XSS
Monthly
CVE-2025-52772 is a CSRF vulnerability in Adnan Haque's Virtual Moderator plugin (versions through 1.4) that enables Cross-Site Scripting (XSS) attacks. An unauthenticated attacker can exploit this via a malicious webpage to perform unauthorized actions and inject malicious scripts, potentially compromising user sessions and data. With a CVSS score of 7.1 and network-accessible attack vector requiring only user interaction, this vulnerability poses a moderate-to-significant risk to affected installations, though exploitation requires social engineering to trick users into visiting attacker-controlled sites.
DOM-based Cross-Site Scripting (XSS) in ANON::form embedded secure form plugin for WordPress versions up to 1.7 allows authenticated attackers with contributor-level access or higher to inject malicious scripts. The vulnerability is triggered when a user interacts with a crafted link, leading to script execution in the victim's browser. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in Ninja Team File Manager Pro for WordPress allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. The vulnerability affects versions up to 1.8.8 and has a low EPSS score (0.04%) with no public exploit or active exploitation reported.
Stored cross-site scripting in Firelight Lightbox WordPress plugin up to version 2.3.16 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at this time.
Stored cross-site scripting (XSS) in WP-Members plugin for WordPress up to version 3.5.4 allows authenticated attackers with contributor-level access or higher to inject malicious scripts into web pages. These scripts execute when other users view affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in Jobs for WordPress plugin up to version 2.7.12 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into job postings. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at time of analysis.
Stored cross-site scripting in Modern Footnotes WordPress plugin through 1.4.19 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into footnote content. When an administrator views a page containing the malicious footnote, the script executes in their browser, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.
Stored cross-site scripting in the WordPress plugin Automatically Hierarchic Categories in Menu up to version 2.0.9 allows authenticated attackers with contributor-level access or higher to inject malicious scripts. When an administrator views the affected menu page, the injected script executes, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in Sitekit WordPress plugin through version 1.9 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when other users view the affected page. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
Stored cross-site scripting (XSS) in WPComplete 2.9.5 and earlier allows authenticated attackers with contributor-level access or higher to inject malicious scripts into web pages. When an administrator views the injected content, the script executes, potentially leading to session hijacking or data theft. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
DOM-based Cross-Site Scripting (XSS) in Related Products Manager for WooCommerce plugin versions up to 1.6.2 allows authenticated attackers with contributor-level access or higher to inject malicious scripts. The vulnerability is triggered when a crafted payload is processed by the browser, leading to script execution in the context of the victim's session. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in Code Engine WordPress plugin through 0.3.2 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when other users view the affected page. No public exploit or active exploitation identified.
Stored cross-site scripting in WP Register Profile With Shortcode plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject malicious scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.
Stored cross-site scripting in WP Engine's Gutenberg Blocks - ACF Blocks Suite plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at time of analysis.
Stored cross-site scripting (XSS) in Anant Addons for Elementor plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject malicious scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
DOM-based Cross-Site Scripting (XSS) in Buying Buddy IDX CRM WordPress plugin up to version 2.3.0 allows authenticated attackers with low privileges to inject malicious scripts via crafted input, leading to potential data theft or session hijacking. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in Fyrebox Quizzes WordPress plugin up to version 3.0 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into quiz pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at this time.
DOM-Based Cross-Site Scripting (XSS) in the Fitness Park WordPress theme through version 1.1.1 allows authenticated attackers with contributor-level access or higher to inject malicious scripts. The vulnerability is triggered when a user interacts with a crafted link, leading to script execution in the victim's browser. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
DOM-based Cross-Site Scripting (XSS) in Spark Multipurpose WordPress theme versions up to 1.0.7 allows authenticated attackers with low privileges to inject malicious scripts via crafted input, leading to potential data theft or session hijacking. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
Stored cross-site scripting (XSS) in Login/Signup Popup plugin for WordPress versions up to 2.9.4 allows authenticated users with high privileges (e.g., administrators) to inject malicious scripts that execute when other users view the affected page. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in Spoki WordPress plugin up to version 2.16.0 allows authenticated attackers with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
Stored cross-site scripting (XSS) in CP Polls WordPress plugin up to version 1.0.81 allows authenticated users with high privileges to inject malicious scripts that execute when other users view poll data. No public exploit or active exploitation identified.
Stored cross-site scripting in ATP Call Now WordPress plugin up to version 1.0.3 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation identified; EPSS score is low (0.04%).
Stored cross-site scripting in CodePen Embed Block plugin for WordPress allows authenticated users with high privileges to inject malicious scripts. This issue affects versions through 1.1.1 and has a low EPSS score with no public exploit identified.
Stored cross-site scripting in WP-FB-AutoConnect plugin for WordPress allows authenticated administrators to inject malicious scripts via improperly neutralized input. Affects versions up to 4.6.3. No public exploit or active exploitation identified; EPSS score is low (0.04%).
