XSS
Monthly
Cross-site scripting (XSS) in Simple Food Ordering System 1.0 allows remote attackers to inject malicious scripts via unsanitized input parameters (pname, category, price) in the /editproduct.php endpoint. The vulnerability requires user interaction (UI:P) but carries low integrity impact and has publicly available exploit code; EPSS probability remains minimal (0.03%) despite public POC availability, suggesting limited real-world adoption or exploitation barriers.
Stored cross-site scripting (XSS) in Simple Food Ordering System 1.0 allows remote attackers to inject malicious scripts via the cname parameter in /addcategory.php, which are executed in the browsers of users viewing affected content. The vulnerability requires user interaction (UI:P) to exploit but has a public proof-of-concept available. Despite the low CVSS score (2.1) and minimal EPSS percentile (10%), the combination of remote network access and public exploit code necessitates prompt patching to prevent account compromise and session hijacking.
Stored cross-site scripting (XSS) in Simple Food Ordering System 1.0 allows remote attackers to inject malicious scripts through the pname, category, or price parameters in /addproduct.php, requiring user interaction to trigger payload execution. Public exploit code is available, and the vulnerability carries low severity (CVSS 2.1) due to the requirement for user interaction and limited scope of impact.
Reflected cross-site scripting (XSS) in Simple Food Ordering System 1.0 via the pname parameter in /editcategory.php allows remote attackers to inject malicious JavaScript that executes in users' browsers with minimal user interaction. The vulnerability requires user interaction (clicking a malicious link) but has low technical complexity and publicly available exploit code, though active exploitation remains unconfirmed and real-world impact is limited by the low EPSS score of 0.03% despite public POC availability.
Reflected cross-site scripting (XSS) in Suishang Enterprise-Level B2B2C Multi-User Mall System 1.0 allows remote attackers to inject malicious scripts via the keywords parameter in the /i/359 endpoint. The vulnerability requires user interaction (clicking a malicious link) and results in limited integrity impact. Although exploit code has been publicly disclosed and the vendor did not respond to early disclosure, the EPSS score of 0.03% and low CVSS impact (2.1) suggest minimal real-world exploitation probability.
Reflected cross-site scripting (XSS) in Suishang Enterprise-Level B2B2C Multi-User Mall System 1.0 allows remote attackers to inject malicious scripts via the category_id parameter in the /Point/index/activity_state endpoint. The vulnerability requires user interaction (UI:P) to trigger and has low integrity impact, but publicly available exploit code exists. The vendor did not respond to disclosure notifications.
Stored cross-site scripting (XSS) in code-projects Client Details System 1.0 allows authenticated users with high privileges to inject malicious scripts via the /admin/manage-users.php endpoint, which are then executed in the browsers of other users who interact with the managed user data. The vulnerability requires administrative privileges and user interaction (UI:P) to exploit, resulting in limited integrity impact (VI:L). Public exploit code is available, though the extremely low CVSS score (1.9) and EPSS probability (0.04%) reflect the high privilege barrier and user interaction requirement that significantly constrain real-world risk.
Stored cross-site scripting (XSS) in code-projects Client Details System 1.0 allows authenticated high-privilege users to inject malicious scripts into the /admin/clientview.php endpoint that execute in the context of other users' browsers. The vulnerability requires user interaction (victim must view affected content) and high administrative privileges to exploit, limiting real-world risk despite public exploit disclosure. EPSS score of 0.03% reflects the stringent authentication and interaction requirements that prevent widespread automated exploitation.
Cross-site scripting (XSS) in code-projects Client Details System 1.0 allows high-privileged authenticated users to inject malicious scripts via the /update-clients.php endpoint, requiring user interaction to execute. The vulnerability carries a low CVSS score of 1.9 due to high privilege requirements (PR:H) and mandatory user interaction (UI:P), but publicly available exploit code exists, making it actionable for insider threats or social engineering scenarios targeting administrators.
Cross-site scripting (XSS) in code-projects Client Details System 1.0 allows remote attackers with high privileges and user interaction to inject malicious scripts via the /welcome.php file, resulting in limited integrity impact. The vulnerability has been publicly disclosed with exploit code available, though real-world exploitation is constrained by the requirement for high administrative privileges and user interaction, reflected in the exceptionally low CVSS score of 1.9 and EPSS probability of 0.03%.
Stored cross-site scripting (XSS) in LearnHouse Account Setting Page allows authenticated users to inject malicious scripts via the /dash/org/settings/previews endpoint, affecting all versions up to commit 98dfad76aad70711a8113f6c1fdabfccf10509ca. An attacker with valid credentials can craft a malicious request that, when viewed by another user (requiring user interaction), executes arbitrary JavaScript in their browser context with potential for data theft or session hijacking. Public exploit code exists, though exploitation requires both login credentials and victim interaction, limiting real-world impact despite the network-accessible vector.
Cross-site scripting (XSS) vulnerability in abhicodebox ModernShop 20250922 allows remote attackers to inject malicious scripts via the 'q' parameter in the /search endpoint, requiring user interaction to execute. The vulnerability has a published exploit and low CVSS score (2.1) due to user interaction requirement, but affects the integrity of victim sessions with EPSS exploitation probability of 0.03% indicating minimal real-world exploitation likelihood.
Stored cross-site scripting (XSS) in OpenWGA 7.11.12 Build 737 Admin UI allows authenticated users with low privileges to inject malicious scripts that execute in the browsers of other users who view the affected interface. Exploitation requires user interaction (clicking a crafted link or visiting a manipulated page), limiting real-world impact despite remote accessibility. Public exploit disclosure exists, but EPSS scoring (0.03%, 7th percentile) and low CVSS severity (2.0) indicate minimal active exploitation likelihood in real deployments.
Cross-site scripting (XSS) in Chatwoot up to version 4.7.0 allows remote attackers to inject malicious scripts via the Link argument in the IframeLoader.vue Admin Interface component, requiring user interaction to trigger. The vulnerability has a low CVSS score (2.1) and EPSS percentile (10%) but publicly available exploit code exists, indicating the attack is straightforward to execute once a victim clicks a crafted link.
Reflected cross-site scripting (XSS) in Simple E-Banking System 1.0 allows remote attackers to inject malicious scripts via the Username parameter in /eBank/register.php. The vulnerability requires user interaction (clicking a malicious link) but has low impact on confidentiality and integrity. Publicly available exploit code exists, though EPSS scoring (0.03%, 10th percentile) suggests limited real-world exploitation despite XSS being a common attack vector.
Stored cross-site scripting in projectworlds Expense Management System 1.0 allows high-privileged authenticated users to inject malicious scripts via the Expense Categories creation page, affecting other users who view the poisoned content. The vulnerability requires administrator-level access and user interaction (rendering the page), limiting real-world impact despite remote network delivery. Publicly available exploit code exists; EPSS exploitation probability is very low at 0.03%, suggesting this is primarily a proof-of-concept risk rather than an actively exploited threat.
Stored cross-site scripting (XSS) in projectworlds Expense Management System 1.0 allows authenticated users with high privileges to inject malicious scripts via the Currency Page create function (/public/admin/currencies/create), which are then reflected to other users who interact with that page. The vulnerability requires user interaction and high-level administrative privileges to exploit, resulting in limited real-world risk despite public exploit availability and low EPSS score.
Stored cross-site scripting (XSS) in projectworlds Expense Management System 1.0 allows authenticated high-privilege users to inject malicious scripts via the Roles Page create endpoint (/public/admin/roles/create), which are then reflected to other users. The vulnerability requires high-privilege authentication and user interaction to trigger, limiting real-world exploitation despite public POC availability and network accessibility.
Stored cross-site scripting (XSS) in projectworlds Expense Management System 1.0 allows high-privileged authenticated users to inject malicious scripts via the /public/admin/users/create endpoint, which are executed in the browsers of other users viewing the affected page. The vulnerability requires administrator privileges and user interaction (clicking a link), significantly limiting exploitation scope despite remote accessibility and publicly available proof-of-concept code.
Stored cross-site scripting (XSS) in projectworlds Gate Pass Management System 1.0 allows authenticated users to inject malicious scripts via the /add-pass.php endpoint, which execute in the browsers of other users who view the affected content. The vulnerability requires user interaction (UI:P) and authenticated access (PR:L), limiting its scope to reflected or stored XSS within an authenticated session. Publicly available exploit code exists, though EPSS exploitation probability remains very low at 0.03%, suggesting limited real-world weaponization despite public disclosure.
Stored cross-site scripting (XSS) in Iqbolshoh php-business-website admin/contact.php allows authenticated attackers with user interaction to inject malicious scripts via the twitter parameter, affecting data integrity for other users. The vulnerability affects a rolling-release project up to commit 10677743a8dfc281f85291a27cf63a0bce043c24, has published exploit code available, but carries low real-world risk due to authentication requirement (PR:L), user interaction dependency (UI:P), and limited impact scope (VI:L only). EPSS exploitation probability is 0.03% (7th percentile), indicating minimal practical exploitation likelihood despite public POC availability.
Stored Cross-Site Scripting (XSS) in Ultimate Addons for WPBakery Page Builder allows unauthenticated attackers to inject malicious scripts into web pages through improper input neutralization. The vulnerability affects versions prior to 3.21.1, enabling attackers to execute arbitrary JavaScript in the browsers of site visitors, potentially leading to session hijacking, credential theft, or malware distribution. No public exploit code has been identified at the time of analysis, and real-world exploitation probability is minimal (EPSS 0.02%).
