Cross-Site Scripting

The WP-PhotoNav plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's photonav shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Responsive Food and Drink Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's display_pdf_menus shortcode in all versions up to, and including, 2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Tournament Bracket Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bracket' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The WP SoundSystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpsstm-track shortcode in all versions up to, and including, 3.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Image Editor by Pixo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘download’ parameter in all versions up to, and including, 2.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The GC Social Wall plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gc_social_wall' shortcode in all versions up to, and including, 1.15 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The TimeZoneCalculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'timezonecalculator_output' shortcode in all versions up to, and including, 3.37 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Stored cross-site scripting in the Event RSVP and Simple Event Management Plugin for WordPress up to 4.1.0 allows authenticated attackers with contributor-level permissions to inject arbitrary web scripts via the 'emd_mb_meta' shortcode. Injected scripts execute whenever any user accesses a page containing the malicious shortcode, potentially leading to session hijacking or unauthorized actions. No active exploitation or public exploit code has been identified, and EPSS score is very low (0.04%), indicating limited immediate risk.

The e.nigma buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button' shortcode in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The WP Masonry & Infinite Scroll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wmis' shortcode in all versions up to, and including, 2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE-2025-5015 is a stored/reflected cross-site scripting (XSS) vulnerability in AccuWeather and Custom RSS widget implementations that permits unauthenticated attackers to inject malicious scripts by replacing legitimate RSS feed URLs with attacker-controlled URLs. The vulnerability has a CVSS 3.1 score of 8.8 (High) with network-based attack vector requiring only user interaction, enabling attackers to achieve high confidentiality, integrity, and availability impact on affected systems. Given the network accessibility and low attack complexity, this represents a significant real-world risk for any platform hosting these widgets.

CVE-2023-44915 is a reflected cross-site scripting (XSS) vulnerability in c3crm's /Login.php component affecting versions up to v3.0.4, where the login_error parameter fails to properly sanitize user input. An attacker can inject malicious JavaScript that executes in victims' browsers when they click a crafted login link, potentially stealing session cookies, credentials, or performing unauthorized actions on behalf of authenticated users. With a CVSS score of 7.1 and network-based attack vector requiring only user interaction, this represents a moderate-to-high severity issue for organizations using vulnerable c3crm deployments.

Hexagon HxGN OnCall Dispatch Advantage (Web) v10.2309.03.00264 and Hexagon HxGN OnCall Dispatch Advantage (Mobile) v10.2402 are vulnerable to Cross Site Scripting (XSS) which allows a remote authenticated attacker with access to the Broadcast (Person) functionality to execute arbitrary code.

CVE-2025-25905 is a Reflected Cross-Site Scripting (XSS) vulnerability in CADClick versions 1.13.0 and earlier that allows unauthenticated remote attackers to inject arbitrary HTML and JavaScript through the 'tree' parameter. Successful exploitation requires user interaction (clicking a malicious link) but can lead to session hijacking, credential theft, and defacement. The vulnerability has a CVSS score of 7.1 (high severity) with a moderate attack complexity, indicating it is practically exploitable in real-world scenarios.

Discourse versions prior to 3.5.0.beta6 contain a reflected cross-site scripting (XSS) vulnerability in social login functionality that is only exploitable when Content Security Policy (CSP) is disabled. An unauthenticated attacker can craft a malicious link leveraging social authentication endpoints to inject arbitrary JavaScript, potentially stealing session tokens, credentials, or performing actions on behalf of the victim. The vulnerability requires user interaction (clicking a malicious link) but has high impact on confidentiality and integrity with no availability impact.

Cross-site scripting in PHPGurukul Hospital Management System 4.0 allows authenticated attackers to inject malicious scripts via the Name parameter in /doctor/manage-patient.php. Successful exploitation modifies user-facing content with no confidentiality or availability impact. A public Proof of Concept exists, but EPSS is very low (0.05%) and the vulnerability is not listed in CISA KEV, indicating limited real-world exploitation likelihood.

