Cross-Site Scripting

Stored cross-site scripting (XSS) in BlueGlass Interactive AG Jobs for WordPress plugin versions 2.8.1 and earlier allows authenticated users with low privileges to inject malicious scripts into job postings that execute in the browsers of other site visitors. The vulnerability requires user interaction (clicking a crafted link) and affects website visitors with cross-site request forgery capabilities, resulting in limited confidentiality and integrity impact but no availability impact. The issue has a low exploitation probability (EPSS 0.04%) despite publicly disclosed details.

Cross-site scripting in WPBakery Visual Composer WHMCS Elements plugin for WordPress allows authenticated attackers with high privileges to inject malicious scripts via DOM manipulation. This XSS can lead to limited data disclosure or actions within the victim's session but requires user interaction. No public exploit or active exploitation reported.

Stored cross-site scripting (XSS) in WordPress plugin My auctions allegro (versions up to 3.6.35) allows authenticated users to inject malicious scripts that execute in other users' browsers when viewing auction content. The vulnerability requires user interaction (UI:R) and affects the confidentiality and integrity of affected WordPress installations, though with limited scope within the plugin context. No public exploit code or active exploitation has been identified; real-world risk is moderate given the requirement for authenticated access and user interaction.

Stored cross-site scripting in HasThemes WC Builder WordPress plugin up to version 1.2.0 allows authenticated attackers with low privileges to inject arbitrary web scripts into pages created with the plugin. When victims view the crafted page, the script executes in their browser, leading to potential data theft or session hijacking.

Stored cross-site scripting in ModelTheme Addons for WPBakery and Elementor plugin for WordPress through version 1.5.5 allows authenticated attackers with contributor-level or higher privileges to inject arbitrary web scripts. When a victim, such as an administrator, views the affected page, the injected script executes in their browser, leading to potential session hijacking, credential theft, or site defacement. No active exploitation or public exploit code is known at this time, and EPSS probability is very low (0.04%).

Stored cross-site scripting in the WPFactory Free Shipping Bar plugin for WooCommerce version 2.4.9 and earlier allows authenticated attackers to inject malicious scripts into pages viewed by other users, potentially leading to data theft or session hijacking. The vulnerability requires contributor-level or higher privileges and user interaction to trigger. No active exploitation or public exploit is known at this time.

Stored cross-site scripting in the Academy LMS WordPress plugin up to version 3.4.0 allows authenticated attackers with low privileges to inject JavaScript into web pages viewed by other users. No evidence of active exploitation or public exploit code exists; EPSS indicates a very low exploitation probability (0.04%).

Stored Cross-Site Scripting in the pixelgrade Category Icon WordPress plugin through version 1.0.2 enables authenticated administrators to inject malicious scripts that execute in other users' browsers, leading to low-impact compromise of confidentiality and integrity. No active exploitation or public proof-of-concept code is currently known, and EPSS indicates a low exploitation probability (0.04%).

Stored cross-site scripting in the Bold Timeline Lite plugin for WordPress allows authenticated attackers to inject arbitrary web scripts. Versions up to and including 1.2.7 are affected, enabling an attacker with low privileges to store a payload that executes when a victim views an infected timeline page. The CVSS 6.5 rating reflects medium severity, but the very low EPSS exploitation probability (0.04%) suggests minimal real-world threat; no public exploit or active exploitation is known.

Stored cross-site scripting in Real 3D FlipBook plugin up to version 4.11.4 allows authenticated users with low privileges to inject malicious scripts that execute in victim browsers. This can lead to session hijacking or

Stored cross-site scripting in Astra Widgets WordPress plugin up to version 1.2.16 allows authenticated attackers with admin access to inject malicious scripts that execute when other users view pages containing affected widgets. No public exploit or active exploitation has been reported, and EPSS probability is low (0.04%).

DOM-based Cross-Site Scripting in the Greenhouse Job Board WordPress plugin versions up to 2.7.3 allows authenticated administrators to inject arbitrary scripts. A victim admin browsing a page where the payload is rendered could have their browser execute the malicious code, leading to session hijacking or data theft. At time of analysis, no active exploitation or public exploit is known.

DOM-based cross-site scripting (XSS) in the GARD AdSense plugin for WordPress versions ≤2.23 allows authenticated administrators to inject malicious scripts that execute in the browser of a victim who interacts with a crafted link. Exploitation requires high-privilege user access and victim user interaction, and no public exploit or active attacks are known (EPSS 0.04%).

Stored cross-site scripting in the WordPress Gift Hunt plugin up to version 2.0.2 allows authenticated attackers with administrator-level privileges to inject arbitrary web scripts that execute when other users view the affected plugin pages. This can lead to session hijacking, credential theft, or unauthorized actions within the site. EPSS indicates very low exploitation probability (0.04%), no active exploitation is known, and no public proof-of-concept has been identified.