Stored cross-site scripting (XSS) in Better Random Redirect WordPress plugin versions up to 1.3.20 allows authenticated users with high privileges (e.g., administrators) to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in RDFa Breadcrumb WordPress plugin through version 2.3 allows authenticated users with high privileges (e.g., administrators) to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation identified; EPSS score is low (0.04%).
Stored cross-site scripting in Simple Sticky Footer WordPress plugin up to version 1.3.5 allows authenticated users with high privileges to inject arbitrary web scripts into pages, which execute when other users access the affected page. No public exploit or active exploitation identified; EPSS score is low (0.04%).
Stored cross-site scripting in Tealium WordPress plugin up to version 2.1.17 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in WP Voting Contest plugin for WordPress allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. The vulnerability affects versions up to 5.8 and has a low EPSS score with no public exploit identified.
Stored cross-site scripting (XSS) in the WordPress plugin IP Based Login through version 2.4.2 allows authenticated administrators to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting vulnerability in the Hand Talk WordPress plugin up to version 6.0 allows authenticated users with high privileges to inject malicious scripts into web pages. An attacker with admin-level access can store XSS payloads that execute when other users view affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.
Stored cross-site scripting (XSS) vulnerability in the PDPA Consent for Thailand WordPress plugin up to version 1.1.1 allows authenticated users with high privileges (e.g., administrators) to inject malicious scripts into web pages. This can lead to session hijacking, defacement, or redirection to malicious sites when other users view the affected page. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting (XSS) in CSV Importer Improved WordPress plugin up to version 0.6.1 allows authenticated users with high privileges to inject malicious scripts via imported CSV data. The vulnerability is triggered when an administrator views the imported data, leading to script execution in the admin context. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting (XSS) in Inventory Presser WordPress plugin up to version 15.0.0 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
Stored cross-site scripting in Recipes manager - WPH plugin for WordPress allows authenticated users with high privileges to inject malicious scripts. Versions through 1.0.4 are affected. No public exploit or active exploitation identified.
CVE-2025-49873 is a Reflected Cross-Site Scripting (XSS) vulnerability in NasaTheme's Elessi WordPress theme that allows unauthenticated attackers to inject malicious scripts into web pages viewed by victims. Versions up to and including 6.3.9 are affected. An attacker can steal session cookies, perform actions on behalf of users, or redirect users to malicious sites with minimal complexity (network-accessible input, user interaction required). The vulnerability lacks confirmed EPSS data and KEV listing at this time, but the CVSS 7.1 score and reflected XSS nature indicate moderate-to-high priority.
Cross-site scripting (XSS) in code-projects School Fees Payment System 1.0 allows an authenticated attacker to inject arbitrary web scripts via the Branch/Address/Detail parameters in /branch.php. A public exploit exists, but no active exploitation has been reported. The EPSS score is low (0.05%), indicating low exploitation likelihood.
The Euro FxRef Currency Converter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's currency shortcode in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Custom Post Carousels with Owl WordPress plugin before 1.4.12 uses the featherlight library and makes use of the data-featherlight attribute without sanitizing before using it.
Stored cross-site scripting (XSS) in PHPGurukul Notice Board System 1.0 allows an authenticated admin to inject arbitrary JavaScript via the Title or Description fields in the Add Notice functionality. The attack is remotely exploitable with high privileges (admin) and requires user interaction. A public exploit exists, but no active exploitation has been reported.
A vulnerability, which was classified as problematic, has been found in PHPGurukul Bus Pass Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/admin-profile.php of the component Profile Page. The manipulation of the argument profile name leads to cross site scripting. The attack may be launched remotely.
Stored cross-site scripting in PHPGurukul COVID19 Testing Management System 1.0 allows authenticated attackers with low privileges to inject arbitrary JavaScript via the 'remark' parameter in /test-details.php. Public exploit code exists, but no active exploitation has been reported and EPSS score is low (0.04%).
Cross-site scripting (XSS) in PHPGurukul COVID19 Testing Management System 2021 allows remote attackers to inject arbitrary web scripts via the 'q' parameter in /search-report-result.php. A public exploit exists, but no active exploitation has been reported and EPSS score is low (0.04%).
Cross-site scripting (XSS) vulnerability in Luna Imaging up to version 7.5.5.6 allows remote attackers to inject arbitrary web scripts via the 'q' parameter in the /luna/servlet/view/search endpoint. Public exploit code exists, but no active exploitation has been reported and EPSS score is low (0.04%).