The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-url` DOM Element Attribute in all versions up to, and including, 1.68.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Insufficient data validation in DevTools in Google Chrome on Windows prior to 138.0.7204.49 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Low)

Komga is a media server for comics, mangas, BDs, magazines and eBooks. A Cross-Site Scripting (XSS) vulnerability has been discovered in versions 1.8.0 through 1.21.3 when serving EPUB resources, either directly from the API, or when reading using the epub reader. The vulnerability lets an attacker perform actions on the victim's behalf. When targeting an admin user, this can be combined with controlling a server-side command to achieve arbitrary code execution. For this vulnerability to be exploited, a malicious EPUB file has to be present in a Komga library, and subsequently accessed in the Epub reader by an admin user. Version 1.22.0 contains a patch for the issue.

A cross-site scripting vulnerability in Netbox Community 4.1.7 (CVSS 7.1). Risk factors: public PoC available.

In Netbox Community 4.1.7, once authenticated, Configuration History > Add`is vulnerable to cross-site scripting (XSS) due to the `current value` field rendering user supplied html. An authenticated attacker can leverage this to add malicious JavaScript to the any banner field. Once a victim edits a Configuration History version or attempts to Add a new version, the XSS payload will trigger.

In Netbox Community 4.1.7, the login page is vulnerable to cross-site scripting (XSS), which allows a privileged, authenticated attacker to exfiltrate user input from the login form.

PHPGurukul Online DJ Booking Management System 2.0 is vulnerable to Cross Site Scripting (XSS) in odms/admin/view-user-queries.php.

PHPGurukul Online DJ Booking Management System 2.0 is vulnerable to Cross Site Scripting (XSS) in /admin/view-booking-detail.php and /admin/invoice-generating.php.

Cross-site scripting in code-projects School Fees Payment System 1.0 allows remote attackers to inject arbitrary web script via crafted parameters in /student.php. The vulnerability requires user interaction (clicking a malicious link) and a publicly available proof-of-concept exists. EPSS score indicates very low exploitation probability, and no active exploitation has been reported.

CVE-2025-27828 is a reflected cross-site scripting (XSS) vulnerability in the legacy chat component of Mitel MiContact Center Business that allows unauthenticated attackers to execute arbitrary scripts in victim browsers through maliciously crafted URLs. The vulnerability affects multiple versions (10.0.0.4 and earlier, 10.1.0.0-10.1.0.5, and 10.2.0.0-10.2.0.4) and requires user interaction to exploit. While the CVSS score of 7.1 is moderate-to-high, the impact is limited to confidentiality and integrity with no availability impact, and exploitation requires social engineering to trick users into clicking malicious links.

Clickjacking on the HTTPS-Only exception page allows tricking users into loading HTTP pages in Firefox and Thunderbird before version 140. With CVSS 4.3, low EPSS (0.04%), and no known active exploitation or public exploit, this is a low-severity UI spoofing risk.

Cross-site scripting in Mozilla Firefox and Thunderbird occurs when a file download specified via Content-Disposition header is ignored for <embed> or <object> tags, allowing an attacker to inject scripts. Affected are Firefox < 140, Firefox ESR < 128.12, Thunderbird < 140, and Thunderbird < 128.12. No public exploit or active exploitation identified; EPSS score is low (0.08%).

The Conference Scheduler plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ parameter in all versions up to, and including, 2.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

WRC-1167GHBK2-S contains a stored cross-site scripting vulnerability in WebGUI. If exploited, an arbitrary script may be executed on the web browser of the user who accessed WebGUI of the product.

Gogs is an open source self-hosted Git service. In application version 0.14.0+dev and prior, there is a stored cross-site scripting (XSS) vulnerability present in Gogs, which allows client-side Javascript code execution. The vulnerability is caused by the usage of a vulnerable and outdated component: pdfjs-1.4.20 under public/plugins/. This issue has been fixed for gogs.io/gogs in version 0.13.3.

Successful exploitation of the stored cross-site scripting vulnerability could allow an attacker to inject malicious scripts into device fields and executed in other users’ browser, potentially leading to session hijacking, defacement, credential theft, or privilege escalation.

Cross-site scripting (XSS) in Hope-Boot 1.0.0 allows an authenticated attacker to inject arbitrary JavaScript via the errorMsg parameter in the login functionality. A public proof-of-concept exploit exists, but no active exploitation has been reported. The EPSS score is low (0.05%), indicating low exploitation likelihood.