Stored cross-site scripting in WordPress WH Tweaks plugin up to version 1.0.2 allows authenticated administrators to inject web scripts that execute in other users' browsers, potentially leading to session hijacking or data theft. The vulnerability requires high privileges (admin) and user interaction (victim must view the poisoned page), with no public exploit or active exploitation confirmed. Its CVSS base score of 5.9 indicates a moderate risk primarily for sites where untrusted individuals may hold administrator roles.

Stored cross-site scripting in the Basticom Framework WordPress plugin up to version 1.5.2 enables authenticated administrators to inject arbitrary web scripts. These scripts execute in the browsers of other users who view the affected page, potentially leading to session hijacking, phishing, or defacement. No active exploitation or public exploit code has been identified at time of analysis, and the EPSS likelihood is very low (0.04%).

Stored cross-site scripting in the WordPress Review Disclaimer plugin versions up to 2.0.3 allows authenticated high-privilege attackers (e.g., admin) to inject arbitrary web scripts that execute in the browsers of other users. While no active exploitation is confirmed and the EPSS likelihood is very low (0.04%), a successful attack could lead to session theft or site defacement when a victim views the injected content.

Stored cross-site scripting in the TouchOfTech Draft Notify WordPress plugin allows authenticated administrators to inject malicious scripts that execute in other users’ browsers when they view affected pages. Versions up to and including 1.5 are vulnerable. The flaw is not actively exploited, and no public exploit code has been identified.

Cross-Site Request Forgery in the WordPress Evergreen Post Tweeter plugin (<=1.8.9) allows stored XSS when a logged-in administrator is tricked into clicking a malicious link. Attackers can exploit this to inject persistent scripts that execute in the browsers of other site visitors, potentially leading to session hijacking or site defacement. No active exploitation or public exploit code has been identified, and the EPSS score is very low (0.02%).

Cross-site scripting (XSS) via unsanitized firstname and lastname parameters in /profile.php of code-projects Student Information System 1.0 allows authenticated remote attackers with user interaction to inject malicious scripts affecting confidentiality. The vulnerability carries a low CVSS score (2.0) due to authentication and user interaction requirements, but publicly available exploit code exists and EPSS analysis assigns 0.06% exploitation probability, reflecting limited real-world attack likelihood despite public POC availability.

Stored cross-site scripting in Hotech Software's Otello product (versions 2.4.0 through 2.4.3) allows authenticated low-privileged attackers to inject persistent malicious scripts that execute in other users' browsers upon viewing affected pages. Reported by Turkey's national CERT (USOM), the vulnerability carries a 7.3 CVSS score with high confidentiality and integrity impact, though no public exploit identified at time of analysis and EPSS exploitation probability is very low at 0.03%.

Cross-site scripting (XSS) vulnerability in CodexThemes TheGem Theme Elements (for Elementor) plugin through version 5.10.5.1 allows improper neutralization of input during web page generation. Attackers can inject malicious scripts that execute in the context of other users' browsers, potentially compromising WordPress site visitors and administrators. No active exploitation has been confirmed at time of analysis, though the low EPSS score (0.04%) suggests limited real-world exploitation likelihood despite the vulnerability's presence in a widely-used Elementor theme plugin.

Stored cross-site scripting (XSS) in WebCodingPlace Responsive Posts Carousel Pro WordPress plugin versions 15.2 and earlier allows authenticated users to inject malicious scripts that execute in the browsers of other site visitors. The vulnerability resides in improper input sanitization during web page generation, enabling attackers to compromise site integrity and steal sensitive user data. EPSS exploitation probability is notably low (0.04%, 14th percentile), suggesting limited real-world attack incentive despite the stored nature of the flaw.

Stored cross-site scripting in Piranha CMS v12.1 allows an attacker who can submit content to the Media module to persist malicious JavaScript in the Name field, which then executes in victims' browsers when the Media section is viewed. A publicly available proof-of-concept exploit exists on GitHub, meaningfully lowering the barrier to exploitation. Despite the network-accessible attack vector and cross-context scope change (S:C), EPSS sits at 0.18% (8th percentile) with no CISA KEV listing, indicating limited real-world exploitation of this niche platform at time of analysis.

Stored cross-site scripting in Piranha CMS v12.1 allows script injection via the Excerpt field in the Page Settings module, executing arbitrary JavaScript in the browsers of users who subsequently view the affected page. The vulnerability carries a publicly available proof-of-concept exploit hosted on GitHub, though EPSS remains very low at 0.18% (8th percentile), indicating limited observed exploitation activity. No KEV listing exists, and no patch has been confirmed from available data at time of analysis.