The Gutenverse News plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘elementId’ parameter in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The WPBakery Page Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Grid Builder feature in all versions up to, and including, 8.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Stored cross-site scripting (XSS) in the Football Pool WordPress plugin up to version 2.12.4 allows authenticated administrators to inject arbitrary web scripts via admin settings. This affects only multi-site installations or those where unfiltered_html is disabled. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
The OceanWP theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Select HTML tag in all versions up to, and including, 4.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin image comparison widget's before/after labels in all versions up to, and including, 3.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpdm_user_dashboard shortcode in all versions up to, and including, 3.3.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Pixel Manager for WooCommerce - Track Conversions and Analytics, Google Ads, TikTok and more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's conversion-pixel in all versions up to, and including, 1.49.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
OpenList Frontend is a UI component for OpenList. Prior to version 4.0.0-rc.4, a vulnerability exists in the file preview/browsing feature of the application, where files with a .py extension that contain JavaScript code wrapped in <script> tags may be interpreted and executed as HTML in certain modes. This leads to a stored XSS vulnerability. This issue has been patched in version 4.0.0-rc.4.
The Versa Director SD-WAN orchestration platform allows customization of the user interface, including the header, footer, and logo. However, the input provided for these customizations is not properly validated or sanitized, allowing a malicious user to inject and store cross-site scripting (XSS) payloads. Exploitation Status: Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. Workarounds or Mitigation: There are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions.
CryptPad is a collaboration suite. Prior to version 2025.3.0, the "Link Bouncer" functionality attempts to filter javascript URIs to prevent Cross-Site Scripting (XSS), however this can be bypassed. There is an "early allow" code path that happens before the URI's protocol/scheme is checked, which a maliciously crafted URI can follow. This issue has been patched in version 2025.3.0.
IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
A cross-site scripting vulnerability in Real Estate Management 1.0 (CVSS 8.1). Risk factors: public PoC available.
A cross-site scripting (XSS) vulnerability in miniTCG v1.3.1 beta allows attackers to execute abritrary web scripts or HTML via injecting a crafted payload into the id parameter at /members/edit.php.
The Target Video Easy Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions up to, and including, 3.8.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The tarteaucitron.io WordPress plugin before 1.9.5 uses query parameters from YouTube oEmbed URLs without sanitizing these parameters correctly, which could allow users with the contributor role and above to perform Stored Cross-site Scripting attacks.
Dify is an open-source LLM app development platform. In version 1.2.0, there is insufficient filtering of user input by web applications. Attackers can use website vulnerabilities to inject malicious script code into web pages. This may result in a cross-site scripting (XSS) attack when a user browses these web pages. At time of posting, there is no known patched version.
A cross-site scripting (XSS) vulnerability in the data resource management function of Miliaris Amigdala v2.2.6 allows attackers to execute arbitrary HTML in the context of a user's browser via a crafted payload.
A cross-site scripting (XSS) vulnerability in the report manager function of Miliaris Amigdala v2.2.6 allows attackers to execute arbitrary HTML in the context of a user's browser via a crafted payload.
A cross-site scripting (XSS) vulnerability in the e-mail manager function of Miliaris Amigdala v2.2.6 allows attackers to execute arbitrary HTML in the context of a user's browser via a crafted payload.
DOM-based Cross-Site Scripting (XSS) in CubeWP Framework versions up to 1.1.23 allows authenticated attackers with low privileges to inject malicious scripts via crafted input, leading to potential data theft or session hijacking. No public exploit or active exploitation has been identified, and the EPSS score is low (0.05%).
Stored cross-site scripting in Responsive Blocks WordPress plugin up to version 2.0.5 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at this time.
DOM-based cross-site scripting in WPAdverts plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject malicious scripts via crafted input. The vulnerability affects versions up to 2.2.4 and requires user interaction to trigger. No public exploit or active exploitation has been identified at this time.
Stored cross-site scripting in If-So Dynamic Content Personalization plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at time of analysis.
Stored cross-site scripting in the Noptin WordPress plugin (newsletter-optin-box) up to version 3.8.7 allows authenticated, high-privileged attackers to inject malicious scripts that execute in the browsers of victim users. Exploitation requires administrator-level access and user interaction, limiting widespread automated attacks. No active exploitation or public proof-of-concept has been identified, and EPSS predicts a very low chance of real-world exploitation.
Stored cross-site scripting in Advanced Sermons WordPress plugin up to version 3.6 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into sermon pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.
Stored cross-site scripting in the Ebook Store WordPress plugin allows authenticated administrators to inject malicious scripts that execute in other users' browsers when they view affected content. The vulnerability affects all plugin versions up to 5.8008, requiring high privileges and user interaction for exploitation. No active exploitation or public exploit code has been confirmed at this time.
Stored cross-site scripting in Kama Click Counter plugin for WordPress versions up to 4.0.3 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at this time.
Stored cross-site scripting in WP Views Counter plugin for WordPress up to version 2.0.3 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at this time.
Stored cross-site scripting in Arconix Shortcodes WordPress plugin up to version 2.1.17 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected content, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.