Stored cross-site scripting in the Dynamic User Directory WordPress plugin (versions ≤ 2.3) allows a high-privileged authenticated user to inject persistent malicious scripts that execute in the browsers of other site visitors or administrators. Disclosed by Patchstack (audit@patchstack.com), the flaw carries a CVSS base score of 5.9 with Scope:Changed, reflecting cross-origin browser impact that can escalate to session hijacking even from a low-C/I impact rating. EPSS places exploitation probability at 0.02% (7th percentile), and no public exploit code or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting (XSS) in CrestaProject Attesa Extra WordPress plugin versions 1.4.7 and earlier allows authenticated users with low privileges to inject malicious scripts that execute in the browsers of other site visitors, potentially compromising session tokens, stealing sensitive data, or performing unauthorized actions. The vulnerability requires user interaction (clicking a malicious link) to trigger the payload, affects confidentiality, integrity, and availability, and carries a moderate CVSS score of 6.5 despite very low EPSS exploitation probability (0.02%, 7th percentile), suggesting limited real-world weaponization despite the vector permitting network-based attacks.
Stored cross-site scripting (XSS) in XLPlugins NextMove Lite WordPress plugin versions through 2.23.0 allows authenticated users with low privileges to inject malicious scripts into thank-you pages, affecting site visitors with escalated impact in multi-site contexts. The vulnerability requires user interaction (page visit) and leverages the plugin's improper input sanitization on web page generation. EPSS exploitation probability is low (0.02%), and no confirmed active exploitation has been reported; however, the stored nature and authenticated attack vector make it a meaningful risk for WordPress sites with untrusted user roles.
DOM-based cross-site scripting (XSS) in Designinvento DirectoryPress WordPress plugin through version 3.6.25 allows authenticated attackers with low privileges to inject malicious scripts that execute in the context of other users' browsers when they view affected pages. The vulnerability requires user interaction (clicking a malicious link) and can affect website visitors across the entire site, potentially leading to session hijacking, credential theft, or malware distribution. EPSS score of 0.02% indicates low exploitation probability despite the publicly available vulnerability details.
DOM-based cross-site scripting (XSS) in Estatik WordPress plugin through version 4.3.0 allows authenticated attackers with low privileges to inject malicious scripts that execute in the browsers of other users, potentially compromising session tokens, stealing sensitive data, or performing unauthorized actions with a victim's permissions. The vulnerability requires user interaction (clicking a malicious link) and affects the entire web application context. No public exploit code or active exploitation has been identified at the time of analysis, though the low EPSS score (0.02%) suggests limited real-world exploitation despite the moderate CVSS rating.
Stored cross-site scripting via CSRF in the CloudSearch WordPress plugin (versions up to and including 3.0.0) by Andrea Landonio allows a remote attacker to trick an authenticated user into submitting a forged request that injects persistent malicious script. Because the injected payload is stored and served to other users, its execution crosses a security scope (S:C), amplifying impact beyond the tricked victim. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.02%, 5th percentile), indicating negligible near-term mass-exploitation pressure.
A stored cross-site scripting (XSS) vulnerability can be exploited via cross-site request forgery (CSRF) in the NikanWP WooCommerce Reporting plugin for WordPress up to version 1.0.0. This allows remote attackers to trick an administrator into performing actions that inject malicious scripts into the plugin's reporting data, which then executes in the victim's browser when viewing the reports. No active exploitation or public exploit code is known, and the EPSS exploitation probability is extremely low (0.02%).
CSRF in Reloadly plugin for WordPress allows stored XSS via a crafted request lacking anti-CSRF tokens, enabling an attacker to inject persistent scripts by tricking an admin. The vulnerability affects all versions up to 2.0.1, with a CVSS base score of 7.1, but EPSS indicates only a 0.02% chance of exploitation, and no active exploitation or public exploit code is known.
Stored cross-site scripting (XSS) in icc0rz H5P WordPress plugin versions 1.16.0 and earlier allows authenticated users with limited privileges to inject malicious scripts that execute in the browsers of other users viewing affected content. The vulnerability stems from improper input sanitization during web page generation and requires user interaction (UI:R) to trigger, affecting confidentiality, integrity, and availability with a CVSS score of 6.5. Despite the moderate CVSS rating, the EPSS score of 0.02% indicates very low real-world exploitation probability at time of analysis, with no public exploit code or active exploitation confirmed.
Cross-Site Request Forgery (CSRF) in the Did Prestashop Display WordPress plugin (versions ≤1.0.30) allows unauthenticated attackers to inject persistent malicious scripts (stored XSS) by tricking an authenticated administrator into clicking a crafted link. The vulnerability carries a CVSS 3.1 base score of 7.1, but no active exploitation or public exploit code is known, and the EPSS exploitation probability is only 0.02%.
Stored cross-site scripting in the Next Page, Not Next Post WordPress plugin up to version 0.3.0 allows authenticated attackers with low privileges to inject malicious web scripts. These scripts execute in the browser of any user viewing the affected page, potentially leading to session hijacking, defacement, or redirection. The vulnerability has a low EPSS score (0.02%) and no known active exploitation or public exploit code at this time.
Stored cross-site scripting in the wp-mapbox-gl-js plugin for WordPress allows low-privilege authenticated attackers to inject arbitrary web scripts. When a victim views a page containing the malicious map, the script executes in their browser, enabling session hijacking, defacement, or credential theft. EPSS predicts extremely low exploitation probability and no active exploitation or public exploit code is known.
Stored Cross-Site Scripting (XSS) in the Events Maker WordPress plugin (≤ 1.6.14) allows authenticated users with low privileges to inject malicious scripts into event-related content. When a victim views the crafted event page, the script executes in their browser, potentially leading to session theft, defacement, or redirection. At time of analysis, no active exploitation or public proof-of-concept has been identified, and EPSS indicates a very low exploitation probability (0.02%).
Stored cross-site scripting (XSS) in the Blox Lite WordPress plugin (version <= 1.2.8) allows authenticated users with content creation privileges to inject arbitrary web scripts. When an administrator or high-privilege user views the affected content, the injected script executes in their browser, potentially leading to session hijacking, site defacement, or phishing. The vulnerability has a low EPSS score (0.02%) and no evidence of active exploitation, though public exploit code may be possible given the nature of XSS.
Stored Cross-Site Scripting (XSS) in the WordPress plugin Post List Featured Image allows authenticated attackers with low privileges to inject malicious scripts that execute in other users' browsers. Versions up to and including 0.5.9 are affected. Exploitation requires an authenticated session and user interaction, with no active exploitation or public exploit known at time of analysis; EPSS reflects a very low exploitation probability (0.02%).
Content injection via stored script-tag HTML in the xSmart WordPress theme through version 1.2.9.4 allows low-privileged authenticated users to embed unsanitized HTML - including script-bearing tags - into pages served to other site visitors. The flaw originates from inadequate output escaping in the Jthemes-developed theme and is classified as CWE-80 (Basic XSS / HTML tag injection). No public exploit code or active exploitation has been identified; EPSS sits at 0.02% (6th percentile), consistent with low threat-actor interest at time of analysis.
Cross-Site Request Forgery in the WP Business Hours WordPress plugin through version 1.4 allows attackers to inject arbitrary web scripts via stored XSS. An unauthenticated attacker can craft a malicious link that, when clicked by an authenticated administrator, triggers a CSRF request to the vulnerable plugin, resulting in persistent script execution in the browsers of other site visitors. The vulnerability has a CVSS score of 7.1 (High) but a very low EPSS exploitation probability (0.02%), and no active exploitation or public proof-of-concept is known.
Stored cross-site scripting via cross-site request forgery in the Awesome Testimonials WordPress plugin up to version 2.2.1 allows unauthenticated attackers to inject malicious scripts that execute in the browsers of site visitors. Exploitation requires a logged-in administrator to be tricked into clicking a crafted link, but no other special configuration is necessary. No active exploitation or public proof-of-concept has been identified at this time.
DOM-based cross-site scripting (XSS) in RomanCode MapSVG WordPress plugin versions up to 8.7.22 allows remote attackers to inject malicious scripts into web pages viewed by other users. The vulnerability requires user interaction (UI:R) and affects the confidentiality and integrity of web sessions. Although the CVSS score is 6.1 (medium), the EPSS exploitation probability is very low at 0.02%, and no public exploit code or active exploitation has been identified; this suggests the practical attack likelihood is minimal despite the moderate CVSS rating.
DOM-based cross-site scripting (XSS) in Marquee Addons for Elementor WordPress plugin versions through 3.8.2 allows remote attackers to inject malicious scripts through improper input neutralization during web page generation. The vulnerability requires user interaction (UI:R) and affects the confidentiality and integrity of affected websites. While CVSS scores 6.1 (medium), the 0.02% EPSS percentile indicates low real-world exploitation probability despite public awareness.
Stored cross-site scripting (XSS) in the Usercentrics CMP WordPress plugin (versions up to 1.0.9) allows authenticated administrator-level attackers to inject arbitrary JavaScript that executes in other users' browsers. Successful exploitation can lead to session hijacking, credential theft, or defacement of the consent management interface. No active exploitation or publicly available proof-of-concept has been identified at time of analysis, and EPSS indicates very low exploitation probability.
Stored cross-site scripting in the Tooltipy (bluet-keywords-tooltip-generator) WordPress plugin through version 5.5.9 allows an authenticated attacker with low privileges to inject persistent malicious scripts into keyword tooltip data. When any site visitor views a page rendering the poisoned tooltip, the script executes in their browser under the site's origin, enabling session hijacking, credential theft, or further client-side attacks. No public exploit or active exploitation has been identified; EPSS is 0.02%, reflecting minimal current threat actor interest.
Stored cross-site scripting in the Opal Service WordPress plugin (<=1.9.1) allows authenticated attackers to inject scripts that execute in the context of other users' sessions. The vulnerability arises from improper input neutralization during page generation, potentially leading to data theft or unauthorized actions. No active exploitation or public proof-of-concept has been identified, and EPSS risk is minimal.