Stored cross-site scripting leading to code execution in Frappe Framework 15.89.0 (and the ERPNext application built on it) lets attackers upload a crafted XML/SVG file through the Attachments module that runs attacker-controlled script when a victim views it. Tagged as XSS/RCE/File Upload with a publicly available exploit code, though EPSS remains low at 0.44% (35th percentile) and it is not on CISA KEV. The CVSS 9.6 rating reflects a scope-changing, user-interaction-dependent attack rather than direct server-side compromise.

Stored cross-site scripting (XSS) in Void Elementor WHMCS Elements for Elementor Page Builder through version 2.0.1.2 allows authenticated attackers to inject malicious scripts into web pages generated by the plugin, potentially compromising site visitors and administrators. The vulnerability stems from improper input sanitization in page generation functions. No public exploit code or active exploitation has been identified, but the low EPSS score (0.04%) reflects limited real-world attack probability despite the high-impact nature of XSS vulnerabilities.

Stored cross-site scripting (XSS) in HappyDevs TempTool WordPress plugin version 1.3.1 and earlier allows authenticated attackers to inject malicious scripts that persist in the database and execute in the browsers of other users who view affected pages. The vulnerability exists in the [Show Current Template Info] functionality and affects the current-template-name component; exploitation requires an authenticated user with appropriate plugin permissions but can compromise all site visitors who interact with the injected content.

Stored cross-site scripting (XSS) in WP Microdata WordPress plugin version 1.0 and earlier allows authenticated users or lower-privileged administrators to inject malicious scripts that execute in the browsers of site visitors, potentially leading to credential theft, session hijacking, or malware distribution. The vulnerability stems from improper input sanitization during web page generation. EPSS score of 0.04% indicates low exploitation probability in real-world conditions.

Stored or reflected cross-site scripting (XSS) in Campcodes Complete Online Beauty Parlor Management System 1.0 allows high-privileged authenticated users to inject malicious scripts via the fromdate parameter in /admin/bwdates-reports-details.php, potentially compromising admin sessions or stealing sensitive data. Public exploit code exists, but exploitation requires admin-level privileges and user interaction (likely clicking a malicious link), limiting real-world attack surface despite CVSS 1.9 indicating minimal risk.

Stored cross-site scripting (XSS) in Simple Stock System 1.0 via the /market/chatuser.php endpoint allows remote attackers to inject malicious scripts without authentication. User interaction is required for payload execution. Publicly available exploit code exists; EPSS score of 0.08% indicates low statistical exploitation probability despite XSS classification.

Stored XSS in SlimStat Analytics for WordPress allows unauthenticated attackers to inject malicious scripts via unsanitized 'outbound_resource' parameter in slimtrack AJAX action (versions ≤5.3.2). Injected scripts execute when any user accesses the compromised page, enabling session hijacking, credential theft, or privilege escalation. Affects all installations with publicly accessible AJAX endpoints. No public exploit identified at time of analysis.

DOM-based cross-site scripting (XSS) in Crocoblock JetElements For Elementor plugin versions up to 2.7.12 allows attackers to inject malicious scripts into web pages through improper input neutralization during page generation. The vulnerability affects WordPress sites using this Elementor page builder extension and can enable session hijacking, credential theft, or malware distribution against site visitors. EPSS exploitation probability is low at 0.04%, but the attack vector is likely network-based requiring no authentication.

Stored HTML injection in Nozomi Networks CMC and Guardian Asset List functionality allows unauthenticated remote attackers to inject malicious HTML tags into asset attributes via crafted network packets, enabling phishing and open redirect attacks when victims view affected assets. CVSS 5.3 (medium severity) with user interaction required; exploitation is bounded by existing Content Security Policy and input validation that prevent full XSS and direct information disclosure.

Stored cross-site scripting in Nozomi Networks CMC and Guardian allows authenticated users with report privileges to inject malicious JavaScript payloads into report definitions. When victims view or import these weaponized reports, the XSS executes in their browser context, enabling attackers to modify application data, disrupt availability, and access sensitive information. The vulnerability requires low-privilege authentication and user interaction (CVSS:4.0 score 7.1, PR:L/UI:P), with high integrity and availability impacts but limited confidentiality exposure. No public exploit identified at time of analysis, though the attack technique is well-understood and straightforward given the stored XSS nature.

Stored HTML injection in Nozomi Networks CMC and Guardian Time Machine Snapshot Diff feature allows unauthenticated attackers to inject HTML tags into asset attributes across snapshots via specially crafted network packets. When a victim uses the Snapshot Diff feature and performs specific GUI actions, the injected HTML renders in their browser, enabling phishing and open redirect attacks. Full XSS exploitation is mitigated by input validation and Content Security Policy. This vulnerability has not been confirmed as actively exploited, requires high attack complexity (multiple preconditions), and results in low integrity impact with limited scope.

