score of 0.02% (6th percentile) reflects the product's extremely limited deployment footprint; no active exploitation is confirmed.
Remote code execution in Rox, the PHP platform powering the BeWelcome hospitality-exchange community, arises from unsafe unserialize() calls on attacker-controllable input: the POST parameter `formkit_memory_recovery` handled by RoxPostHandler::getCallbackAction and the `bwRemember` 'memory cookie' read by RoxModelBase::getMemoryCookie. Because usable PHP gadget chains ship in Rox and its bundled libraries, an attacker with low-level access can trigger PHP object injection to write arbitrary files or execute code, resulting in full site compromise. The issue carries a CVSS 4.0 base score of 9.4 and was fixed in commit c60bf04 (2025-06-16); no public exploit identified at time of analysis, though a referenced technical gist may contain exploitation detail.
Remote code execution in the VideoWhisper Paid Videochat Turnkey Site WordPress plugin (versions up to 7.3.23) allows authenticated administrators to inject and execute arbitrary code through code injection vulnerabilities. The CVSS 9.1 severity reflects scope change and high impact across confidentiality, integrity, and availability. EPSS exploitation probability is low at 0.04% (13th percentile), and no public exploit identified at time of analysis, suggesting this remains a theoretical high-severity issue requiring privileged access rather than an imminent mass-exploitation threat.
Stored cross-site scripting via CSRF in the CloudSearch WordPress plugin (versions up to and including 3.0.0) by Andrea Landonio allows a remote attacker to trick an authenticated user into submitting a forged request that injects persistent malicious script. Because the injected payload is stored and served to other users, its execution crosses a security scope (S:C), amplifying impact beyond the tricked victim. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.02%, 5th percentile), indicating negligible near-term mass-exploitation pressure.
A stored cross-site scripting (XSS) vulnerability can be exploited via cross-site request forgery (CSRF) in the NikanWP WooCommerce Reporting plugin for WordPress up to version 1.0.0. This allows remote attackers to trick an administrator into performing actions that inject malicious scripts into the plugin's reporting data, which then executes in the victim's browser when viewing the reports. No active exploitation or public exploit code is known, and the EPSS exploitation probability is extremely low (0.02%).
CSRF in Reloadly plugin for WordPress allows stored XSS via a crafted request lacking anti-CSRF tokens, enabling an attacker to inject persistent scripts by tricking an admin. The vulnerability affects all versions up to 2.0.1, with a CVSS base score of 7.1, but EPSS indicates only a 0.02% chance of exploitation, and no active exploitation or public exploit code is known.
Cross-Site Request Forgery (CSRF) in the Did Prestashop Display WordPress plugin (versions ≤1.0.30) allows unauthenticated attackers to inject persistent malicious scripts (stored XSS) by tricking an authenticated administrator into clicking a crafted link. The vulnerability carries a CVSS 3.1 base score of 7.1, but no active exploitation or public exploit code is known, and the EPSS exploitation probability is only 0.02%.
Cross-Site Request Forgery in the WP Business Hours WordPress plugin through version 1.4 allows attackers to inject arbitrary web scripts via stored XSS. An unauthenticated attacker can craft a malicious link that, when clicked by an authenticated administrator, triggers a CSRF request to the vulnerable plugin, resulting in persistent script execution in the browsers of other site visitors. The vulnerability has a CVSS score of 7.1 (High) but a very low EPSS exploitation probability (0.02%), and no active exploitation or public proof-of-concept is known.
Stored cross-site scripting via cross-site request forgery in the Awesome Testimonials WordPress plugin up to version 2.2.1 allows unauthenticated attackers to inject malicious scripts that execute in the browsers of site visitors. Exploitation requires a logged-in administrator to be tricked into clicking a crafted link, but no other special configuration is necessary. No active exploitation or public proof-of-concept has been identified at this time.
Cross-Site Request Forgery (CSRF) in the Multilang Contact Form WordPress plugin (≤ 1.5) allows an attacker to inject stored cross-site scripting (XSS) payloads by tricking an authenticated administrator into clicking a malicious link. The stored XSS can then execute in the context of other users viewing the affected page, leading to cookie theft, session hijacking, or defacement. No public exploit code or active exploitation has been identified, and the EPSS score is very low (0.02%), indicating minimal current probability of large-scale attacks.