DOM-based cross-site scripting vulnerability in Meks Flexible Shortcodes WordPress plugin up to version 1.3.7 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts via crafted shortcodes. The vulnerability is triggered when a user interacts with a malicious link, leading to script execution in the victim's browser. No public exploit or active exploitation has been reported, and the EPSS score is low (0.05%).
Reflected Cross-Site Scripting (XSS) vulnerability in the Saleswonder Team Tobias WP2LEADS WordPress plugin (versions up to 3.5.0) that allows unauthenticated attackers to inject malicious scripts into web pages viewed by users. An attacker can craft a malicious URL containing JavaScript payload and trick users into clicking it, potentially leading to session hijacking, credential theft, or malware distribution. The vulnerability has a CVSS score of 7.1 (High) with network-based attack vector requiring user interaction, and while KEV/active exploitation status and POC availability are not explicitly confirmed in provided data, the low attack complexity and reflected nature suggest moderate real-world risk.
Reflected Cross-Site Scripting (XSS) vulnerability in the CodeRevolution Echo RSS Feed Post Generator Plugin for WordPress affecting versions through 5.4.8.1. An unauthenticated attacker can inject malicious scripts into web pages viewed by users with no special privileges required, potentially leading to session hijacking, credential theft, or malware distribution. The CVSS 7.1 score reflects the moderate severity with network attack vector and user interaction requirement.
Reflected Cross-Site Scripting (XSS) vulnerability in Rustaurius Ultimate Reviews WordPress plugin versions up to 3.2.14, allowing unauthenticated attackers to inject malicious scripts that execute in users' browsers. The vulnerability requires user interaction (clicking a malicious link) but can compromise session tokens, steal sensitive data, or perform actions on behalf of affected users. While this is a network-accessible, low-complexity attack with moderate CVSS score (7.1), reflected XSS vulnerabilities are commonly exploited and proof-of-concept code is typically straightforward to develop.
Reflected Cross-Site Scripting (XSS) vulnerability in WPQuark's eForm WordPress Form Builder plugin that allows unauthenticated attackers to inject malicious scripts into web pages viewed by other users. The vulnerability affects the eForm plugin across unspecified version ranges and can be exploited with user interaction to compromise confidentiality, integrity, and availability. No active KEV designation or confirmed POC availability is documented, but the network-accessible nature and low attack complexity present moderate real-world exploitation risk.
A cross-site scripting vulnerability in Michal Jaworski Track (CVSS 7.1). High severity vulnerability requiring prompt remediation.
Reflected Cross-Site Scripting (XSS) vulnerability in NasaTheme Nasa Core versions up to 6.3.2 that allows unauthenticated attackers to inject arbitrary JavaScript code into web pages viewed by other users. The vulnerability affects the Nasa Core component through improper input neutralization during web page generation, enabling attackers to steal session cookies, perform actions on behalf of users, or distribute malware. With a CVSS score of 7.1 and low attack complexity, this vulnerability poses a moderate-to-high risk to affected installations, particularly if the affected theme is actively deployed in production environments.
Stored Cross-Site Scripting (XSS) vulnerability in CreativeMedia Elite Video Player versions up to 10.0.5 that allows unauthenticated attackers to inject and persist malicious scripts through the web page generation process. An attacker can craft a malicious input that gets stored in the application and executed in the browsers of other users who view the affected page, potentially leading to session hijacking, credential theft, or malware distribution. The vulnerability requires user interaction (UI:R) but has a network attack vector with no authentication required, making it a moderate-to-high priority threat depending on deployment context.
The Simple Logo Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.9.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Master Slider - Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's masterslider_pb and ms_slide shortcodes in all versions up to, and including, 3.10.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Mezzanine CMS, in versions prior to 6.1.1, contains a Stored Cross-Site Scripting (XSS) vulnerability in the admin interface. The vulnerability exists in the "displayable_links_js" function, which fails to properly sanitize blog post titles before including them in JSON responses served via "/admin/displayable_links.js". An authenticated admin user can create a blog post with a malicious JavaScript payload in the title field, then trick another admin user into clicking a direct link to the "/admin/displayable_links.js" endpoint, causing the malicious script to execute in their browser.
Reflected Cross-Site Scripting (XSS) in osCommerce v4. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the name of any parameter in /watch/en/about-us. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.
The Ivory Search WordPress plugin before 5.5.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
The WordPress Infinite Scroll - Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-button-label HTML attribute in all versions up to, and including, 7.4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Wise Chat WordPress plugin versions up to 3.3.4 contains a Stored Cross-Site Scripting (XSS) vulnerability in the X-Forwarded-For header processing that allows unauthenticated attackers to inject malicious scripts without authentication or user interaction. When vulnerable pages are accessed by site visitors, the injected scripts execute in their browsers, potentially enabling credential theft, session hijacking, or malware distribution. This vulnerability has a CVSS score of 7.2 (High) and affects all publicly-facing WordPress installations running the affected plugin versions.