A reflected cross-site scripting (XSS) vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the data parameter in jsmol.php. The application fails to properly sanitize user input before embedding it into the HTTP response, allowing an attacker to execute arbitrary JavaScript in the victim's browser by crafting a malicious link. This can be used to hijack user sessions or manipulate page content. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-02 UTC.

HTMLSanitizer.jl is a Whitelist-based HTML sanitizer. Prior to version 0.2.1, when adding the style tag to the whitelist, content inside the tag is incorrectly unescaped, and closing tags injected as content are interpreted as real HTML, enabling tag injection and JavaScript execution. This could result in possible cross-site scripting (XSS) in any HTML that is sanitized with this library. This issue has been patched in version 0.2.1. A workaround involves adding the math and svg elements to the whitelist manually.

CVE-2025-52558 is a reflected/stored cross-site scripting (XSS) vulnerability in changedetection.io prior to version 0.50.4, where error messages from website change detection filters are not properly sanitized before display. Attackers can inject malicious JavaScript through crafted filter configurations or monitored web pages, potentially compromising user sessions and data. The vulnerability requires user interaction (clicking a link/visiting a page) and affects all users of the open-source change detection service, though no CISA KEV listing or widespread active exploitation is currently documented.

Visionatrix versions 1.5.0 through 2.5.0 contain a Reflected XSS vulnerability in the /docs/flows endpoint that allows unauthenticated attackers to execute arbitrary JavaScript in users' browsers. The vulnerability stems from improper use of FastAPI's get_swagger_ui_html function with unsanitized user-controlled input, enabling session hijacking and exfiltration of application secrets. The CVSS 8.8 score reflects high severity due to network accessibility, low attack complexity, and no privilege requirements, though user interaction is required to trigger the exploit.

Cross-site scripting (XSS) in seaswalker spring-analysis up to commit 4379cce allows remote authenticated users to inject arbitrary web scripts via the Name parameter in SimpleController.java. A public exploit exists, but EPSS score is low (0.05%) and no active exploitation has been reported.

In JetBrains TeamCity before 2025.03.3 reflected XSS in the NPM Registry integration was possible

In JetBrains TeamCity before 2025.03.3 reflected XSS on diskUsageBuildsStats page was possible

In JetBrains TeamCity before 2025.03.3 reflected XSS on the favoriteIcon page was possible

In JetBrains TeamCity before 2025.03.3 a DOM-based XSS at the Performance Monitor page was possible

Stored cross-site scripting in SourceCodester Student Result Management System 1.0 allows an authenticated admin to inject arbitrary JavaScript via the School Name parameter on the System Settings page. A public exploit exists, but the vulnerability requires high privileges and user interaction, limiting real-world impact.

Cross-site scripting (XSS) in SourceCodester Student Result Management System 1.0 allows an authenticated admin to inject arbitrary JavaScript via the Manage Students module. A public exploit exists, but exploitation requires high privileges and user interaction, limiting real-world risk.

Cross-site scripting (XSS) in code-projects School Fees Payment System 1.0 allows remote attackers to inject arbitrary web script via the 'transcation_remark' parameter in /fees.php. Public exploit code exists, but no active exploitation has been confirmed. EPSS score is low (0.06%), indicating low exploitation likelihood.

Cross-site scripting (XSS) in CodeAstro Patient Record Management System 1.0 allows an authenticated high-privilege user to inject arbitrary JavaScript via the Patient Name/Name argument on the Generate New Report Page. Publicly available exploit code exists, but no active exploitation has been confirmed. EPSS score is low (0.09%), indicating low exploitation likelihood.

A Cross-Site Scripting (XSS) vulnerability has been identified in Psono-Client’s handling of vault entries of type website_password and bookmark, as used in Bitdefender SecurePass. The client does not properly sanitize the URL field in these entries. As a result, an attacker can craft a malicious vault entry (or trick a user into creating or importing one) with a javascript:URL. When the user interacts with this entry (for example, by clicking or opening it), the application will execute the malicious JavaScript in the context of the Psono vault. This allows an attacker to run arbitrary code in the victim’s browser, potentially giving them access to the user’s password vault and sensitive data.