Cross-site request forgery enables stored XSS injection in WordPress Pricing Table builder plugin versions up to 1.5.3. Remote unauthenticated attackers can trick authenticated WordPress administrators into executing malicious requests that inject persistent JavaScript payloads into pricing table configurations. EPSS score of 0.02% (4th percentile) indicates low observed exploitation probability, and no active exploitation has been confirmed via CISA KEV. The changed scope (S:C) in CVSS vector indicates potential for broader site compromise beyond the plugin's security context.
Unauthorized data access in PickPlugins Testimonial Slider for WordPress (≤2.0.15) enables low-privilege authenticated users to retrieve testimonials without proper authorization, leading to a confidentiality breach. The vulnerability allows any logged-in subscriber to read all testimonial entries, potentially exposing sensitive content. No active exploitation or public proof-of-concept is currently known.
Authenticated information disclosure in PickPlugins Post Grid and Gutenberg Blocks plugin for WordPress (≤2.3.17) allows low-privileged users to access sensitive post data due to missing authorization checks. The vulnerability requires a valid WordPress account with at least subscriber-level privileges but no user interaction. No public exploit code or active exploitation has been observed, and EPSS indicates a low probability of widespread exploitation (0.09%).
Broken access control in King Addons for Elementor (WordPress plugin) versions through 51.1.61 allows authenticated attackers with low privileges to bypass authorization checks and gain unauthorized access to high-privilege functionality. The CVSS 8.8 score reflects potential for full compromise (high confidentiality, integrity, and availability impact), though the EPSS score of 0.05% (15th percentile) indicates minimal real-world exploitation observed. No public exploit code or CISA KEV listing identified at time of analysis. The vulnerability stems from improperly configured access control security levels (CWE-862: Missing Authorization), enabling privilege escalation by low-privileged users.
Confidential data exposure via missing authorization in Nelio Content WordPress plugin versions up to 4.0.5 allows authenticated low-privileged users (e.g., subscribers) to access information restricted to editors or administrators. The flaw carries a CVSS 6.5 score, but EPSS indicates very low exploitation probability (0.04%), and no public exploit or active exploitation has been identified.
Stored Cross-Site Scripting (XSS) in Ultimate Addons for WPBakery Page Builder allows unauthenticated attackers to inject malicious scripts into web pages through improper input neutralization. The vulnerability affects versions prior to 3.21.1, enabling attackers to execute arbitrary JavaScript in the browsers of site visitors, potentially leading to session hijacking, credential theft, or malware distribution. No public exploit code has been identified at the time of analysis, and real-world exploitation probability is minimal (EPSS 0.02%).
Stored cross-site scripting (XSS) in CrestaProject Attesa Extra WordPress plugin versions 1.4.7 and earlier allows authenticated users with low privileges to inject malicious scripts that execute in the browsers of other site visitors, potentially compromising session tokens, stealing sensitive data, or performing unauthorized actions. The vulnerability requires user interaction (clicking a malicious link) to trigger the payload, affects confidentiality, integrity, and availability, and carries a moderate CVSS score of 6.5 despite very low EPSS exploitation probability (0.02%, 7th percentile), suggesting limited real-world weaponization despite the vector permitting network-based attacks.
Stored cross-site scripting (XSS) in XLPlugins NextMove Lite WordPress plugin versions through 2.23.0 allows authenticated users with low privileges to inject malicious scripts into thank-you pages, affecting site visitors with escalated impact in multi-site contexts. The vulnerability requires user interaction (page visit) and leverages the plugin's improper input sanitization on web page generation. EPSS exploitation probability is low (0.02%), and no confirmed active exploitation has been reported; however, the stored nature and authenticated attack vector make it a meaningful risk for WordPress sites with untrusted user roles.