CVE-2025-52772 is a CSRF vulnerability in Adnan Haque's Virtual Moderator plugin (versions through 1.4) that enables Cross-Site Scripting (XSS) attacks. An unauthenticated attacker can exploit this via a malicious webpage to perform unauthorized actions and inject malicious scripts, potentially compromising user sessions and data. With a CVSS score of 7.1 and network-accessible attack vector requiring only user interaction, this vulnerability poses a moderate-to-significant risk to affected installations, though exploitation requires social engineering to trick users into visiting attacker-controlled sites.
DOM-based Cross-Site Scripting (XSS) in ANON::form embedded secure form plugin for WordPress versions up to 1.7 allows authenticated attackers with contributor-level access or higher to inject malicious scripts. The vulnerability is triggered when a user interacts with a crafted link, leading to script execution in the victim's browser. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in Ninja Team File Manager Pro for WordPress allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. The vulnerability affects versions up to 1.8.8 and has a low EPSS score (0.04%) with no public exploit or active exploitation reported.
Stored cross-site scripting in Firelight Lightbox WordPress plugin up to version 2.3.16 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at this time.
Stored cross-site scripting (XSS) in WP-Members plugin for WordPress up to version 3.5.4 allows authenticated attackers with contributor-level access or higher to inject malicious scripts into web pages. These scripts execute when other users view affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in Jobs for WordPress plugin up to version 2.7.12 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into job postings. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at time of analysis.
Stored cross-site scripting in Modern Footnotes WordPress plugin through 1.4.19 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into footnote content. When an administrator views a page containing the malicious footnote, the script executes in their browser, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.
Stored cross-site scripting in the WordPress plugin Automatically Hierarchic Categories in Menu up to version 2.0.9 allows authenticated attackers with contributor-level access or higher to inject malicious scripts. When an administrator views the affected menu page, the injected script executes, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in Sitekit WordPress plugin through version 1.9 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when other users view the affected page. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
Stored cross-site scripting (XSS) in WPComplete 2.9.5 and earlier allows authenticated attackers with contributor-level access or higher to inject malicious scripts into web pages. When an administrator views the injected content, the script executes, potentially leading to session hijacking or data theft. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
DOM-based Cross-Site Scripting (XSS) in Related Products Manager for WooCommerce plugin versions up to 1.6.2 allows authenticated attackers with contributor-level access or higher to inject malicious scripts. The vulnerability is triggered when a crafted payload is processed by the browser, leading to script execution in the context of the victim's session. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in Code Engine WordPress plugin through 0.3.2 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when other users view the affected page. No public exploit or active exploitation identified.
Stored cross-site scripting in WP Register Profile With Shortcode plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject malicious scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.
Stored cross-site scripting in WP Engine's Gutenberg Blocks - ACF Blocks Suite plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at time of analysis.
Stored cross-site scripting (XSS) in Anant Addons for Elementor plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject malicious scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
DOM-based Cross-Site Scripting (XSS) in Buying Buddy IDX CRM WordPress plugin up to version 2.3.0 allows authenticated attackers with low privileges to inject malicious scripts via crafted input, leading to potential data theft or session hijacking. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in Fyrebox Quizzes WordPress plugin up to version 3.0 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into quiz pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at this time.
DOM-Based Cross-Site Scripting (XSS) in the Fitness Park WordPress theme through version 1.1.1 allows authenticated attackers with contributor-level access or higher to inject malicious scripts. The vulnerability is triggered when a user interacts with a crafted link, leading to script execution in the victim's browser. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
DOM-based Cross-Site Scripting (XSS) in Spark Multipurpose WordPress theme versions up to 1.0.7 allows authenticated attackers with low privileges to inject malicious scripts via crafted input, leading to potential data theft or session hijacking. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
Stored cross-site scripting (XSS) in Login/Signup Popup plugin for WordPress versions up to 2.9.4 allows authenticated users with high privileges (e.g., administrators) to inject malicious scripts that execute when other users view the affected page. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in Spoki WordPress plugin up to version 2.16.0 allows authenticated attackers with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
Stored cross-site scripting (XSS) in CP Polls WordPress plugin up to version 1.0.81 allows authenticated users with high privileges to inject malicious scripts that execute when other users view poll data. No public exploit or active exploitation identified.
Stored cross-site scripting in ATP Call Now WordPress plugin up to version 1.0.3 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation identified; EPSS score is low (0.04%).
Stored cross-site scripting in CodePen Embed Block plugin for WordPress allows authenticated users with high privileges to inject malicious scripts. This issue affects versions through 1.1.1 and has a low EPSS score with no public exploit identified.
Stored cross-site scripting in WP-FB-AutoConnect plugin for WordPress allows authenticated administrators to inject malicious scripts via improperly neutralized input. Affects versions up to 4.6.3. No public exploit or active exploitation identified; EPSS score is low (0.04%).