Reflected cross-site scripting vulnerability in the shinetheme Traveler WordPress theme (versions below 3.2.6) enables unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser via a crafted link. Successful exploitation could lead to session theft, data compromise, or page manipulation, though no active exploitation or public proof-of-concept is currently known. Upgrading to version 3.2.6 or later resolves the issue.

Content injection in the Stockie Extra WordPress plugin allows

Reflected cross-site scripting (XSS) in 8theme's XStore Core WordPress plugin (versions below 5.6) allows unauthenticated remote attackers to inject arbitrary web scripts into pages generated by the plugin

Reflected XSS in Proliz Software Ltd. OBS (Student Affairs Information System) versions before 26.5009 allows authenticated low-privileged attackers to inject and execute malicious scripts in a victim user's browser session. The attack requires the victim to interact with a crafted URL, but upon success the confidentiality impact is rated High - meaningful in an academic context where sensitive student records and PII may be accessible. No public exploit code or CISA KEV listing exists; EPSS at 0.03% (8th percentile) indicates very low automated exploitation probability, suggesting risk is primarily confined to targeted attacks against specific Turkish educational institutions using this platform.

Reflected cross-site scripting (XSS) in xiweicheng Teamwork Management System up to version 2.28.0 allows high-privilege users to inject malicious scripts via the content parameter in the /admin/blog/comment/create endpoint. The vulnerability requires admin authentication and user interaction (UI:P), limiting real-world risk despite network accessibility. Publicly available exploit code exists, though EPSS scoring (0.06%, 18th percentile) and CVSS 1.9 indicate low actual exploitation probability due to high privilege requirements.

Spip 4.1.10 contains a file upload vulnerability that allows attackers to upload malicious SVG files with embedded external links. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Stored cross-site scripting (XSS) in ThemeNectar Salient Shortcodes WordPress plugin through version 1.5.4 allows authenticated users with low privileges to inject malicious scripts that execute in the context of higher-privileged administrators or other site visitors. The vulnerability requires user interaction (UI:R in CVSS vector) and affects the shortcode generation functionality, enabling persistence of malicious payloads in page content. EPSS score of 0.06% indicates low real-world exploitation probability despite the moderate CVSS 6.5 rating.

Stored cross-site scripting (XSS) in VK Google Job Posting Manager WordPress plugin versions up to 1.2.22 allows authenticated users with low privileges to inject malicious scripts that execute in the context of other users' browsers, potentially compromising site administrators. The vulnerability requires user interaction (clicking a link or viewing a malicious page) to trigger payload execution and affects the plugin's web page generation functionality. EPSS probability of exploitation is notably low at 0.04%, suggesting this is primarily a theoretical risk without documented active exploitation.

DOM-based cross-site scripting in the Document Library Lite WordPress plugin (versions <=1.1.7) allows authenticated attackers with high privileges to execute arbitrary JavaScript in the browser of an administrator who visits a crafted page. This could lead to account compromise or malicious actions within the WordPress admin.

Stored cross-site scripting (XSS) in Premio Stars Testimonials WordPress plugin versions 3.3.4 and below allows authenticated users to inject malicious scripts that execute in the context of other users' browsers, potentially compromising site administrators or visitors. The vulnerability requires user interaction (UI:R) and authenticated access (PR:L), limiting immediate risk, but the stored nature means injected payloads persist and affect multiple users. No public exploit code or active KEV status is documented, though the 6.5 CVSS score reflects moderate severity when considering cross-site impact.

Stored cross-site scripting (XSS) vulnerability in vion707 DMadmin backend allows high-privilege authenticated users to inject malicious scripts via the Add function in AddonsController, affecting the application's integrity. The vulnerability requires user interaction (UI:P) and high-privilege access (PR:H), limiting real-world exploitation risk despite a network attack vector. Public exploit code is available, but the extremely low CVSS score (1.9) and EPSS probability (0.05th percentile) suggest minimal practical risk in typical deployments.

Stored cross-site scripting in MISP (Malware Information Sharing Platform) versions before 2.5.28 allows authenticated users with workflow privileges to inject arbitrary JavaScript via the workflow execution path view (executionPath.ctp), where doT.js template expressions used unescaped interpolation. Successful exploitation against a user who views the affected page (UI:R) results in scope-changed compromise of the victim's MISP session, including high-confidentiality/integrity/availability impact (CVSS 9.0). Publicly available exploit code exists in researcher-published repositories; no CISA KEV listing at time of analysis.

Cross-site scripting in Mayan EDMS 4.10.1 and earlier allows remote unauthenticated attackers to inject scripts via the /authentication/ endpoint. Exploiting this vulnerability could enable session hijacking or phishing if a victim visits a malicious link. Public exploit code is available, but no active exploitation is confirmed.