Stored cross-site scripting in SiteGround Email Marketing plugin for WordPress <=1.7.1 allows authenticated attackers with low-privilege accounts to inject scripts that execute in the context of users who view the affected page, potentially leading to session hijacking or unauthorized actions. The vulnerability, reported by Patchstack, has a medium CVSS score (6.5) but a very low EPSS exploitation probability (0.02%) with no known public exploit or active exploitation at this time.
Stored cross-site scripting in the Rock Convert WordPress plugin (≤3.0.1) enables low-privilege authenticated users to inject scripts that execute in the browsers of other users viewing compromised pages, potentially hijacking sessions or phishing credentials. No active exploitation or public exploit code is known, and EPSS estimates a very low (0.02%) chance of exploitation. The risk is moderate for sites with untrusted users, but elevated for admin accounts that view the injected content.
We are tasked with synthesizing multi-source intelligence about CVE-2025-62910 into a comprehensive JSON analysis. Need to follow all rules. First, extract info from input: - CVE ID: CVE-2025-62910 - Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in deshine Video Gallery by Huzzaz huzzaz-video-gallery allows Stored XSS. This issue affects Video Gallery by Huzzaz: from n/a through <= 10.5. - CVSS: 6.5, vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L - CWE: CWE-79 - EPSS: 0.02%, percentile 7% - Reported by: audit@patchstack.com - Tags: XSS - References: [nvd] (None) https://patchstack.com/database/Wordpress/Plugin/huzzaz-video-gallery/vulnerability/wordpress-video-gallery-by-huzzaz-plugin-10-5-cross-site-scripting-xss-vulnerability?_s_id=cve Other info: patch information? No explicit patch version mentioned. Description says "from n/a through <= 10.5". No KEV status, no POC info. So exploitation status: "no public exploit identified at time of analysis". Need to note. Fields: 1. product_name: "1-3 words ONLY." The product is "Video Gallery by Huzzaz" (a WordPress plugin). Abbreviated? Could be "Video Gallery by Huzzaz" (3 words). Maybe "Huzzaz Video Gallery" as per description "Video Gallery by Huzzaz". I'll use "Huzzaz Video Gallery". 2. summary: 2-3 sentence plain-language synthesis. Must not start with generic "A vulnerability". Start with impact verb and product. For stored XSS, impact is "Stored cross-site scripting". So: "Stored cross-site scripting in the Huzzaz Video Gallery WordPress plugin <=10.5 allows authenticated attackers...". But check CVSS: PR:L (requires low privileges), UI:R (user interaction required for exploitation). So an attacker with low privileges (e.g., contributor) can inject a script that will be stored and executed when an admin or other user views the page. Score 6.5, medium. EPSS low. No active exploitation. So summary: "Stored cross-site scripting in the Huzzaz
Stored cross-site scripting (XSS) in the WordPress plugin Custom Post Type Attachment (custom-post-type-pdf-attachment) up to version 3.4.6 allows authenticated attackers with low privileges to inject malicious scripts that execute in the browsers of other users, potentially leading to session hijacking, defacement, or redirection to malicious sites. No active exploitation or public exploit code has been reported, but the vulnerability requires user interaction to trigger.
Stored cross-site scripting in the Query Posts WordPress plugin 0.3.2 and below allows an authenticated attacker with low privileges to inject malicious scripts that execute in the browser of users who view the affected page, leading to data theft or session hijacking. No active exploitation or public exploit code has been reported, and the EPSS exploitation probability is very low (0.02%).
Stored cross-site scripting in WordPress WP Geo plugin through version 3.5.1 enables authenticated attackers to inject malicious scripts that execute in victims' browsers. The vulnerability, reported by Patchstack, could allow session theft or content manipulation when a privileged user views a page containing the stored payload. No evidence of active exploitation exists, and the EPSS score is low (0.02%).
Stored cross-site scripting (XSS) in WPClever WPC Smart Messages for WooCommerce plugin versions up to 4.2.8 allows authenticated users with limited privileges to inject malicious scripts that execute in the browsers of other site visitors. The vulnerability requires user interaction (UI:R) and affects confidentiality and integrity through script injection, with a CVSS score of 5.4 reflecting moderate risk; however, the 0.02% EPSS score indicates minimal real-world exploitation probability at time of analysis, and no public exploit code or active exploitation has been confirmed.
Stored cross-site scripting in the Popular Posts by Webline WordPress plugin allows authenticated attackers to inject arbitrary web scripts into pages that will execute whenever a user accesses an affected page. The vulnerability affects plugin versions up to and including 1.1.1 and can lead to data theft or session hijacking when an administrator or other high-privilege user views the injected content. No active exploitation or public exploit code was identified at the time of analysis, and EPSS indicates a very low probability of widespread exploitation.
Stored cross-site scripting in Photospace Responsive WordPress plugin versions up to 2.2.0 allows authenticated administrators to inject malicious scripts that execute in the context of other users' sessions. The vulnerability, assigned CVE-2025-62899, can lead to limited compromise of confidentiality, integrity, and availability. With a very low EPSS score (0.02%) and no exploit code publicly available, current exploitation likelihood is minimal.
Stored cross-site scripting in the WordPress Links shortcode plugin up to version 1.8.3 allows authenticated attackers with low privileges to inject malicious scripts via the plugin's shortcode functionality. When a victim views a page containing the crafted shortcode, the injected script executes in their browser, leading to potential session theft, content manipulation, or redirection. No active exploitation or public exploit is reported, and EPSS indicates a low exploitation probability.
Improper neutralization of HTML script tags in WP Recipe Maker through version 10.0.x enables reflected cross-site scripting (XSS) attacks against users. The vulnerability affects the Brecht WP Recipe Maker WordPress plugin and requires user interaction (clicking a malicious link) to exploit. An attacker can inject arbitrary JavaScript into the page context, achieving code execution in the victim's browser with potential to steal session tokens or perform actions on behalf of authenticated users. The vulnerability has low real-world exploitation probability (EPSS 0.02%) and does not appear to be actively exploited in the wild.
Cross-Site Request Forgery (CSRF) in the Multilang Contact Form WordPress plugin (≤ 1.5) allows an attacker to inject stored cross-site scripting (XSS) payloads by tricking an authenticated administrator into clicking a malicious link. The stored XSS can then execute in the context of other users viewing the affected page, leading to cookie theft, session hijacking, or defacement. No public exploit code or active exploitation has been identified, and the EPSS score is very low (0.02%), indicating minimal current probability of large-scale attacks.
Stored Cross-Site Scripting vulnerability in ACF Recent Posts Widget WordPress plugin allows authenticated users with contributor-level access to inject malicious scripts into pages. Affects versions up to 5.9.3. EPSS score is very low (0.02%) and no public exploit or KEV listing identified, reducing immediate exploitation risk.
DOM-based cross-site scripting (XSS) in King Addons for Elementor plugin versions up to 51.1.61 allows authenticated users with low privileges to inject malicious scripts that execute in other users' browsers when they interact with affected pages. The vulnerability requires user interaction (clicking a link) and affects the confidentiality and integrity of website content, with an EPSS score of 0.02% indicating low real-world exploitation probability despite the moderate CVSS rating of 5.4.
Cross-site request forgery enables stored XSS injection in WordPress Pricing Table builder plugin versions up to 1.5.3. Remote unauthenticated attackers can trick authenticated WordPress administrators into executing malicious requests that inject persistent JavaScript payloads into pricing table configurations. EPSS score of 0.02% (4th percentile) indicates low observed exploitation probability, and no active exploitation has been confirmed via CISA KEV. The changed scope (S:C) in CVSS vector indicates potential for broader site compromise beyond the plugin's security context.
DOM-based cross-site scripting (XSS) in RexTheme WP VR WordPress plugin up to version 8.5.48 allows authenticated users with low privileges to inject malicious scripts that execute in other users' browsers with site-wide scope. The vulnerability requires user interaction (UI:R) and affects confidentiality, integrity, and availability equally. Exploitation requires valid WordPress account credentials but carries moderate real-world risk given the low EPSS score (0.02%) and authenticated requirement despite the CVSS 6.5 rating.
Reflected cross-site scripting in Mingsoft MCMS v6.0.1 allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by delivering a crafted URL containing a malicious payload. The CVSS scope change (S:C) indicates impact extends beyond the web application itself into the victim's browser trust context, enabling session hijacking or credential theft. No public exploit identified at time of analysis beyond the referenced GitHub gist, and EPSS of 0.22% (13th percentile) signals very low current exploitation interest.
Stored cross-site scripting on the KeeneticOS 'Wireless ISP' page enables a physically proximate attacker to compromise a Keenetic router by injecting a malicious payload-likely via a crafted nearby wireless network name (SSID)-that executes in an authenticated administrator's browser session. Successful exploitation allows the attacker to create additional users with full administrative permissions, resulting in complete device takeover. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS probability stands at 0.03%, indicating limited current exploitation activity.
Reflected cross-site scripting in Proliz Software OBS (Student Affairs Information System) prior to V26.0401 allows remote attackers to execute arbitrary JavaScript in a victim's browser session after luring them to click a crafted link. The high CVSS of 7.6 reflects unauthenticated network exploitation with high confidentiality impact, though no public exploit identified at time of analysis and EPSS data was not provided. The flaw was reported by Turkey's national CERT (USOM), indicating regional relevance for Turkish higher-education institutions that use this Student Affairs platform.
Reflected XSS in AcBakImzala, ArkSigner's document signing application, affects all versions before v5.1.4 and allows unauthenticated remote attackers to inject and execute malicious scripts in a victim's browser. The attack requires the victim to interact with a crafted URL, limiting automated exploitation, but the low attack complexity and absence of authentication requirements make social-engineering-based delivery straightforward. No public exploit code or CISA KEV listing has been identified; EPSS is very low at 0.03% (9th percentile), consistent with limited observed exploitation interest at this time.