Stored cross-site scripting (XSS) in Better Random Redirect WordPress plugin versions up to 1.3.20 allows authenticated users with high privileges (e.g., administrators) to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in RDFa Breadcrumb WordPress plugin through version 2.3 allows authenticated users with high privileges (e.g., administrators) to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation identified; EPSS score is low (0.04%).
Stored cross-site scripting in Simple Sticky Footer WordPress plugin up to version 1.3.5 allows authenticated users with high privileges to inject arbitrary web scripts into pages, which execute when other users access the affected page. No public exploit or active exploitation identified; EPSS score is low (0.04%).
Stored cross-site scripting in Tealium WordPress plugin up to version 2.1.17 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting in WP Voting Contest plugin for WordPress allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. The vulnerability affects versions up to 5.8 and has a low EPSS score with no public exploit identified.
Stored cross-site scripting (XSS) in the WordPress plugin IP Based Login through version 2.4.2 allows authenticated administrators to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting vulnerability in the Hand Talk WordPress plugin up to version 6.0 allows authenticated users with high privileges to inject malicious scripts into web pages. An attacker with admin-level access can store XSS payloads that execute when other users view affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.
Stored cross-site scripting (XSS) vulnerability in the PDPA Consent for Thailand WordPress plugin up to version 1.1.1 allows authenticated users with high privileges (e.g., administrators) to inject malicious scripts into web pages. This can lead to session hijacking, defacement, or redirection to malicious sites when other users view the affected page. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting (XSS) in CSV Importer Improved WordPress plugin up to version 0.6.1 allows authenticated users with high privileges to inject malicious scripts via imported CSV data. The vulnerability is triggered when an administrator views the imported data, leading to script execution in the admin context. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored cross-site scripting (XSS) in Inventory Presser WordPress plugin up to version 15.0.0 allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
Stored cross-site scripting in Recipes manager - WPH plugin for WordPress allows authenticated users with high privileges to inject malicious scripts. Versions through 1.0.4 are affected. No public exploit or active exploitation identified.
CVE-2025-49873 is a Reflected Cross-Site Scripting (XSS) vulnerability in NasaTheme's Elessi WordPress theme that allows unauthenticated attackers to inject malicious scripts into web pages viewed by victims. Versions up to and including 6.3.9 are affected. An attacker can steal session cookies, perform actions on behalf of users, or redirect users to malicious sites with minimal complexity (network-accessible input, user interaction required). The vulnerability lacks confirmed EPSS data and KEV listing at this time, but the CVSS 7.1 score and reflected XSS nature indicate moderate-to-high priority.
Cross-site scripting (XSS) in code-projects School Fees Payment System 1.0 allows an authenticated attacker to inject arbitrary web scripts via the Branch/Address/Detail parameters in /branch.php. A public exploit exists, but no active exploitation has been reported. The EPSS score is low (0.05%), indicating low exploitation likelihood.
The Euro FxRef Currency Converter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's currency shortcode in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Custom Post Carousels with Owl WordPress plugin before 1.4.12 uses the featherlight library and makes use of the data-featherlight attribute without sanitizing before using it.
Stored cross-site scripting (XSS) in PHPGurukul Notice Board System 1.0 allows an authenticated admin to inject arbitrary JavaScript via the Title or Description fields in the Add Notice functionality. The attack is remotely exploitable with high privileges (admin) and requires user interaction. A public exploit exists, but no active exploitation has been reported.
A vulnerability, which was classified as problematic, has been found in PHPGurukul Bus Pass Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/admin-profile.php of the component Profile Page. The manipulation of the argument profile name leads to cross site scripting. The attack may be launched remotely.
Stored cross-site scripting in PHPGurukul COVID19 Testing Management System 1.0 allows authenticated attackers with low privileges to inject arbitrary JavaScript via the 'remark' parameter in /test-details.php. Public exploit code exists, but no active exploitation has been reported and EPSS score is low (0.04%).
Cross-site scripting (XSS) in PHPGurukul COVID19 Testing Management System 2021 allows remote attackers to inject arbitrary web scripts via the 'q' parameter in /search-report-result.php. A public exploit exists, but no active exploitation has been reported and EPSS score is low (0.04%).
Cross-site scripting (XSS) vulnerability in Luna Imaging up to version 7.5.5.6 allows remote attackers to inject arbitrary web scripts via the 'q' parameter in the /luna/servlet/view/search endpoint. Public exploit code exists, but no active exploitation has been reported and EPSS score is low (0.04%).