Cross-site scripting (XSS) in code-projects Student File Management System 1.0 allows high-privilege users to inject malicious scripts via the /admin/update_student.php endpoint, requiring user interaction to execute. The vulnerability has low real-world impact (CVSS 1.9, EPSS 0.06%) despite publicly available exploit code, as it demands high administrative privileges and user action; however, the low exploitation threshold (EPSS percentile 18%) indicates this is not a widespread threat.

Cross-site scripting vulnerability in code-projects Student File Management System 1.0 allows high-privilege authenticated users to inject malicious scripts via the Update User Page at /admin/update_user.php, requiring user interaction to trigger. The exploit is publicly available and rated CVSS 1.9 due to restrictive privilege and UI requirements, though EPSS score of 0.05% indicates minimal real-world exploitation risk.

Reflected cross-site scripting (XSS) in WPS Visitor Counter WordPress plugin through version 1.4.8 allows remote attackers to inject malicious scripts via the REQUEST_URI parameter, which is output without sanitization in HTML attributes. The vulnerability has a CVSS score of 5.8 and requires user interaction (clicking a crafted link), with exploitation limited primarily to older web browsers due to modern XSS protections. No public exploit code or active exploitation has been identified at the time of analysis.

Reflected cross-site scripting (XSS) in Qualitor up to version 8.24.73 allows authenticated remote attackers to inject malicious scripts via the cdscript parameter in /Qualitor/html/bc/bcdocumento9/biblioteca/request/viewDocumento.php, exploitable only with user interaction (e.g., clicking a malicious link). While publicly available exploit code exists and the vendor has confirmed and patched the issue, the low CVSS score (2.0) and requirement for both authentication and user interaction significantly limit real-world risk.

Stored Cross-Site Scripting in WP Job Portal plugin for WordPress up to version 2.4.4 allows authenticated attackers with Editor-level access or higher to inject arbitrary JavaScript into job description fields by exploiting explicit whitelisting of the `<script>` tag in the WPJOBPORTAL_ALLOWED_TAGS configuration. The injected scripts execute when users view affected job listings, enabling session hijacking, credential theft, and other malicious activities. Impact is limited to multi-site installations or sites with unfiltered_html disabled. CVSS score of 4.4 reflects the high privilege requirement (PR:H) and high attack complexity (AC:H), though the vulnerability affects a potentially large number of WordPress installations.

Stored Cross-Site Scripting in Bold Timeline Lite WordPress plugin up to version 1.2.7 allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript via the 'title' parameter of the 'bold_timeline_group' shortcode, executing malicious scripts whenever users view affected pages. CVSS 6.4 reflects moderate impact (confidentiality and integrity compromise across trust boundaries); EPSS 0.04% indicates low real-world exploitation probability. No public exploit code or active exploitation confirmed.

Stored Cross-Site Scripting in BUKAZU Search widget plugin for WordPress allows authenticated attackers with Contributor-level access and above to inject arbitrary JavaScript through the 'shortcode' parameter of the 'bukazu_search' shortcode. The vulnerability affects all versions up to and including 3.3.2 and results from insufficient input sanitization and output escaping. Malicious scripts execute in the context of any user accessing affected pages. EPSS score of 0.04% indicates low real-world exploitation probability despite moderate CVSS 6.4 severity.

Stored Cross-Site Scripting in NewStatPress WordPress plugin versions up to 1.4.3 allows authenticated attackers with contributor-level or higher privileges to inject arbitrary JavaScript into pages via a regex bypass in the nsp_shortcode function. When site visitors access pages containing the injected malicious shortcode attribute, the attacker's script executes in their browsers, enabling session hijacking, credential theft, or malware distribution. No public exploit code has been identified; EPSS score of 0.04% reflects the requirement for authenticated access and user interaction.

Reflected cross-site scripting (XSS) in Accept Stripe Payments Using Contact Form 7 WordPress plugin versions up to 3.1 allows unauthenticated attackers to inject arbitrary JavaScript via the 'failure_message' parameter due to insufficient input sanitization and output escaping. An attacker can craft a malicious link that, when clicked by a victim, executes JavaScript in the victim's browser session with access to sensitive data or session tokens. No public exploit code or active exploitation has been confirmed at the time of analysis.

Stored cross-site scripting in Better Elementor Addons plugin for WordPress up to version 1.5.5 allows authenticated attackers with contributor-level or higher privileges to inject arbitrary JavaScript through insufficiently sanitized Slider widget attributes, which executes when any user views the affected page. This is a stored XSS vulnerability affecting a widely-deployed WordPress plugin; no public exploit code or active exploitation has been confirmed at time of analysis, but the low CVSS complexity (AC:L) and moderate EPSS exploitation probability make this a practical concern for any WordPress site running the vulnerable plugin versions with user roles permitted to edit pages.