Stored Cross-Site Scripting (XSS) can be injected into WordPress sites running the Video Blogster Lite plugin up to version 1.2 via a Cross-Site Request Forgery (CSRF) attack. An unauthenticated attacker can trick an authenticated administrator into clicking a crafted link, leading to persistent JavaScript execution in the browsers of site visitors. There is no evidence of active exploitation or public exploit code at this time, and the EPSS model predicts a very low probability of widespread use.
Stored cross-site scripting in the Werk aan de Muur WordPress plugin (≤1.5) allows authenticated users with high privileges to inject malicious scripts that execute in other administrators’ browser contexts, potentially leading to session hijacking or content manipulation. No public exploit code found; not listed in CISA KEV or reported as actively exploited. EPSS score indicates very low exploitation probability.
Stored cross-site scripting vulnerability in the Colibri Page Builder WordPress plugin allows authenticated editors or administrators to inject malicious scripts into pages. When other users view the affected page, the script executes, potentially leading to limited data theft, defacement, or session hijacking. Exploitation requires high privileges and user interaction; no active exploitation or public exploit code is known, and EPSS predicts a very low exploitation probability (0.02%).
Reflected cross-site scripting in the Easy WooCommerce Customizer WordPress plugin (versions up to and including 1.0.2) allows unauthenticated remote attackers to inject arbitrary JavaScript into a victim's browser session by tricking them into clicking a crafted URL. The vulnerability carries a changed scope (S:C), meaning injected script runs in the victim's browser context and can access cookies, session tokens, or perform actions on behalf of the authenticated user. No public exploit code has been identified and EPSS probability is minimal at 0.03%, indicating very low current real-world exploitation activity.
Stored cross-site scripting in the Doctreat WordPress Theme through version 1.6.7 allows authenticated attackers to inject HTML and script code, enabling client-side code injection in visitors' browsers. Exploitation requires a contributor-level WordPress account but no user interaction from the victim. No public exploit code or active exploitation has been reported; EPSS indicates a very low likelihood of widespread attacks.
Reflected XSS in the NEX-Forms LITE WordPress plugin (all versions prior to 8.2) allows unauthenticated remote attackers to inject and execute malicious JavaScript in a victim's browser by luring them to a crafted URL. The script runs in the browser's page context with scope change, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit code or active exploitation has been identified; the EPSS score of 0.03% at the 8th percentile reflects negligible current exploitation activity.
Reflected cross-site scripting in WP Tactical Popup plugin for WordPress (≤1.1) allows unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser via a crafted URL. Exploitation requires user interaction (clicking a malicious link), potentially leading to session hijacking or content manipulation. No active exploitation or public exploit has been identified at this time.
Reflected Cross-Site Scripting (XSS) in the Munzir myshouts-shoutbox WordPress plugin (versions ≤ 0.9) allows unauthenticated attackers to inject and execute arbitrary web scripts in a victim’s browser by tricking them into clicking a crafted link. The vulnerability arises from improper neutralization of user input during web page generation, enabling script execution in the context of the affected site. No active exploitation or public exploit code has been identified, and EPSS indicates a low probability of real-world exploitation (0.03%).
Reflected cross-site scripting in the WordPress Likert Survey Master plugin allows unauthenticated attackers to inject arbitrary web scripts via a crafted URL. Successful exploitation requires tricking an administrator into clicking the link while authenticated, potentially leading to session hijacking or malicious actions performed in the victim's browser context. No active exploitation or public exploit code has been identified, and the EPSS score indicates very low exploit likelihood (0.07%).
Stored cross-site scripting in the Toast Mobile Menu WordPress plugin (<=1.0.8) allows unauthenticated attackers to inject malicious scripts that execute when a user views an infected page, potentially leading to session hijacking or content manipulation. No active exploitation or public proof-of-concept is confirmed at time of analysis, and the EPSS score indicates a low probability of real-world attacks.
Reflected cross-site scripting in the MultiSite Clone Duplicator WordPress plugin through version 1.5.3 allows attackers to execute arbitrary JavaScript in victims' browsers when they click a crafted link. Successful exploitation could lead to session hijacking, data theft, or unauthorized actions on behalf of the user. No active exploitation or public exploits are known, and EPSS predicts very low exploitation likelihood (0.06%).
Reflected cross-site scripting (XSS) in the Contact Form by Supsystic WordPress plugin (versions through 1.7.36) allows unauthenticated remote attackers to execute malicious JavaScript in victims' browsers via crafted URLs. The vulnerability enables session hijacking, credential theft, and malicious actions performed in the context of the victim's authenticated session. EPSS probability indicates low exploitation likelihood (0.07%, 22nd percentile) with no public exploit identified at time of analysis.
Reflected Cross-Site Scripting (XSS) in WordPress plugin oik-privacy-policy versions ≤1.4.10 allows remote attackers to execute arbitrary JavaScript in victims' browsers. Exploitation requires user interaction (victim must click malicious link). EPSS probability is low (0.07%, 22nd percentile), and no active exploitation is confirmed. Reported by Patchstack security audit team, indicating professional vulnerability disclosure.
Reflected cross-site scripting in NextMove Lite (WordPress thank-you page plugin) versions ≤2.24.0 allows unauthenticated remote attackers to execute malicious JavaScript in victim browsers via crafted URLs. The vulnerability requires user interaction (clicking a malicious link) but achieves scope change per CVSS vector, enabling session hijacking, credential theft, or malicious actions under victim's WordPress session. EPSS score of 0.03% (8th percentile) indicates low probability of mass exploitation, though XSS vulnerabilities are commonly used in targeted social engineering campaigns against WordPress site administrators.
Reflected cross-site scripting in the CropRefine WordPress plugin (<= 1.2.1) allows unauthenticated attackers to inject arbitrary web scripts by tricking a user into clicking a crafted link. The vulnerability, reported by Patchstack, has a CVSS 7.1 high severity but a very low EPSS exploitation probability (0.03%), and no active exploitation or public exploit code has been identified.
Reflected cross-site scripting in bbPress Notify plugin versions up to 2.19.5 allows unauthenticated remote attackers to execute malicious JavaScript in victim browsers through crafted URLs. The vulnerability stems from improper input sanitization during web page generation (CWE-79). With CVSS 7.1 and changed scope (S:C), successful exploitation enables session hijacking, credential theft, and malicious actions in the victim's context. EPSS score of 0.03% (8th percentile) indicates low observed exploitation probability, and no active exploitation is confirmed (not in CISA KEV), though Patchstack has publicly documented the vulnerability.
Reflected cross-site scripting in Robokassa payment gateway for WooCommerce (versions ≤1.8.5) allows remote attackers to execute malicious JavaScript in victim browsers through specially crafted URLs. The scope-change CVSS flag indicates attackers can impact resources beyond the vulnerable plugin itself, potentially compromising WooCommerce admin sessions or customer payment data. EPSS probability is low (0.03%, 8th percentile), and no active exploitation or public POC has been identified at time of analysis.
Reflected cross-site scripting in Email Attachment by Order Status & Products WordPress plugin versions ≤1.0.1 allows remote unauthenticated attackers to execute arbitrary JavaScript in victim browsers through low-complexity attacks requiring user interaction. The vulnerability enables cross-site scope impact (S:C), allowing attackers to compromise confidentiality, integrity, and availability at a low level across security boundaries. No active exploitation or public POC is confirmed at time of analysis, with EPSS data unavailable for this recently published CVE.
Stored cross-site scripting (XSS) in Crocoblock JetElements For Elementor plugin through version 2.7.8 allows authenticated users with low privileges to inject malicious scripts that execute in the browsers of site visitors, potentially compromising site integrity and user sessions. The vulnerability requires user interaction (UI:R) and affects authenticated users (PR:L), limiting immediate blast radius but posing persistent risk to WordPress installations using this Elementor extension.
Stored XSS in Crocoblock JetEngine WordPress plugin versions 3.7.3 and earlier allows authenticated users with limited privileges to inject malicious scripts that execute in the browsers of other users, including administrators. The vulnerability requires user interaction (UI:R) to trigger and affects confidentiality, integrity, and availability with limited scope. With EPSS at 0.07% and no KEV status indicating active exploitation, this represents a low-probability but real risk requiring patching in multi-user WordPress environments.
Stored cross-site scripting (XSS) in Crocoblock JetBlocks For Elementor plugin versions up to 1.3.18 allows authenticated users with low privileges to inject malicious scripts that execute in the browsers of other site visitors. The vulnerability requires user interaction (UI:R) and affects confidentiality and integrity, with an EPSS score of 0.06% indicating very low real-world exploitation likelihood despite the moderate CVSS 5.4 rating.
Reflected cross-site scripting (XSS) in Crocoblock JetBlog WordPress plugin through version 2.4.4 allows authenticated users to inject malicious scripts that execute in other users' browsers when they interact with crafted links. The vulnerability requires user interaction (UI:R) and authenticated access (PR:L), limiting but not eliminating real-world risk; EPSS score of 0.07% indicates low exploitation probability despite the moderate CVSS 6.5 rating.
Stored Cross-Site Scripting (XSS) in Crocoblock JetBlog WordPress plugin through version 2.4.4.1 allows authenticated users with low privileges to inject malicious scripts that persist in web pages and execute in the browsers of other site visitors, potentially compromising session tokens, stealing sensitive data, or performing unauthorized actions. EPSS score of 0.07% and lack of public exploit code indicate low real-world exploitation probability despite the moderate CVSS 6.5 score.
Reflected cross-site scripting (XSS) in Crocoblock JetSearch WordPress plugin versions through 3.5.10 allows unauthenticated remote attackers to execute arbitrary JavaScript in victim browsers via maliciously crafted URLs. The vulnerability requires user interaction (clicking a malicious link) but carries a changed scope, meaning successful exploitation can impact resources beyond the vulnerable component. EPSS probability is low (0.07%, 22nd percentile), indicating minimal observed exploitation attempts, and no public exploit code or CISA KEV listing exists at time of analysis.