The Gutenverse News plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘elementId’ parameter in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The WPBakery Page Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Grid Builder feature in all versions up to, and including, 8.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Stored cross-site scripting (XSS) in the Football Pool WordPress plugin up to version 2.12.4 allows authenticated administrators to inject arbitrary web scripts via admin settings. This affects only multi-site installations or those where unfiltered_html is disabled. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
The OceanWP theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Select HTML tag in all versions up to, and including, 4.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin image comparison widget's before/after labels in all versions up to, and including, 3.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpdm_user_dashboard shortcode in all versions up to, and including, 3.3.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Pixel Manager for WooCommerce - Track Conversions and Analytics, Google Ads, TikTok and more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's conversion-pixel in all versions up to, and including, 1.49.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
OpenList Frontend is a UI component for OpenList. Prior to version 4.0.0-rc.4, a vulnerability exists in the file preview/browsing feature of the application, where files with a .py extension that contain JavaScript code wrapped in <script> tags may be interpreted and executed as HTML in certain modes. This leads to a stored XSS vulnerability. This issue has been patched in version 4.0.0-rc.4.
The Versa Director SD-WAN orchestration platform allows customization of the user interface, including the header, footer, and logo. However, the input provided for these customizations is not properly validated or sanitized, allowing a malicious user to inject and store cross-site scripting (XSS) payloads. Exploitation Status: Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. Workarounds or Mitigation: There are no workarounds to disable the GUI option. Versa recommends that Director be upgraded to one of the remediated software versions.
CryptPad is a collaboration suite. Prior to version 2025.3.0, the "Link Bouncer" functionality attempts to filter javascript URIs to prevent Cross-Site Scripting (XSS), however this can be bypassed. There is an "early allow" code path that happens before the URI's protocol/scheme is checked, which a maliciously crafted URI can follow. This issue has been patched in version 2025.3.0.
IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
A cross-site scripting vulnerability in Real Estate Management 1.0 (CVSS 8.1). Risk factors: public PoC available.
A cross-site scripting (XSS) vulnerability in miniTCG v1.3.1 beta allows attackers to execute abritrary web scripts or HTML via injecting a crafted payload into the id parameter at /members/edit.php.
The Target Video Easy Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions up to, and including, 3.8.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The tarteaucitron.io WordPress plugin before 1.9.5 uses query parameters from YouTube oEmbed URLs without sanitizing these parameters correctly, which could allow users with the contributor role and above to perform Stored Cross-site Scripting attacks.
Dify is an open-source LLM app development platform. In version 1.2.0, there is insufficient filtering of user input by web applications. Attackers can use website vulnerabilities to inject malicious script code into web pages. This may result in a cross-site scripting (XSS) attack when a user browses these web pages. At time of posting, there is no known patched version.
A cross-site scripting (XSS) vulnerability in the data resource management function of Miliaris Amigdala v2.2.6 allows attackers to execute arbitrary HTML in the context of a user's browser via a crafted payload.
A cross-site scripting (XSS) vulnerability in the report manager function of Miliaris Amigdala v2.2.6 allows attackers to execute arbitrary HTML in the context of a user's browser via a crafted payload.
A cross-site scripting (XSS) vulnerability in the e-mail manager function of Miliaris Amigdala v2.2.6 allows attackers to execute arbitrary HTML in the context of a user's browser via a crafted payload.
DOM-based Cross-Site Scripting (XSS) in CubeWP Framework versions up to 1.1.23 allows authenticated attackers with low privileges to inject malicious scripts via crafted input, leading to potential data theft or session hijacking. No public exploit or active exploitation has been identified, and the EPSS score is low (0.05%).
Stored cross-site scripting in Responsive Blocks WordPress plugin up to version 2.0.5 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at this time.
DOM-based cross-site scripting in WPAdverts plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject malicious scripts via crafted input. The vulnerability affects versions up to 2.2.4 and requires user interaction to trigger. No public exploit or active exploitation has been identified at this time.
Stored cross-site scripting in If-So Dynamic Content Personalization plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at time of analysis.
Stored cross-site scripting in the Noptin WordPress plugin (newsletter-optin-box) up to version 3.8.7 allows authenticated, high-privileged attackers to inject malicious scripts that execute in the browsers of victim users. Exploitation requires administrator-level access and user interaction, limiting widespread automated attacks. No active exploitation or public proof-of-concept has been identified, and EPSS predicts a very low chance of real-world exploitation.
Stored cross-site scripting in Advanced Sermons WordPress plugin up to version 3.6 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into sermon pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.
Stored cross-site scripting in the Ebook Store WordPress plugin allows authenticated administrators to inject malicious scripts that execute in other users' browsers when they view affected content. The vulnerability affects all plugin versions up to 5.8008, requiring high privileges and user interaction for exploitation. No active exploitation or public exploit code has been confirmed at this time.
Stored cross-site scripting in Kama Click Counter plugin for WordPress versions up to 4.0.3 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at this time.
Stored cross-site scripting in WP Views Counter plugin for WordPress up to version 2.0.3 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at this time.
Stored cross-site scripting in Arconix Shortcodes WordPress plugin up to version 2.1.17 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected content, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.