Reflected cross-site scripting (XSS) in yangshare warehouseManager 仓库管理系统 1.1.0 allows authenticated remote attackers to inject malicious scripts via the Name parameter in the addCustomer function of CustomerManageHandler.java. User interaction is required for exploitation. Public exploit code is available, and the vulnerability has been disclosed publicly.

Stored cross-site scripting (XSS) in baowzh hfly up to commit 638ff9abe9078bc977c132b37acbe1900b63491c allows authenticated users with user interaction to inject malicious scripts via the /admin/index.php/advtext/add endpoint in the advtext module. Public exploit code is available, and the vulnerability carries a low CVSS score of 2.0 due to authentication and user-interaction requirements, but the EPSS score of 0.05% indicates minimal real-world exploitation probability despite public availability of proof-of-concept code.

Shopware, an open commerce platform, contains a reflected cross-site scripting (XSS) vulnerability in its authentication controller where the 'waitTime' URL parameter from the login page is rendered directly into the Twig template without validation or sanitization. Versions 6.4.6.0 through 6.6.10.9 and 6.7.0.0 through 6.7.5.0 are affected, allowing attackers to inject malicious JavaScript code through crafted URLs. With an EPSS score of only 0.04% (11th percentile), active exploitation appears low despite the availability of patches and public advisories.

Cross-site scripting in GoldenHorn (a web-based trade management platform by TAC Information Services Internal and External Trade Inc.) allows a low-privileged authenticated attacker to inject malicious JavaScript into pages rendered by other users, resulting in limited confidentiality impact such as session token or data exfiltration. All versions prior to 4.25.1121.1 are affected. No active exploitation has been confirmed (not listed in CISA KEV), and the EPSS score of 0.02% (7th percentile) indicates very low exploitation probability at time of analysis.

Stored or reflected cross-site scripting in phpIPAM v1.7.3 enables remote unauthenticated attackers to inject malicious JavaScript into the Request IP form via the `instructions` parameter, which is subsequently rendered in the admin-facing `/app/admin/instructions/edit-result.php` endpoint. When an authenticated administrator views the affected page, the injected script executes in their browser session, potentially enabling session token theft, credential harvesting, or unauthorized administrative actions. No public exploit identified at time of analysis, though a technical disclosure post exists at glitch0ne.com; EPSS of 0.22% at the 13th percentile confirms low opportunistic exploitation pressure.

Reflected XSS in Talent Software's e-BAP Automation platform (versions before build 42957) allows unauthenticated remote attackers to inject and execute malicious scripts in a victim's browser by tricking them into clicking a crafted URL. The CVSS vector (PR:N/UI:R) confirms no attacker authentication is needed, but successful exploitation depends on social-engineering a valid application user. No active exploitation has been confirmed (not in CISA KEV) and EPSS sits at 0.02% (7th percentile), indicating low near-term exploitation probability.

Reflected cross-site scripting in Talent Software UNIS allows unauthenticated remote attackers to inject and execute malicious JavaScript in a victim's browser session. All UNIS versions prior to build 42957 are affected, as disclosed by Turkey's national CERT (USOM). No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.02% (7th percentile) indicates very low observed exploitation probability.

Stored cross-site scripting in the Rencontre WordPress plugin up to version 3.13.7 allows authenticated attackers with high privileges to inject malicious scripts into fields rendered on pages accessed by other users. Successful exploitation could lead to session hijacking, data exfiltration, or defacement when victims view the affected content. No active exploitation or public exploit code has been confirmed at this time.

Stored cross-site scripting (XSS) in the WP eBay Product Feeds WordPress plugin (≤3.4.9) allows authenticated attackers with high privileges to inject malicious scripts into pages viewed by other users. The vulnerability affects all versions up to and including 3.4.9. Public exploit availability is unknown and EPSS indicates very low exploitation probability (0.06%).

Stored cross-site scripting (XSS) in the Calendly Embedder WordPress plugin (versions ≤ 1.1.7.2) allows authenticated administrators to inject malicious scripts that execute in other users' browsers when viewing affected pages. The vulnerability requires high privileges and user interaction, resulting in low confidentiality, integrity, and availability impact. No active exploitation or public exploit code is known, and EPSS indicates a 0.06% probability of exploitation.