Cross-site scripting (XSS) in Simple Food Ordering System 1.0 allows remote attackers to inject malicious scripts via unsanitized input parameters (pname, category, price) in the /editproduct.php endpoint. The vulnerability requires user interaction (UI:P) but carries low integrity impact and has publicly available exploit code; EPSS probability remains minimal (0.03%) despite public POC availability, suggesting limited real-world adoption or exploitation barriers.
Stored cross-site scripting (XSS) in Simple Food Ordering System 1.0 allows remote attackers to inject malicious scripts via the cname parameter in /addcategory.php, which are executed in the browsers of users viewing affected content. The vulnerability requires user interaction (UI:P) to exploit but has a public proof-of-concept available. Despite the low CVSS score (2.1) and minimal EPSS percentile (10%), the combination of remote network access and public exploit code necessitates prompt patching to prevent account compromise and session hijacking.
Stored cross-site scripting (XSS) in Simple Food Ordering System 1.0 allows remote attackers to inject malicious scripts through the pname, category, or price parameters in /addproduct.php, requiring user interaction to trigger payload execution. Public exploit code is available, and the vulnerability carries low severity (CVSS 2.1) due to the requirement for user interaction and limited scope of impact.
Reflected cross-site scripting (XSS) in Simple Food Ordering System 1.0 via the pname parameter in /editcategory.php allows remote attackers to inject malicious JavaScript that executes in users' browsers with minimal user interaction. The vulnerability requires user interaction (clicking a malicious link) but has low technical complexity and publicly available exploit code, though active exploitation remains unconfirmed and real-world impact is limited by the low EPSS score of 0.03% despite public POC availability.
Reflected cross-site scripting (XSS) in Suishang Enterprise-Level B2B2C Multi-User Mall System 1.0 allows remote attackers to inject malicious scripts via the keywords parameter in the /i/359 endpoint. The vulnerability requires user interaction (clicking a malicious link) and results in limited integrity impact. Although exploit code has been publicly disclosed and the vendor did not respond to early disclosure, the EPSS score of 0.03% and low CVSS impact (2.1) suggest minimal real-world exploitation probability.
Reflected cross-site scripting (XSS) in Suishang Enterprise-Level B2B2C Multi-User Mall System 1.0 allows remote attackers to inject malicious scripts via the category_id parameter in the /Point/index/activity_state endpoint. The vulnerability requires user interaction (UI:P) to trigger and has low integrity impact, but publicly available exploit code exists. The vendor did not respond to disclosure notifications.
Stored cross-site scripting (XSS) in code-projects Client Details System 1.0 allows authenticated users with high privileges to inject malicious scripts via the /admin/manage-users.php endpoint, which are then executed in the browsers of other users who interact with the managed user data. The vulnerability requires administrative privileges and user interaction (UI:P) to exploit, resulting in limited integrity impact (VI:L). Public exploit code is available, though the extremely low CVSS score (1.9) and EPSS probability (0.04%) reflect the high privilege barrier and user interaction requirement that significantly constrain real-world risk.
Stored cross-site scripting (XSS) in code-projects Client Details System 1.0 allows authenticated high-privilege users to inject malicious scripts into the /admin/clientview.php endpoint that execute in the context of other users' browsers. The vulnerability requires user interaction (victim must view affected content) and high administrative privileges to exploit, limiting real-world risk despite public exploit disclosure. EPSS score of 0.03% reflects the stringent authentication and interaction requirements that prevent widespread automated exploitation.
Cross-site scripting (XSS) in code-projects Client Details System 1.0 allows high-privileged authenticated users to inject malicious scripts via the /update-clients.php endpoint, requiring user interaction to execute. The vulnerability carries a low CVSS score of 1.9 due to high privilege requirements (PR:H) and mandatory user interaction (UI:P), but publicly available exploit code exists, making it actionable for insider threats or social engineering scenarios targeting administrators.
Cross-site scripting (XSS) in code-projects Client Details System 1.0 allows remote attackers with high privileges and user interaction to inject malicious scripts via the /welcome.php file, resulting in limited integrity impact. The vulnerability has been publicly disclosed with exploit code available, though real-world exploitation is constrained by the requirement for high administrative privileges and user interaction, reflected in the exceptionally low CVSS score of 1.9 and EPSS probability of 0.03%.
Stored cross-site scripting (XSS) in LearnHouse Account Setting Page allows authenticated users to inject malicious scripts via the /dash/org/settings/previews endpoint, affecting all versions up to commit 98dfad76aad70711a8113f6c1fdabfccf10509ca. An attacker with valid credentials can craft a malicious request that, when viewed by another user (requiring user interaction), executes arbitrary JavaScript in their browser context with potential for data theft or session hijacking. Public exploit code exists, though exploitation requires both login credentials and victim interaction, limiting real-world impact despite the network-accessible vector.
Cross-site scripting (XSS) vulnerability in abhicodebox ModernShop 20250922 allows remote attackers to inject malicious scripts via the 'q' parameter in the /search endpoint, requiring user interaction to execute. The vulnerability has a published exploit and low CVSS score (2.1) due to user interaction requirement, but affects the integrity of victim sessions with EPSS exploitation probability of 0.03% indicating minimal real-world exploitation likelihood.
Stored cross-site scripting (XSS) in OpenWGA 7.11.12 Build 737 Admin UI allows authenticated users with low privileges to inject malicious scripts that execute in the browsers of other users who view the affected interface. Exploitation requires user interaction (clicking a crafted link or visiting a manipulated page), limiting real-world impact despite remote accessibility. Public exploit disclosure exists, but EPSS scoring (0.03%, 7th percentile) and low CVSS severity (2.0) indicate minimal active exploitation likelihood in real deployments.
Cross-site scripting (XSS) in Chatwoot up to version 4.7.0 allows remote attackers to inject malicious scripts via the Link argument in the IframeLoader.vue Admin Interface component, requiring user interaction to trigger. The vulnerability has a low CVSS score (2.1) and EPSS percentile (10%) but publicly available exploit code exists, indicating the attack is straightforward to execute once a victim clicks a crafted link.
Reflected cross-site scripting (XSS) in Simple E-Banking System 1.0 allows remote attackers to inject malicious scripts via the Username parameter in /eBank/register.php. The vulnerability requires user interaction (clicking a malicious link) but has low impact on confidentiality and integrity. Publicly available exploit code exists, though EPSS scoring (0.03%, 10th percentile) suggests limited real-world exploitation despite XSS being a common attack vector.
Stored cross-site scripting in projectworlds Expense Management System 1.0 allows high-privileged authenticated users to inject malicious scripts via the Expense Categories creation page, affecting other users who view the poisoned content. The vulnerability requires administrator-level access and user interaction (rendering the page), limiting real-world impact despite remote network delivery. Publicly available exploit code exists; EPSS exploitation probability is very low at 0.03%, suggesting this is primarily a proof-of-concept risk rather than an actively exploited threat.
Stored cross-site scripting (XSS) in projectworlds Expense Management System 1.0 allows authenticated users with high privileges to inject malicious scripts via the Currency Page create function (/public/admin/currencies/create), which are then reflected to other users who interact with that page. The vulnerability requires user interaction and high-level administrative privileges to exploit, resulting in limited real-world risk despite public exploit availability and low EPSS score.
Stored cross-site scripting (XSS) in projectworlds Expense Management System 1.0 allows authenticated high-privilege users to inject malicious scripts via the Roles Page create endpoint (/public/admin/roles/create), which are then reflected to other users. The vulnerability requires high-privilege authentication and user interaction to trigger, limiting real-world exploitation despite public POC availability and network accessibility.
Stored cross-site scripting (XSS) in projectworlds Expense Management System 1.0 allows high-privileged authenticated users to inject malicious scripts via the /public/admin/users/create endpoint, which are executed in the browsers of other users viewing the affected page. The vulnerability requires administrator privileges and user interaction (clicking a link), significantly limiting exploitation scope despite remote accessibility and publicly available proof-of-concept code.
Stored cross-site scripting (XSS) in projectworlds Gate Pass Management System 1.0 allows authenticated users to inject malicious scripts via the /add-pass.php endpoint, which execute in the browsers of other users who view the affected content. The vulnerability requires user interaction (UI:P) and authenticated access (PR:L), limiting its scope to reflected or stored XSS within an authenticated session. Publicly available exploit code exists, though EPSS exploitation probability remains very low at 0.03%, suggesting limited real-world weaponization despite public disclosure.
Stored cross-site scripting (XSS) in Iqbolshoh php-business-website admin/contact.php allows authenticated attackers with user interaction to inject malicious scripts via the twitter parameter, affecting data integrity for other users. The vulnerability affects a rolling-release project up to commit 10677743a8dfc281f85291a27cf63a0bce043c24, has published exploit code available, but carries low real-world risk due to authentication requirement (PR:L), user interaction dependency (UI:P), and limited impact scope (VI:L only). EPSS exploitation probability is 0.03% (7th percentile), indicating minimal practical exploitation likelihood despite public POC availability.
Stored Cross-Site Scripting (XSS) in Ultimate Addons for WPBakery Page Builder allows unauthenticated attackers to inject malicious scripts into web pages through improper input neutralization. The vulnerability affects versions prior to 3.21.1, enabling attackers to execute arbitrary JavaScript in the browsers of site visitors, potentially leading to session hijacking, credential theft, or malware distribution. No public exploit code has been identified at the time of analysis, and real-world exploitation probability is minimal (EPSS 0.02%).