DOM-based cross-site scripting (XSS) in Designinvento DirectoryPress WordPress plugin through version 3.6.25 allows authenticated attackers with low privileges to inject malicious scripts that execute in the context of other users' browsers when they view affected pages. The vulnerability requires user interaction (clicking a malicious link) and can affect website visitors across the entire site, potentially leading to session hijacking, credential theft, or malware distribution. EPSS score of 0.02% indicates low exploitation probability despite the publicly available vulnerability details.
DOM-based cross-site scripting (XSS) in Estatik WordPress plugin through version 4.3.0 allows authenticated attackers with low privileges to inject malicious scripts that execute in the browsers of other users, potentially compromising session tokens, stealing sensitive data, or performing unauthorized actions with a victim's permissions. The vulnerability requires user interaction (clicking a malicious link) and affects the entire web application context. No public exploit code or active exploitation has been identified at the time of analysis, though the low EPSS score (0.02%) suggests limited real-world exploitation despite the moderate CVSS rating.
Stored cross-site scripting (XSS) in icc0rz H5P WordPress plugin versions 1.16.0 and earlier allows authenticated users with limited privileges to inject malicious scripts that execute in the browsers of other users viewing affected content. The vulnerability stems from improper input sanitization during web page generation and requires user interaction (UI:R) to trigger, affecting confidentiality, integrity, and availability with a CVSS score of 6.5. Despite the moderate CVSS rating, the EPSS score of 0.02% indicates very low real-world exploitation probability at time of analysis, with no public exploit code or active exploitation confirmed.
Stored cross-site scripting in the Next Page, Not Next Post WordPress plugin up to version 0.3.0 allows authenticated attackers with low privileges to inject malicious web scripts. These scripts execute in the browser of any user viewing the affected page, potentially leading to session hijacking, defacement, or redirection. The vulnerability has a low EPSS score (0.02%) and no known active exploitation or public exploit code at this time.
Stored cross-site scripting in the wp-mapbox-gl-js plugin for WordPress allows low-privilege authenticated attackers to inject arbitrary web scripts. When a victim views a page containing the malicious map, the script executes in their browser, enabling session hijacking, defacement, or credential theft. EPSS predicts extremely low exploitation probability and no active exploitation or public exploit code is known.
Stored Cross-Site Scripting (XSS) in the Events Maker WordPress plugin (≤ 1.6.14) allows authenticated users with low privileges to inject malicious scripts into event-related content. When a victim views the crafted event page, the script executes in their browser, potentially leading to session theft, defacement, or redirection. At time of analysis, no active exploitation or public proof-of-concept has been identified, and EPSS indicates a very low exploitation probability (0.02%).
Stored cross-site scripting (XSS) in the Blox Lite WordPress plugin (version <= 1.2.8) allows authenticated users with content creation privileges to inject arbitrary web scripts. When an administrator or high-privilege user views the affected content, the injected script executes in their browser, potentially leading to session hijacking, site defacement, or phishing. The vulnerability has a low EPSS score (0.02%) and no evidence of active exploitation, though public exploit code may be possible given the nature of XSS.
Stored Cross-Site Scripting (XSS) in the WordPress plugin Post List Featured Image allows authenticated attackers with low privileges to inject malicious scripts that execute in other users' browsers. Versions up to and including 0.5.9 are affected. Exploitation requires an authenticated session and user interaction, with no active exploitation or public exploit known at time of analysis; EPSS reflects a very low exploitation probability (0.02%).