Stored cross-site scripting vulnerability in the WP-ShowHide WordPress plugin (versions through 1.05) allows authenticated attackers with contributor-level access to inject arbitrary web scripts. When a

We are tasked with synthesizing data about CVE-2025-67534 into a comprehensive JSON analysis. We must use ALL provided data: references, EPSS, KEV status (not mentioned, assume false), patch availability, CPE strings (none provided), and tags (CSRF, XSS). First, parse the description: "Cross-Site Request Forgery (CSRF) vulnerability in Jacques Malgrange Rencontre rencontre allows Stored XSS. This issue affects Rencontre: from n/a through <= 3.13.7." CVSS: 7.1, vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. CWE-352. EPSS: 0.03% (low). No KEV mentioned, so not actively exploited. No POC data. Patch? Reference is a Patchstack database entry for a WordPress plugin. We need to infer patch availability. The reference URL likely describes the vulnerability and might say if a patch exists. Since no explicit fix version is mentioned beyond "<= 3.13.7", it's probable that the next version after 3.13.7 is a fix, but not confirmed. I'll say "Patch availability not confirmed; likely fix in version >3.13.7" but careful: rule says "If patch data says NOT available: 'No vendor-released patch identified at time of analysis'". We don't have explicit patch data. I'll note: "Upstream fix not independently confirmed; likely version after 3.13.7 addresses the issue" but avoid inventing version numbers. For remediation, I can say "Upgrade to Rencontre version 3.13.8 or higher if available, or apply vendor-provided patch" but careful: we only know <= 3.13.7 affected, so fix version would be 3.13.8. Patchstack might indicate the fix version. Since the reference is a Patchstack URL, they usually show the fixed version. So I'll assume the fix is in a later version. I'll state: "Vendor patch likely available in version 3.13.8 or later" but the rule says to cite exact fix versions from input data. The input data doesn't mention a specific fix version, only "through <= 3.13.7". I'll check: "Patch available per vendor advisory" would fit if the advisory says patch available. The reference URL is

Stored cross-site scripting in the Themify Portfolio Post WordPress plugin through version 1.3.0 allows authenticated attackers to embed arbitrary web scripts into portfolio items, which execute in victims’ browsers upon viewing. This can enable session theft, credential capture, or malicious redirects. No active exploitation or public exploit code has been reported, and the EPSS exploitation probability is low (0.06%).

DOM-based cross-site scripting (XSS) in muffingroup Betheme WordPress theme versions up to 28.2 allows authenticated attackers with low privileges to inject malicious scripts that execute in the context of other users' browsers. The vulnerability requires user interaction (UI:R) and affects the confidentiality, integrity, and availability of affected installations; EPSS exploitation probability is low at 0.04%, and no public exploit code or active exploitation has been confirmed.

DOM-based cross-site scripting in Dream-Theme The7 WordPress theme versions before 12.9.0 allows authenticated users to inject malicious scripts that execute in the context of other users' browsers via improperly sanitized input during web page generation. The vulnerability requires user interaction (UI:R) and authenticated access (PR:L), limiting real-world exploitability despite a moderate CVSS score of 6.5. EPSS exploitation probability is low at 0.04th percentile, and no public exploit code or active exploitation has been reported.

Improper HTML tag neutralization in sevenspark Contact Form 7 - Dynamic Text Extension through version 5.0.5 allows unauthenticated remote attackers to inject malicious scripts via a network-based attack with no user interaction required, resulting in confidentiality compromise through information disclosure. The vulnerability is classified as cross-site scripting (XSS) with low exploitability probability (EPSS 0.06%, percentile 18%), suggesting limited real-world attack incentive despite the network-accessible attack vector.

Stored cross-site scripting (XSS) in Porto Theme - Functionality plugin for WordPress allows authenticated users with low privileges to inject malicious scripts into web pages that execute in the browsers of other site visitors. The vulnerability affects Porto Theme - Functionality versions below 3.7.3 and has a low exploitation probability (EPSS 0.01%), but requires user interaction and authenticated access to exploit, limiting immediate risk to well-managed WordPress installations with access controls.

DOM-Based Cross-Site Scripting (XSS) in KALLYAS WordPress theme versions below 4.25.0 allows authenticated users with low privileges to inject malicious scripts that execute in the browsers of other users, potentially stealing session cookies, credentials, or performing unauthorized actions on their behalf. The vulnerability requires user interaction (clicking a malicious link) and affects the theme's web page generation routines. EPSS probability is 0.01% (very low), suggesting minimal real-world exploitation likelihood despite the moderate CVSS score of 6.5.

DOM-based cross-site scripting in WordPress plugin WP Ultimate Review versions ≤2.3.7 allows remote attackers to execute malicious JavaScript in victims' browsers via crafted input that is improperly sanitized during client-side page rendering. The vulnerability requires user interaction (CVSS UI:R) but no authentication (PR:N), enabling attacks via social engineering or malicious links. Exploitation probability is low (EPSS 0.04%, 14th percentile), with no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV).