Stored cross-site scripting in the Dynamic User Directory WordPress plugin (versions ≤ 2.3) allows a high-privileged authenticated user to inject persistent malicious scripts that execute in the browsers of other site visitors or administrators. Disclosed by Patchstack (audit@patchstack.com), the flaw carries a CVSS base score of 5.9 with Scope:Changed, reflecting cross-origin browser impact that can escalate to session hijacking even from a low-C/I impact rating. EPSS places exploitation probability at 0.02% (7th percentile), and no public exploit code or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting (XSS) in CrestaProject Attesa Extra WordPress plugin versions 1.4.7 and earlier allows authenticated users with low privileges to inject malicious scripts that execute in the browsers of other site visitors, potentially compromising session tokens, stealing sensitive data, or performing unauthorized actions. The vulnerability requires user interaction (clicking a malicious link) to trigger the payload, affects confidentiality, integrity, and availability, and carries a moderate CVSS score of 6.5 despite very low EPSS exploitation probability (0.02%, 7th percentile), suggesting limited real-world weaponization despite the vector permitting network-based attacks.
Stored cross-site scripting (XSS) in XLPlugins NextMove Lite WordPress plugin versions through 2.23.0 allows authenticated users with low privileges to inject malicious scripts into thank-you pages, affecting site visitors with escalated impact in multi-site contexts. The vulnerability requires user interaction (page visit) and leverages the plugin's improper input sanitization on web page generation. EPSS exploitation probability is low (0.02%), and no confirmed active exploitation has been reported; however, the stored nature and authenticated attack vector make it a meaningful risk for WordPress sites with untrusted user roles.
DOM-based cross-site scripting (XSS) in Designinvento DirectoryPress WordPress plugin through version 3.6.25 allows authenticated attackers with low privileges to inject malicious scripts that execute in the context of other users' browsers when they view affected pages. The vulnerability requires user interaction (clicking a malicious link) and can affect website visitors across the entire site, potentially leading to session hijacking, credential theft, or malware distribution. EPSS score of 0.02% indicates low exploitation probability despite the publicly available vulnerability details.
DOM-based cross-site scripting (XSS) in Estatik WordPress plugin through version 4.3.0 allows authenticated attackers with low privileges to inject malicious scripts that execute in the browsers of other users, potentially compromising session tokens, stealing sensitive data, or performing unauthorized actions with a victim's permissions. The vulnerability requires user interaction (clicking a malicious link) and affects the entire web application context. No public exploit code or active exploitation has been identified at the time of analysis, though the low EPSS score (0.02%) suggests limited real-world exploitation despite the moderate CVSS rating.
Stored cross-site scripting via CSRF in the CloudSearch WordPress plugin (versions up to and including 3.0.0) by Andrea Landonio allows a remote attacker to trick an authenticated user into submitting a forged request that injects persistent malicious script. Because the injected payload is stored and served to other users, its execution crosses a security scope (S:C), amplifying impact beyond the tricked victim. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.02%, 5th percentile), indicating negligible near-term mass-exploitation pressure.
A stored cross-site scripting (XSS) vulnerability can be exploited via cross-site request forgery (CSRF) in the NikanWP WooCommerce Reporting plugin for WordPress up to version 1.0.0. This allows remote attackers to trick an administrator into performing actions that inject malicious scripts into the plugin's reporting data, which then executes in the victim's browser when viewing the reports. No active exploitation or public exploit code is known, and the EPSS exploitation probability is extremely low (0.02%).
CSRF in Reloadly plugin for WordPress allows stored XSS via a crafted request lacking anti-CSRF tokens, enabling an attacker to inject persistent scripts by tricking an admin. The vulnerability affects all versions up to 2.0.1, with a CVSS base score of 7.1, but EPSS indicates only a 0.02% chance of exploitation, and no active exploitation or public exploit code is known.
Stored cross-site scripting (XSS) in icc0rz H5P WordPress plugin versions 1.16.0 and earlier allows authenticated users with limited privileges to inject malicious scripts that execute in the browsers of other users viewing affected content. The vulnerability stems from improper input sanitization during web page generation and requires user interaction (UI:R) to trigger, affecting confidentiality, integrity, and availability with a CVSS score of 6.5. Despite the moderate CVSS rating, the EPSS score of 0.02% indicates very low real-world exploitation probability at time of analysis, with no public exploit code or active exploitation confirmed.
Cross-Site Request Forgery (CSRF) in the Did Prestashop Display WordPress plugin (versions ≤1.0.30) allows unauthenticated attackers to inject persistent malicious scripts (stored XSS) by tricking an authenticated administrator into clicking a crafted link. The vulnerability carries a CVSS 3.1 base score of 7.1, but no active exploitation or public exploit code is known, and the EPSS exploitation probability is only 0.02%.
Stored cross-site scripting in the Next Page, Not Next Post WordPress plugin up to version 0.3.0 allows authenticated attackers with low privileges to inject malicious web scripts. These scripts execute in the browser of any user viewing the affected page, potentially leading to session hijacking, defacement, or redirection. The vulnerability has a low EPSS score (0.02%) and no known active exploitation or public exploit code at this time.
Stored cross-site scripting in the wp-mapbox-gl-js plugin for WordPress allows low-privilege authenticated attackers to inject arbitrary web scripts. When a victim views a page containing the malicious map, the script executes in their browser, enabling session hijacking, defacement, or credential theft. EPSS predicts extremely low exploitation probability and no active exploitation or public exploit code is known.
Stored Cross-Site Scripting (XSS) in the Events Maker WordPress plugin (≤ 1.6.14) allows authenticated users with low privileges to inject malicious scripts into event-related content. When a victim views the crafted event page, the script executes in their browser, potentially leading to session theft, defacement, or redirection. At time of analysis, no active exploitation or public proof-of-concept has been identified, and EPSS indicates a very low exploitation probability (0.02%).
Stored cross-site scripting (XSS) in the Blox Lite WordPress plugin (version <= 1.2.8) allows authenticated users with content creation privileges to inject arbitrary web scripts. When an administrator or high-privilege user views the affected content, the injected script executes in their browser, potentially leading to session hijacking, site defacement, or phishing. The vulnerability has a low EPSS score (0.02%) and no evidence of active exploitation, though public exploit code may be possible given the nature of XSS.
Stored Cross-Site Scripting (XSS) in the WordPress plugin Post List Featured Image allows authenticated attackers with low privileges to inject malicious scripts that execute in other users' browsers. Versions up to and including 0.5.9 are affected. Exploitation requires an authenticated session and user interaction, with no active exploitation or public exploit known at time of analysis; EPSS reflects a very low exploitation probability (0.02%).
Content injection via stored script-tag HTML in the xSmart WordPress theme through version 1.2.9.4 allows low-privileged authenticated users to embed unsanitized HTML - including script-bearing tags - into pages served to other site visitors. The flaw originates from inadequate output escaping in the Jthemes-developed theme and is classified as CWE-80 (Basic XSS / HTML tag injection). No public exploit code or active exploitation has been identified; EPSS sits at 0.02% (6th percentile), consistent with low threat-actor interest at time of analysis.
Cross-Site Request Forgery in the WP Business Hours WordPress plugin through version 1.4 allows attackers to inject arbitrary web scripts via stored XSS. An unauthenticated attacker can craft a malicious link that, when clicked by an authenticated administrator, triggers a CSRF request to the vulnerable plugin, resulting in persistent script execution in the browsers of other site visitors. The vulnerability has a CVSS score of 7.1 (High) but a very low EPSS exploitation probability (0.02%), and no active exploitation or public proof-of-concept is known.
Stored cross-site scripting via cross-site request forgery in the Awesome Testimonials WordPress plugin up to version 2.2.1 allows unauthenticated attackers to inject malicious scripts that execute in the browsers of site visitors. Exploitation requires a logged-in administrator to be tricked into clicking a crafted link, but no other special configuration is necessary. No active exploitation or public proof-of-concept has been identified at this time.
DOM-based cross-site scripting (XSS) in RomanCode MapSVG WordPress plugin versions up to 8.7.22 allows remote attackers to inject malicious scripts into web pages viewed by other users. The vulnerability requires user interaction (UI:R) and affects the confidentiality and integrity of web sessions. Although the CVSS score is 6.1 (medium), the EPSS exploitation probability is very low at 0.02%, and no public exploit code or active exploitation has been identified; this suggests the practical attack likelihood is minimal despite the moderate CVSS rating.
DOM-based cross-site scripting (XSS) in Marquee Addons for Elementor WordPress plugin versions through 3.8.2 allows remote attackers to inject malicious scripts through improper input neutralization during web page generation. The vulnerability requires user interaction (UI:R) and affects the confidentiality and integrity of affected websites. While CVSS scores 6.1 (medium), the 0.02% EPSS percentile indicates low real-world exploitation probability despite public awareness.
Stored cross-site scripting (XSS) in the Usercentrics CMP WordPress plugin (versions up to 1.0.9) allows authenticated administrator-level attackers to inject arbitrary JavaScript that executes in other users' browsers. Successful exploitation can lead to session hijacking, credential theft, or defacement of the consent management interface. No active exploitation or publicly available proof-of-concept has been identified at time of analysis, and EPSS indicates very low exploitation probability.
Stored cross-site scripting in the Tooltipy (bluet-keywords-tooltip-generator) WordPress plugin through version 5.5.9 allows an authenticated attacker with low privileges to inject persistent malicious scripts into keyword tooltip data. When any site visitor views a page rendering the poisoned tooltip, the script executes in their browser under the site's origin, enabling session hijacking, credential theft, or further client-side attacks. No public exploit or active exploitation has been identified; EPSS is 0.02%, reflecting minimal current threat actor interest.
Stored cross-site scripting in the Opal Service WordPress plugin (<=1.9.1) allows authenticated attackers to inject scripts that execute in the context of other users' sessions. The vulnerability arises from improper input neutralization during page generation, potentially leading to data theft or unauthorized actions. No active exploitation or public proof-of-concept has been identified, and EPSS risk is minimal.