The 3D FlipBook - PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ and 'mode' parameters in all versions up to, and including, 1.16.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note: This issue affects only block-based themes.

The TableOn - WordPress Posts Table Filterable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tableon_popup_iframe_button shortcode in all versions up to, and including, 1.0.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE-2025-5034 is a Reflected Cross-Site Scripting (XSS) vulnerability in the wp-file-download WordPress plugin versions before 6.2.6, caused by failure to sanitize and escape user-supplied parameters before output. Attackers can craft malicious URLs containing JavaScript payloads that execute in victims' browsers when clicked, potentially stealing session cookies, hijacking accounts, or performing unauthorized actions. The vulnerability requires user interaction (clicking a link) but affects all users without authentication requirements, making it a moderate-to-significant risk for WordPress installations using this plugin.

FastGPT is an AI Agent building platform. Prior to version 4.9.12, the LastRoute Parameter on login page is vulnerable to open redirect and DOM-based XSS. Improper validation and lack of sanitization of this parameter allows attackers execute malicious JavaScript or redirect them to attacker-controlled sites. This issue has been patched in version 4.9.12.

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows specially crafted content in URLs to be used with TokenReplace and not be properly sanitized by some SkinObjects. This issue has been patched in version 10.0.1.

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In versions 6.0.0 to before 10.0.1, DNN.PLATFORM allows a specially crafted request to inject scripts in the Activity Feed Attachments endpoint which will then render in the feed. This issue has been patched in version 10.0.1.

CVE-2025-52557 is a stored/reflected XSS vulnerability in Mail-0's Zero email solution (version 0.8) that allows unauthenticated attackers to craft malicious emails containing unexecuted JavaScript code. When a victim opens the email in the web interface, the JavaScript executes in their browser context, enabling session hijacking and potential account takeover. The vulnerability has been patched in version 0.81, and exploitation requires user interaction (opening the email), making it a moderate-to-high severity issue suitable for rapid patching.

Cross-site scripting (XSS) in Responsive Blog 1.0 allows an authenticated attacker to inject arbitrary JavaScript via the keyword parameter in /search.php. A public exploit exists, but no active exploitation has been reported and EPSS risk is low (0.06%).

Cross-site scripting (XSS) in Responsive Blog 1.0/1.12.4/3.3.4 via the admin pageViewMembers.php allows authenticated attackers with high privileges to inject malicious scripts. A public exploit exists, but EPSS score is low (0.04%) and no active exploitation in CISA KEV.

Stored cross-site scripting in SourceCodester My Food Recipe 1.0 allows an authenticated attacker to inject arbitrary JavaScript via the Name parameter on the Add Recipe page. A public exploit exists, but EPSS score is low (0.05%) and no active exploitation has been reported.

CVE-2025-52794 is a Cross-Site Request Forgery (CSRF) vulnerability in Creative-Solutions Creative Contact Form (versions up to 1.0.0) that enables Stored XSS attacks. An unauthenticated attacker can craft malicious requests to inject persistent JavaScript payloads through contact form submissions, affecting any user who views the contaminated form data. The vulnerability has a CVSS score of 7.1 (High) with network-based attack vector and low attack complexity, making it readily exploitable in typical web deployments.

CVE-2025-52793 is a Cross-Site Request Forgery (CSRF) vulnerability in Esselink.nu Settings that enables reflected Cross-Site Scripting (XSS) attacks. The vulnerability affects Esselink.nu Settings versions up to and including 2.94, allowing unauthenticated remote attackers to perform actions on behalf of users and inject malicious scripts with minimal user interaction. With a CVSS score of 7.1 and network-based attack vector, this vulnerability poses a moderate-to-significant risk to affected installations, particularly if actively exploited or if public proof-of-concept code becomes available.

CVE-2025-52792 is a Cross-Site Request Forgery (CSRF) vulnerability in the vgstef WP User Stylesheet Switcher WordPress plugin (versions up to v2.2.0) that enables Stored XSS attacks. An unauthenticated attacker can exploit this via a simple network request with user interaction to inject malicious scripts that execute in victims' browsers, potentially compromising user sessions and data. The vulnerability has not been confirmed as actively exploited in the wild, though the high CVSS score (7.1) and network-accessible attack vector indicate practical exploitability.