Stored cross-site scripting (XSS) in Master Addons for Elementor through version 2.0.9.9.4 allows authenticated users with limited privileges to inject malicious scripts that execute in the browsers of other site visitors, potentially compromising administrator accounts or stealing sensitive data. The vulnerability requires user interaction (UI:R) and affects the plugin's input sanitization during web page generation. With an EPSS score of 0.04% and no confirmed active exploitation, this represents a lower real-world risk despite the moderate CVSS base score of 6.5.

Stored cross-site scripting (XSS) in SimpLy Gallery WordPress plugin (versions up to 3.3.2.1) allows authenticated users with low privileges to inject malicious scripts that execute in the browsers of other site visitors, potentially leading to session hijacking, credential theft, or site defacement. The vulnerability requires user interaction (UI:R) and affects confidentiality, integrity, and availability. No public exploit code or active exploitation has been confirmed; EPSS score of 0.04% indicates low real-world exploitation probability despite the moderate CVSS rating.

Stored cross-site scripting in the REHub Framework WordPress plugin versions below 19.9.9.7 permits authenticated attackers to inject malicious scripts. When a victim, such as an administrator, views the tainted content, the script executes in their browser, potentially stealing session data or performing actions on their behalf. The vulnerability has a low EPSS score (0.06%) and no public exploit or reported active exploitation.

DOM-based Cross-Site Scripting in the CridioStudio ListingPro Lead Form plugin for WordPress allows authenticated attackers with low privileges to inject arbitrary JavaScript into pages viewed by other users. Exploitation requires the attacker to submit crafted input via the vulnerable lead form and convince a victim to visit a page where the tainted data is rendered unsafely, enabling session hijacking, phishing, or browser-based attacks. No active exploitation or public exploit code has been identified.

Stored XSS in Make Section & Column Clickable For Elementor WordPress plugin (versions through 2.4) allows authenticated users with high privileges to inject malicious scripts that execute in other users' browsers. The vulnerability requires user interaction (UI:R) and affects site confidentiality, integrity, and availability with limited scope. EPSS score of 0.04% indicates low exploitation probability despite the presence of a public vulnerability disclosure.

DOM-based cross-site scripting (XSS) in ThimPress WP Hotel Booking plugin versions up to 2.2.8 allows authenticated users with high privileges to inject malicious scripts that execute in the context of other users' browsers. The vulnerability requires user interaction (UI:R) and high administrator privileges (PR:H), limiting its real-world impact despite a moderate CVSS score of 5.9. EPSS exploitation probability is very low at 0.04%, indicating minimal practical attack likelihood.

Stored cross-site scripting (XSS) in Generic Elements for Elementor plugin versions 1.2.9 and earlier allows authenticated users with limited privileges to inject malicious scripts that execute in the context of other users' browsers, potentially leading to session hijacking, credential theft, or malware distribution. The vulnerability requires user interaction (clicking a malicious link) and affects WordPress installations using this plugin. EPSS exploitation probability is low at 0.04%, and no public exploit code or active exploitation has been identified.

Cross-site request forgery (CSRF) in Create Posts & Terms WordPress plugin through version 1.3.1 enables attackers to inject malicious scripts that persist in the application database. Exploitation requires tricking an authenticated administrator into visiting a malicious page while logged into WordPress. The vulnerability chains CSRF with stored XSS, allowing attackers to execute arbitrary JavaScript in victims' browsers across sessions with potential for privilege escalation, data theft, and site compromise. EPSS score and exploitation data not available, but Patchstack database listing indicates security researcher disclosure.

Stored cross-site scripting (XSS) in @tiptap/extension-link before version 2.10.4 allows attackers to execute arbitrary JavaScript by injecting javascript: URL payloads into link attributes during link creation or modification. The vulnerability requires user interaction to trigger the payload and impacts the integrity of affected web applications. Publicly available exploit code exists, and a vendor-released patch is available in version 2.10.4.

Cross-site scripting in Talent Software e-BAP Automation (versions 1.8.96 through pre-v.41815) allows unauthenticated remote attackers to inject arbitrary JavaScript into web pages served by the application. The CVSS vector assigns UI:N (no user interaction required), which is atypical for XSS and may suggest a stored or persistent injection variant that auto-executes rather than a reflected type requiring a victim to click a crafted link. No public exploit identified at time of analysis, and the EPSS score of 0.03% (10th percentile) signals very low current exploitation interest; however, the unauthenticated network exposure warrants patching in internet-facing deployments.

IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.12 are affected by cross-site scripting due to improper validation of user-supplied input. An attacker could exploit this vulnerability by using a specially crafted URL to redirect the user to a malicious site.

A stored cross-site scripting vulnerability exists in the web management interface of the R.V.R. Elettronica TLK302T telemetry controller (firmware 1.5.1799).