Stored cross-site scripting in SiteGround Email Marketing plugin for WordPress <=1.7.1 allows authenticated attackers with low-privilege accounts to inject scripts that execute in the context of users who view the affected page, potentially leading to session hijacking or unauthorized actions. The vulnerability, reported by Patchstack, has a medium CVSS score (6.5) but a very low EPSS exploitation probability (0.02%) with no known public exploit or active exploitation at this time.
Stored cross-site scripting in the Rock Convert WordPress plugin (≤3.0.1) enables low-privilege authenticated users to inject scripts that execute in the browsers of other users viewing compromised pages, potentially hijacking sessions or phishing credentials. No active exploitation or public exploit code is known, and EPSS estimates a very low (0.02%) chance of exploitation. The risk is moderate for sites with untrusted users, but elevated for admin accounts that view the injected content.
We are tasked with synthesizing multi-source intelligence about CVE-2025-62910 into a comprehensive JSON analysis. Need to follow all rules. First, extract info from input: - CVE ID: CVE-2025-62910 - Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in deshine Video Gallery by Huzzaz huzzaz-video-gallery allows Stored XSS. This issue affects Video Gallery by Huzzaz: from n/a through <= 10.5. - CVSS: 6.5, vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L - CWE: CWE-79 - EPSS: 0.02%, percentile 7% - Reported by: audit@patchstack.com - Tags: XSS - References: [nvd] (None) https://patchstack.com/database/Wordpress/Plugin/huzzaz-video-gallery/vulnerability/wordpress-video-gallery-by-huzzaz-plugin-10-5-cross-site-scripting-xss-vulnerability?_s_id=cve Other info: patch information? No explicit patch version mentioned. Description says "from n/a through <= 10.5". No KEV status, no POC info. So exploitation status: "no public exploit identified at time of analysis". Need to note. Fields: 1. product_name: "1-3 words ONLY." The product is "Video Gallery by Huzzaz" (a WordPress plugin). Abbreviated? Could be "Video Gallery by Huzzaz" (3 words). Maybe "Huzzaz Video Gallery" as per description "Video Gallery by Huzzaz". I'll use "Huzzaz Video Gallery". 2. summary: 2-3 sentence plain-language synthesis. Must not start with generic "A vulnerability". Start with impact verb and product. For stored XSS, impact is "Stored cross-site scripting". So: "Stored cross-site scripting in the Huzzaz Video Gallery WordPress plugin <=10.5 allows authenticated attackers...". But check CVSS: PR:L (requires low privileges), UI:R (user interaction required for exploitation). So an attacker with low privileges (e.g., contributor) can inject a script that will be stored and executed when an admin or other user views the page. Score 6.5, medium. EPSS low. No active exploitation. So summary: "Stored cross-site scripting in the Huzzaz
Stored cross-site scripting (XSS) in the WordPress plugin Custom Post Type Attachment (custom-post-type-pdf-attachment) up to version 3.4.6 allows authenticated attackers with low privileges to inject malicious scripts that execute in the browsers of other users, potentially leading to session hijacking, defacement, or redirection to malicious sites. No active exploitation or public exploit code has been reported, but the vulnerability requires user interaction to trigger.
Stored cross-site scripting in the Query Posts WordPress plugin 0.3.2 and below allows an authenticated attacker with low privileges to inject malicious scripts that execute in the browser of users who view the affected page, leading to data theft or session hijacking. No active exploitation or public exploit code has been reported, and the EPSS exploitation probability is very low (0.02%).
Stored cross-site scripting in WordPress WP Geo plugin through version 3.5.1 enables authenticated attackers to inject malicious scripts that execute in victims' browsers. The vulnerability, reported by Patchstack, could allow session theft or content manipulation when a privileged user views a page containing the stored payload. No evidence of active exploitation exists, and the EPSS score is low (0.02%).
Stored cross-site scripting (XSS) in WPClever WPC Smart Messages for WooCommerce plugin versions up to 4.2.8 allows authenticated users with limited privileges to inject malicious scripts that execute in the browsers of other site visitors. The vulnerability requires user interaction (UI:R) and affects confidentiality and integrity through script injection, with a CVSS score of 5.4 reflecting moderate risk; however, the 0.02% EPSS score indicates minimal real-world exploitation probability at time of analysis, and no public exploit code or active exploitation has been confirmed.
Stored cross-site scripting in the Popular Posts by Webline WordPress plugin allows authenticated attackers to inject arbitrary web scripts into pages that will execute whenever a user accesses an affected page. The vulnerability affects plugin versions up to and including 1.1.1 and can lead to data theft or session hijacking when an administrator or other high-privilege user views the injected content. No active exploitation or public exploit code was identified at the time of analysis, and EPSS indicates a very low probability of widespread exploitation.
Stored cross-site scripting in Photospace Responsive WordPress plugin versions up to 2.2.0 allows authenticated administrators to inject malicious scripts that execute in the context of other users' sessions. The vulnerability, assigned CVE-2025-62899, can lead to limited compromise of confidentiality, integrity, and availability. With a very low EPSS score (0.02%) and no exploit code publicly available, current exploitation likelihood is minimal.
Stored cross-site scripting in the WordPress Links shortcode plugin up to version 1.8.3 allows authenticated attackers with low privileges to inject malicious scripts via the plugin's shortcode functionality. When a victim views a page containing the crafted shortcode, the injected script executes in their browser, leading to potential session theft, content manipulation, or redirection. No active exploitation or public exploit is reported, and EPSS indicates a low exploitation probability.
Improper neutralization of HTML script tags in WP Recipe Maker through version 10.0.x enables reflected cross-site scripting (XSS) attacks against users. The vulnerability affects the Brecht WP Recipe Maker WordPress plugin and requires user interaction (clicking a malicious link) to exploit. An attacker can inject arbitrary JavaScript into the page context, achieving code execution in the victim's browser with potential to steal session tokens or perform actions on behalf of authenticated users. The vulnerability has low real-world exploitation probability (EPSS 0.02%) and does not appear to be actively exploited in the wild.
Cross-Site Request Forgery (CSRF) in the Multilang Contact Form WordPress plugin (≤ 1.5) allows an attacker to inject stored cross-site scripting (XSS) payloads by tricking an authenticated administrator into clicking a malicious link. The stored XSS can then execute in the context of other users viewing the affected page, leading to cookie theft, session hijacking, or defacement. No public exploit code or active exploitation has been identified, and the EPSS score is very low (0.02%), indicating minimal current probability of large-scale attacks.
Stored Cross-Site Scripting vulnerability in ACF Recent Posts Widget WordPress plugin allows authenticated users with contributor-level access to inject malicious scripts into pages. Affects versions up to 5.9.3. EPSS score is very low (0.02%) and no public exploit or KEV listing identified, reducing immediate exploitation risk.
DOM-based cross-site scripting (XSS) in King Addons for Elementor plugin versions up to 51.1.61 allows authenticated users with low privileges to inject malicious scripts that execute in other users' browsers when they interact with affected pages. The vulnerability requires user interaction (clicking a link) and affects the confidentiality and integrity of website content, with an EPSS score of 0.02% indicating low real-world exploitation probability despite the moderate CVSS rating of 5.4.
Cross-site request forgery enables stored XSS injection in WordPress Pricing Table builder plugin versions up to 1.5.3. Remote unauthenticated attackers can trick authenticated WordPress administrators into executing malicious requests that inject persistent JavaScript payloads into pricing table configurations. EPSS score of 0.02% (4th percentile) indicates low observed exploitation probability, and no active exploitation has been confirmed via CISA KEV. The changed scope (S:C) in CVSS vector indicates potential for broader site compromise beyond the plugin's security context.
DOM-based cross-site scripting (XSS) in RexTheme WP VR WordPress plugin up to version 8.5.48 allows authenticated users with low privileges to inject malicious scripts that execute in other users' browsers with site-wide scope. The vulnerability requires user interaction (UI:R) and affects confidentiality, integrity, and availability equally. Exploitation requires valid WordPress account credentials but carries moderate real-world risk given the low EPSS score (0.02%) and authenticated requirement despite the CVSS 6.5 rating.
Reflected cross-site scripting in Mingsoft MCMS v6.0.1 allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by delivering a crafted URL containing a malicious payload. The CVSS scope change (S:C) indicates impact extends beyond the web application itself into the victim's browser trust context, enabling session hijacking or credential theft. No public exploit identified at time of analysis beyond the referenced GitHub gist, and EPSS of 0.22% (13th percentile) signals very low current exploitation interest.
Stored cross-site scripting on the KeeneticOS 'Wireless ISP' page enables a physically proximate attacker to compromise a Keenetic router by injecting a malicious payload-likely via a crafted nearby wireless network name (SSID)-that executes in an authenticated administrator's browser session. Successful exploitation allows the attacker to create additional users with full administrative permissions, resulting in complete device takeover. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS probability stands at 0.03%, indicating limited current exploitation activity.
Reflected cross-site scripting in Proliz Software OBS (Student Affairs Information System) prior to V26.0401 allows remote attackers to execute arbitrary JavaScript in a victim's browser session after luring them to click a crafted link. The high CVSS of 7.6 reflects unauthenticated network exploitation with high confidentiality impact, though no public exploit identified at time of analysis and EPSS data was not provided. The flaw was reported by Turkey's national CERT (USOM), indicating regional relevance for Turkish higher-education institutions that use this Student Affairs platform.
Reflected XSS in AcBakImzala, ArkSigner's document signing application, affects all versions before v5.1.4 and allows unauthenticated remote attackers to inject and execute malicious scripts in a victim's browser. The attack requires the victim to interact with a crafted URL, limiting automated exploitation, but the low attack complexity and absence of authentication requirements make social-engineering-based delivery straightforward. No public exploit code or CISA KEV listing has been identified; EPSS is very low at 0.03% (9th percentile), consistent with limited observed exploitation interest at this time.