DOM-based cross-site scripting vulnerability in Meks Flexible Shortcodes WordPress plugin up to version 1.3.7 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts via crafted shortcodes. The vulnerability is triggered when a user interacts with a malicious link, leading to script execution in the victim's browser. No public exploit or active exploitation has been reported, and the EPSS score is low (0.05%).
Reflected Cross-Site Scripting (XSS) vulnerability in the Saleswonder Team Tobias WP2LEADS WordPress plugin (versions up to 3.5.0) that allows unauthenticated attackers to inject malicious scripts into web pages viewed by users. An attacker can craft a malicious URL containing JavaScript payload and trick users into clicking it, potentially leading to session hijacking, credential theft, or malware distribution. The vulnerability has a CVSS score of 7.1 (High) with network-based attack vector requiring user interaction, and while KEV/active exploitation status and POC availability are not explicitly confirmed in provided data, the low attack complexity and reflected nature suggest moderate real-world risk.
Reflected Cross-Site Scripting (XSS) vulnerability in the CodeRevolution Echo RSS Feed Post Generator Plugin for WordPress affecting versions through 5.4.8.1. An unauthenticated attacker can inject malicious scripts into web pages viewed by users with no special privileges required, potentially leading to session hijacking, credential theft, or malware distribution. The CVSS 7.1 score reflects the moderate severity with network attack vector and user interaction requirement.
Reflected Cross-Site Scripting (XSS) vulnerability in Rustaurius Ultimate Reviews WordPress plugin versions up to 3.2.14, allowing unauthenticated attackers to inject malicious scripts that execute in users' browsers. The vulnerability requires user interaction (clicking a malicious link) but can compromise session tokens, steal sensitive data, or perform actions on behalf of affected users. While this is a network-accessible, low-complexity attack with moderate CVSS score (7.1), reflected XSS vulnerabilities are commonly exploited and proof-of-concept code is typically straightforward to develop.
Reflected Cross-Site Scripting (XSS) vulnerability in WPQuark's eForm WordPress Form Builder plugin that allows unauthenticated attackers to inject malicious scripts into web pages viewed by other users. The vulnerability affects the eForm plugin across unspecified version ranges and can be exploited with user interaction to compromise confidentiality, integrity, and availability. No active KEV designation or confirmed POC availability is documented, but the network-accessible nature and low attack complexity present moderate real-world exploitation risk.
A cross-site scripting vulnerability in Michal Jaworski Track (CVSS 7.1). High severity vulnerability requiring prompt remediation.
Reflected Cross-Site Scripting (XSS) vulnerability in NasaTheme Nasa Core versions up to 6.3.2 that allows unauthenticated attackers to inject arbitrary JavaScript code into web pages viewed by other users. The vulnerability affects the Nasa Core component through improper input neutralization during web page generation, enabling attackers to steal session cookies, perform actions on behalf of users, or distribute malware. With a CVSS score of 7.1 and low attack complexity, this vulnerability poses a moderate-to-high risk to affected installations, particularly if the affected theme is actively deployed in production environments.
Stored Cross-Site Scripting (XSS) vulnerability in CreativeMedia Elite Video Player versions up to 10.0.5 that allows unauthenticated attackers to inject and persist malicious scripts through the web page generation process. An attacker can craft a malicious input that gets stored in the application and executed in the browsers of other users who view the affected page, potentially leading to session hijacking, credential theft, or malware distribution. The vulnerability requires user interaction (UI:R) but has a network attack vector with no authentication required, making it a moderate-to-high priority threat depending on deployment context.
The Simple Logo Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.9.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Master Slider - Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's masterslider_pb and ms_slide shortcodes in all versions up to, and including, 3.10.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Mezzanine CMS, in versions prior to 6.1.1, contains a Stored Cross-Site Scripting (XSS) vulnerability in the admin interface. The vulnerability exists in the "displayable_links_js" function, which fails to properly sanitize blog post titles before including them in JSON responses served via "/admin/displayable_links.js". An authenticated admin user can create a blog post with a malicious JavaScript payload in the title field, then trick another admin user into clicking a direct link to the "/admin/displayable_links.js" endpoint, causing the malicious script to execute in their browser.
Reflected Cross-Site Scripting (XSS) in osCommerce v4. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the name of any parameter in /watch/en/about-us. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.
The Ivory Search WordPress plugin before 5.5.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
The WordPress Infinite Scroll - Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-button-label HTML attribute in all versions up to, and including, 7.4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Wise Chat WordPress plugin versions up to 3.3.4 contains a Stored Cross-Site Scripting (XSS) vulnerability in the X-Forwarded-For header processing that allows unauthenticated attackers to inject malicious scripts without authentication or user interaction. When vulnerable pages are accessed by site visitors, the injected scripts execute in their browsers, potentially enabling credential theft, session hijacking, or malware distribution. This vulnerability has a CVSS score of 7.2 (High) and affects all publicly-facing WordPress installations running the affected plugin versions.