CVE-2025-52791 is a CSRF vulnerability in devfelixmoira Knowledge Base Maker (versions up to 1.1.8) that enables Stored XSS attacks, allowing unauthenticated remote attackers to inject malicious scripts that persist and execute in users' browsers. The vulnerability requires user interaction (clicking a malicious link) but can affect multiple users through stored payloads, with a CVSS score of 7.1 indicating medium-high severity. No KEV listing or confirmed EPSS data is available in public sources, and patch availability status requires verification with the vendor.

CVE-2025-52790 is a CSRF vulnerability in the r-win WP-DownloadCounter WordPress plugin (versions through 1.01) that enables Stored XSS attacks. An attacker can craft malicious requests that, when clicked by an administrator, inject persistent JavaScript into the plugin's data storage, affecting all site visitors. The CVSS 7.1 score reflects moderate severity with network-based attack delivery and user interaction requirements, though the actual exploitability and active exploitation status require verification against KEV and EPSS data.

A cross-site scripting vulnerability in George Lewe Lewe ChordPress allows Stored XSS (CVSS 7.1). High severity vulnerability requiring prompt remediation.

CVE-2025-52784 is a Cross-Site Request Forgery (CSRF) vulnerability in hideoguchi Bluff Post that enables Stored XSS attacks, affecting versions through 1.1.1. An unauthenticated attacker can craft malicious requests to inject persistent JavaScript payloads that execute in victims' browsers when they view affected content, potentially leading to session hijacking, credential theft, or defacement. The vulnerability has a CVSS score of 7.1 (High) with network-based attack vector and low complexity, indicating moderate real-world risk.

A remote code execution vulnerability in themelocation Change Cart button Colors WooCommerce allows Stored XSS (CVSS 7.1). High severity vulnerability requiring prompt remediation.

CVE-2025-52782 is a Reflected Cross-Site Scripting (XSS) vulnerability in King Rayhan Scroll UP WordPress plugin versions through 2.0 that allows unauthenticated attackers to inject malicious scripts into web pages viewed by users. The vulnerability has a CVSS score of 7.1 (High) with network-based attack vector requiring user interaction; attackers can steal session cookies, perform actions on behalf of users, or redirect users to malicious sites. KEV status and active exploitation data were not provided in available intelligence sources, though the reflected XSS nature suggests moderate real-world exploitability.

CVE-2025-52781 is a Cross-Site Request Forgery (CSRF) vulnerability in Beee TinyNav versions up to 1.4 that enables Stored XSS attacks. An unauthenticated attacker can craft malicious requests to inject persistent JavaScript payloads into the application, which are then executed in the browsers of other users who interact with the compromised content. With a CVSS score of 7.1 and network-based attack vector requiring only user interaction, this vulnerability poses a moderate-to-significant risk to affected deployments, particularly if actively exploited in the wild or publicly disclosed with proof-of-concept code.

CVE-2025-52780 is a CSRF vulnerability in Mohammad Parsa Logo Manager For Samandehi (versions through 0.5) that enables Stored XSS attacks, allowing unauthenticated attackers to perform unauthorized actions and inject malicious scripts affecting other users. The vulnerability has a CVSS score of 7.1 (High) and exploits weak CSRF protections in an admin/management plugin, with the attack requiring user interaction (UI:R) but affecting multiple users via stored payload persistence.

CVE-2025-52772 is a CSRF vulnerability in Adnan Haque's Virtual Moderator plugin (versions through 1.4) that enables Cross-Site Scripting (XSS) attacks. An unauthenticated attacker can exploit this via a malicious webpage to perform unauthorized actions and inject malicious scripts, potentially compromising user sessions and data. With a CVSS score of 7.1 and network-accessible attack vector requiring only user interaction, this vulnerability poses a moderate-to-significant risk to affected installations, though exploitation requires social engineering to trick users into visiting attacker-controlled sites.

DOM-based Cross-Site Scripting (XSS) in ANON::form embedded secure form plugin for WordPress versions up to 1.7 allows authenticated attackers with contributor-level access or higher to inject malicious scripts. The vulnerability is triggered when a user interacts with a crafted link, leading to script execution in the victim's browser. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).