Stored Cross-Site Scripting (XSS) can be injected into WordPress sites running the Video Blogster Lite plugin up to version 1.2 via a Cross-Site Request Forgery (CSRF) attack. An unauthenticated attacker can trick an authenticated administrator into clicking a crafted link, leading to persistent JavaScript execution in the browsers of site visitors. There is no evidence of active exploitation or public exploit code at this time, and the EPSS model predicts a very low probability of widespread use.
Stored cross-site scripting in the Werk aan de Muur WordPress plugin (≤1.5) allows authenticated users with high privileges to inject malicious scripts that execute in other administrators’ browser contexts, potentially leading to session hijacking or content manipulation. No public exploit code found; not listed in CISA KEV or reported as actively exploited. EPSS score indicates very low exploitation probability.
Stored cross-site scripting vulnerability in the Colibri Page Builder WordPress plugin allows authenticated editors or administrators to inject malicious scripts into pages. When other users view the affected page, the script executes, potentially leading to limited data theft, defacement, or session hijacking. Exploitation requires high privileges and user interaction; no active exploitation or public exploit code is known, and EPSS predicts a very low exploitation probability (0.02%).
Reflected cross-site scripting in the Easy WooCommerce Customizer WordPress plugin (versions up to and including 1.0.2) allows unauthenticated remote attackers to inject arbitrary JavaScript into a victim's browser session by tricking them into clicking a crafted URL. The vulnerability carries a changed scope (S:C), meaning injected script runs in the victim's browser context and can access cookies, session tokens, or perform actions on behalf of the authenticated user. No public exploit code has been identified and EPSS probability is minimal at 0.03%, indicating very low current real-world exploitation activity.
Stored cross-site scripting in the Doctreat WordPress Theme through version 1.6.7 allows authenticated attackers to inject HTML and script code, enabling client-side code injection in visitors' browsers. Exploitation requires a contributor-level WordPress account but no user interaction from the victim. No public exploit code or active exploitation has been reported; EPSS indicates a very low likelihood of widespread attacks.
Reflected XSS in the NEX-Forms LITE WordPress plugin (all versions prior to 8.2) allows unauthenticated remote attackers to inject and execute malicious JavaScript in a victim's browser by luring them to a crafted URL. The script runs in the browser's page context with scope change, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit code or active exploitation has been identified; the EPSS score of 0.03% at the 8th percentile reflects negligible current exploitation activity.
Reflected cross-site scripting in WP Tactical Popup plugin for WordPress (≤1.1) allows unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser via a crafted URL. Exploitation requires user interaction (clicking a malicious link), potentially leading to session hijacking or content manipulation. No active exploitation or public exploit has been identified at this time.
Reflected Cross-Site Scripting (XSS) in the Munzir myshouts-shoutbox WordPress plugin (versions ≤ 0.9) allows unauthenticated attackers to inject and execute arbitrary web scripts in a victim’s browser by tricking them into clicking a crafted link. The vulnerability arises from improper neutralization of user input during web page generation, enabling script execution in the context of the affected site. No active exploitation or public exploit code has been identified, and EPSS indicates a low probability of real-world exploitation (0.03%).
Reflected cross-site scripting in the WordPress Likert Survey Master plugin allows unauthenticated attackers to inject arbitrary web scripts via a crafted URL. Successful exploitation requires tricking an administrator into clicking the link while authenticated, potentially leading to session hijacking or malicious actions performed in the victim's browser context. No active exploitation or public exploit code has been identified, and the EPSS score indicates very low exploit likelihood (0.07%).
Stored cross-site scripting in the Toast Mobile Menu WordPress plugin (<=1.0.8) allows unauthenticated attackers to inject malicious scripts that execute when a user views an infected page, potentially leading to session hijacking or content manipulation. No active exploitation or public proof-of-concept is confirmed at time of analysis, and the EPSS score indicates a low probability of real-world attacks.
Reflected cross-site scripting in the MultiSite Clone Duplicator WordPress plugin through version 1.5.3 allows attackers to execute arbitrary JavaScript in victims' browsers when they click a crafted link. Successful exploitation could lead to session hijacking, data theft, or unauthorized actions on behalf of the user. No active exploitation or public exploits are known, and EPSS predicts very low exploitation likelihood (0.06%).
Reflected cross-site scripting (XSS) in the Contact Form by Supsystic WordPress plugin (versions through 1.7.36) allows unauthenticated remote attackers to execute malicious JavaScript in victims' browsers via crafted URLs. The vulnerability enables session hijacking, credential theft, and malicious actions performed in the context of the victim's authenticated session. EPSS probability indicates low exploitation likelihood (0.07%, 22nd percentile) with no public exploit identified at time of analysis.
Reflected Cross-Site Scripting (XSS) in WordPress plugin oik-privacy-policy versions ≤1.4.10 allows remote attackers to execute arbitrary JavaScript in victims' browsers. Exploitation requires user interaction (victim must click malicious link). EPSS probability is low (0.07%, 22nd percentile), and no active exploitation is confirmed. Reported by Patchstack security audit team, indicating professional vulnerability disclosure.
Reflected cross-site scripting in NextMove Lite (WordPress thank-you page plugin) versions ≤2.24.0 allows unauthenticated remote attackers to execute malicious JavaScript in victim browsers via crafted URLs. The vulnerability requires user interaction (clicking a malicious link) but achieves scope change per CVSS vector, enabling session hijacking, credential theft, or malicious actions under victim's WordPress session. EPSS score of 0.03% (8th percentile) indicates low probability of mass exploitation, though XSS vulnerabilities are commonly used in targeted social engineering campaigns against WordPress site administrators.
Reflected cross-site scripting in the CropRefine WordPress plugin (<= 1.2.1) allows unauthenticated attackers to inject arbitrary web scripts by tricking a user into clicking a crafted link. The vulnerability, reported by Patchstack, has a CVSS 7.1 high severity but a very low EPSS exploitation probability (0.03%), and no active exploitation or public exploit code has been identified.
Reflected cross-site scripting in bbPress Notify plugin versions up to 2.19.5 allows unauthenticated remote attackers to execute malicious JavaScript in victim browsers through crafted URLs. The vulnerability stems from improper input sanitization during web page generation (CWE-79). With CVSS 7.1 and changed scope (S:C), successful exploitation enables session hijacking, credential theft, and malicious actions in the victim's context. EPSS score of 0.03% (8th percentile) indicates low observed exploitation probability, and no active exploitation is confirmed (not in CISA KEV), though Patchstack has publicly documented the vulnerability.
Reflected cross-site scripting in Robokassa payment gateway for WooCommerce (versions ≤1.8.5) allows remote attackers to execute malicious JavaScript in victim browsers through specially crafted URLs. The scope-change CVSS flag indicates attackers can impact resources beyond the vulnerable plugin itself, potentially compromising WooCommerce admin sessions or customer payment data. EPSS probability is low (0.03%, 8th percentile), and no active exploitation or public POC has been identified at time of analysis.
Reflected cross-site scripting in Email Attachment by Order Status & Products WordPress plugin versions ≤1.0.1 allows remote unauthenticated attackers to execute arbitrary JavaScript in victim browsers through low-complexity attacks requiring user interaction. The vulnerability enables cross-site scope impact (S:C), allowing attackers to compromise confidentiality, integrity, and availability at a low level across security boundaries. No active exploitation or public POC is confirmed at time of analysis, with EPSS data unavailable for this recently published CVE.
Stored cross-site scripting (XSS) in Crocoblock JetElements For Elementor plugin through version 2.7.8 allows authenticated users with low privileges to inject malicious scripts that execute in the browsers of site visitors, potentially compromising site integrity and user sessions. The vulnerability requires user interaction (UI:R) and affects authenticated users (PR:L), limiting immediate blast radius but posing persistent risk to WordPress installations using this Elementor extension.
Stored XSS in Crocoblock JetEngine WordPress plugin versions 3.7.3 and earlier allows authenticated users with limited privileges to inject malicious scripts that execute in the browsers of other users, including administrators. The vulnerability requires user interaction (UI:R) to trigger and affects confidentiality, integrity, and availability with limited scope. With EPSS at 0.07% and no KEV status indicating active exploitation, this represents a low-probability but real risk requiring patching in multi-user WordPress environments.
Stored cross-site scripting (XSS) in Crocoblock JetBlocks For Elementor plugin versions up to 1.3.18 allows authenticated users with low privileges to inject malicious scripts that execute in the browsers of other site visitors. The vulnerability requires user interaction (UI:R) and affects confidentiality and integrity, with an EPSS score of 0.06% indicating very low real-world exploitation likelihood despite the moderate CVSS 5.4 rating.
Reflected cross-site scripting (XSS) in Crocoblock JetBlog WordPress plugin through version 2.4.4 allows authenticated users to inject malicious scripts that execute in other users' browsers when they interact with crafted links. The vulnerability requires user interaction (UI:R) and authenticated access (PR:L), limiting but not eliminating real-world risk; EPSS score of 0.07% indicates low exploitation probability despite the moderate CVSS 6.5 rating.
Stored Cross-Site Scripting (XSS) in Crocoblock JetBlog WordPress plugin through version 2.4.4.1 allows authenticated users with low privileges to inject malicious scripts that persist in web pages and execute in the browsers of other site visitors, potentially compromising session tokens, stealing sensitive data, or performing unauthorized actions. EPSS score of 0.07% and lack of public exploit code indicate low real-world exploitation probability despite the moderate CVSS 6.5 score.
Reflected cross-site scripting (XSS) in Crocoblock JetSearch WordPress plugin versions through 3.5.10 allows unauthenticated remote attackers to execute arbitrary JavaScript in victim browsers via maliciously crafted URLs. The vulnerability requires user interaction (clicking a malicious link) but carries a changed scope, meaning successful exploitation can impact resources beyond the vulnerable component. EPSS probability is low (0.07%, 22nd percentile), indicating minimal observed exploitation attempts, and no public exploit code or CISA KEV listing exists at time of analysis.