We need to produce a JSON object with specific fields. The user provided CVE-2025-62917 data. I'll parse the given data. Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jamel.Z Tooltipy bluet-keywords-tooltip-generator allows Stored XSS. This issue affects Tooltipy: from n/a through <= 5.5.9. CVSS Score: 6.5 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L CWE: CWE-79 EPSS: 0.02% (percentile 7%) Tags: XSS References: [nvd] (None) https://patchstack.com/database/Wordpress/Plugin/bluet-keywords-tooltip-generator/vulnerability/wordpress-tooltipy-plugin-5-5-9-cross-site-scripting-xss-vulnerability?_s_id=cve We need to infer product_name: The vulnerability is in "Tooltipy" by Jamel.Z, which is a WordPress plugin (bluet-keywords-tooltip-generator). So product_name: "Tooltipy" or "WordPress Tooltipy Plugin"? The instruction says: "1-3 words ONLY. The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel', 'nginx-ui', 'GoAnywhere MFT'. NOT the vulnerability type, NOT the vendor alone, NOT a description. If multiple products, pick the primary one." So for a WordPress plugin, the primary product is "Tooltipy" (the plugin name). Vendor is Jamel.Z, but product name is "Tooltipy". Possibly "Tooltipy for WordPress" but that's 3 words. "Tooltipy" alone is okay. It's the plugin's name. So I'll use "Tooltipy". Summary: 2-3 sentence plain-language summary. Not copying description. Start with specific impact verb and product. Here: Stored XSS in Tooltipy plugin up to 5.5.9. Impact: attacker with contributor-level access can inject scripts, leading to stealing admin session or redirecting users, etc. Mention CVSS, EPSS low, no KEV, no POC explicitly given. So summary: "Stored cross-site scripting (XSS) in WordPress Tooltipy plugin versions ≤5.5.9 allows authenticated attackers with low privileges to inject arbitrary web scripts that execute when other users access
Stored cross-site scripting in the Opal Service WordPress plugin (<=1.9.1) allows authenticated attackers to inject scripts that execute in the context of other users' sessions. The vulnerability arises from improper input neutralization during page generation, potentially leading to data theft or unauthorized actions. No active exploitation or public proof-of-concept has been identified, and EPSS risk is minimal.
Stored cross-site scripting in SiteGround Email Marketing plugin for WordPress <=1.7.1 allows authenticated attackers with low-privilege accounts to inject scripts that execute in the context of users who view the affected page, potentially leading to session hijacking or unauthorized actions. The vulnerability, reported by Patchstack, has a medium CVSS score (6.5) but a very low EPSS exploitation probability (0.02%) with no known public exploit or active exploitation at this time.
Stored cross-site scripting in the Rock Convert WordPress plugin (≤3.0.1) enables low-privilege authenticated users to inject scripts that execute in the browsers of other users viewing compromised pages, potentially hijacking sessions or phishing credentials. No active exploitation or public exploit code is known, and EPSS estimates a very low (0.02%) chance of exploitation. The risk is moderate for sites with untrusted users, but elevated for admin accounts that view the injected content.
We are tasked with synthesizing multi-source intelligence about CVE-2025-62910 into a comprehensive JSON analysis. Need to follow all rules. First, extract info from input: - CVE ID: CVE-2025-62910 - Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in deshine Video Gallery by Huzzaz huzzaz-video-gallery allows Stored XSS. This issue affects Video Gallery by Huzzaz: from n/a through <= 10.5. - CVSS: 6.5, vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L - CWE: CWE-79 - EPSS: 0.02%, percentile 7% - Reported by: audit@patchstack.com - Tags: XSS - References: [nvd] (None) https://patchstack.com/database/Wordpress/Plugin/huzzaz-video-gallery/vulnerability/wordpress-video-gallery-by-huzzaz-plugin-10-5-cross-site-scripting-xss-vulnerability?_s_id=cve Other info: patch information? No explicit patch version mentioned. Description says "from n/a through <= 10.5". No KEV status, no POC info. So exploitation status: "no public exploit identified at time of analysis". Need to note. Fields: 1. product_name: "1-3 words ONLY." The product is "Video Gallery by Huzzaz" (a WordPress plugin). Abbreviated? Could be "Video Gallery by Huzzaz" (3 words). Maybe "Huzzaz Video Gallery" as per description "Video Gallery by Huzzaz". I'll use "Huzzaz Video Gallery". 2. summary: 2-3 sentence plain-language synthesis. Must not start with generic "A vulnerability". Start with impact verb and product. For stored XSS, impact is "Stored cross-site scripting". So: "Stored cross-site scripting in the Huzzaz Video Gallery WordPress plugin <=10.5 allows authenticated attackers...". But check CVSS: PR:L (requires low privileges), UI:R (user interaction required for exploitation). So an attacker with low privileges (e.g., contributor) can inject a script that will be stored and executed when an admin or other user views the page. Score 6.5, medium. EPSS low. No active exploitation. So summary: "Stored cross-site scripting in the Huzzaz