Stored cross-site scripting in Ninja Team File Manager Pro for WordPress allows authenticated users with high privileges to inject malicious scripts that execute when other users view affected pages. The vulnerability affects versions up to 1.8.8 and has a low EPSS score (0.04%) with no public exploit or active exploitation reported.

Stored cross-site scripting in Firelight Lightbox WordPress plugin up to version 2.3.16 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at this time.

Stored cross-site scripting (XSS) in WP-Members plugin for WordPress up to version 3.5.4 allows authenticated attackers with contributor-level access or higher to inject malicious scripts into web pages. These scripts execute when other users view affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).

Stored cross-site scripting in Jobs for WordPress plugin up to version 2.7.12 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into job postings. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at time of analysis.

Stored cross-site scripting in Modern Footnotes WordPress plugin through 1.4.19 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into footnote content. When an administrator views a page containing the malicious footnote, the script executes in their browser, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.

Stored cross-site scripting in the WordPress plugin Automatically Hierarchic Categories in Menu up to version 2.0.9 allows authenticated attackers with contributor-level access or higher to inject malicious scripts. When an administrator views the affected menu page, the injected script executes, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).

Stored cross-site scripting in Sitekit WordPress plugin through version 1.9 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when other users view the affected page. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).

Stored cross-site scripting (XSS) in WPComplete 2.9.5 and earlier allows authenticated attackers with contributor-level access or higher to inject malicious scripts into web pages. When an administrator views the injected content, the script executes, potentially leading to session hijacking or data theft. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).

DOM-based Cross-Site Scripting (XSS) in Related Products Manager for WooCommerce plugin versions up to 1.6.2 allows authenticated attackers with contributor-level access or higher to inject malicious scripts. The vulnerability is triggered when a crafted payload is processed by the browser, leading to script execution in the context of the victim's session. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).

Stored cross-site scripting in Code Engine WordPress plugin through 0.3.2 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when other users view the affected page. No public exploit or active exploitation identified.

Stored cross-site scripting in WP Register Profile With Shortcode plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject malicious scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified.

Stored cross-site scripting in WP Engine's Gutenberg Blocks - ACF Blocks Suite plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at time of analysis.

Stored cross-site scripting (XSS) in Anant Addons for Elementor plugin for WordPress allows authenticated attackers with contributor-level access or higher to inject malicious scripts into pages. These scripts execute when other users view the affected page, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).

DOM-based Cross-Site Scripting (XSS) in Buying Buddy IDX CRM WordPress plugin up to version 2.3.0 allows authenticated attackers with low privileges to inject malicious scripts via crafted input, leading to potential data theft or session hijacking. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).

Stored cross-site scripting in Fyrebox Quizzes WordPress plugin up to version 3.0 allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into quiz pages. These scripts execute when other users view the affected pages, potentially leading to session hijacking or defacement. No public exploit or active exploitation has been identified at this time.

DOM-Based Cross-Site Scripting (XSS) in the Fitness Park WordPress theme through version 1.1.1 allows authenticated attackers with contributor-level access or higher to inject malicious scripts. The vulnerability is triggered when a user interacts with a crafted link, leading to script execution in the victim's browser. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).

DOM-based Cross-Site Scripting (XSS) in Spark Multipurpose WordPress theme versions up to 1.0.7 allows authenticated attackers with low privileges to inject malicious scripts via crafted input, leading to potential data theft or session hijacking. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).

Stored cross-site scripting (XSS) in Login/Signup Popup plugin for WordPress versions up to 2.9.4 allows authenticated users with high privileges (e.g., administrators) to inject malicious scripts that execute when other users view the affected page. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).

Stored cross-site scripting in Spoki WordPress plugin up to version 2.16.0 allows authenticated attackers with high privileges to inject malicious scripts that execute when other users view affected pages. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).

Stored cross-site scripting (XSS) in CP Polls WordPress plugin up to version 1.0.81 allows authenticated users with high privileges to inject malicious scripts that execute when other users view poll data. No public exploit or active exploitation identified.