Cross-Site Scripting

Stored cross-site scripting (XSS) in projectworlds Expense Management System 1.0 allows high-privileged authenticated users to inject malicious scripts via the /public/admin/users/create endpoint, which are executed in the browsers of other users viewing the affected page. The vulnerability requires administrator privileges and user interaction (clicking a link), significantly limiting exploitation scope despite remote accessibility and publicly available proof-of-concept code.

Stored cross-site scripting (XSS) in projectworlds Gate Pass Management System 1.0 allows authenticated users to inject malicious scripts via the /add-pass.php endpoint, which execute in the browsers of other users who view the affected content. The vulnerability requires user interaction (UI:P) and authenticated access (PR:L), limiting its scope to reflected or stored XSS within an authenticated session. Publicly available exploit code exists, though EPSS exploitation probability remains very low at 0.03%, suggesting limited real-world weaponization despite public disclosure.

Stored cross-site scripting (XSS) in Iqbolshoh php-business-website admin/contact.php allows authenticated attackers with user interaction to inject malicious scripts via the twitter parameter, affecting data integrity for other users. The vulnerability affects a rolling-release project up to commit 10677743a8dfc281f85291a27cf63a0bce043c24, has published exploit code available, but carries low real-world risk due to authentication requirement (PR:L), user interaction dependency (UI:P), and limited impact scope (VI:L only). EPSS exploitation probability is 0.03% (7th percentile), indicating minimal practical exploitation likelihood despite public POC availability.

Stored Cross-Site Scripting (XSS) in Ultimate Addons for WPBakery Page Builder allows unauthenticated attackers to inject malicious scripts into web pages through improper input neutralization. The vulnerability affects versions prior to 3.21.1, enabling attackers to execute arbitrary JavaScript in the browsers of site visitors, potentially leading to session hijacking, credential theft, or malware distribution. No public exploit code has been identified at the time of analysis, and real-world exploitation probability is minimal (EPSS 0.02%).

Stored cross-site scripting in the Dynamic User Directory WordPress plugin (versions ≤ 2.3) allows a high-privileged authenticated user to inject persistent malicious scripts that execute in the browsers of other site visitors or administrators. Disclosed by Patchstack (audit@patchstack.com), the flaw carries a CVSS base score of 5.9 with Scope:Changed, reflecting cross-origin browser impact that can escalate to session hijacking even from a low-C/I impact rating. EPSS places exploitation probability at 0.02% (7th percentile), and no public exploit code or CISA KEV listing has been identified at time of analysis.

Stored cross-site scripting (XSS) in CrestaProject Attesa Extra WordPress plugin versions 1.4.7 and earlier allows authenticated users with low privileges to inject malicious scripts that execute in the browsers of other site visitors, potentially compromising session tokens, stealing sensitive data, or performing unauthorized actions. The vulnerability requires user interaction (clicking a malicious link) to trigger the payload, affects confidentiality, integrity, and availability, and carries a moderate CVSS score of 6.5 despite very low EPSS exploitation probability (0.02%, 7th percentile), suggesting limited real-world weaponization despite the vector permitting network-based attacks.

Stored cross-site scripting (XSS) in XLPlugins NextMove Lite WordPress plugin versions through 2.23.0 allows authenticated users with low privileges to inject malicious scripts into thank-you pages, affecting site visitors with escalated impact in multi-site contexts. The vulnerability requires user interaction (page visit) and leverages the plugin's improper input sanitization on web page generation. EPSS exploitation probability is low (0.02%), and no confirmed active exploitation has been reported; however, the stored nature and authenticated attack vector make it a meaningful risk for WordPress sites with untrusted user roles.

DOM-based cross-site scripting (XSS) in Designinvento DirectoryPress WordPress plugin through version 3.6.25 allows authenticated attackers with low privileges to inject malicious scripts that execute in the context of other users' browsers when they view affected pages. The vulnerability requires user interaction (clicking a malicious link) and can affect website visitors across the entire site, potentially leading to session hijacking, credential theft, or malware distribution. EPSS score of 0.02% indicates low exploitation probability despite the publicly available vulnerability details.

DOM-based cross-site scripting (XSS) in Estatik WordPress plugin through version 4.3.0 allows authenticated attackers with low privileges to inject malicious scripts that execute in the browsers of other users, potentially compromising session tokens, stealing sensitive data, or performing unauthorized actions with a victim's permissions. The vulnerability requires user interaction (clicking a malicious link) and affects the entire web application context. No public exploit code or active exploitation has been identified at the time of analysis, though the low EPSS score (0.02%) suggests limited real-world exploitation despite the moderate CVSS rating.

Stored cross-site scripting via CSRF in the CloudSearch WordPress plugin (versions up to and including 3.0.0) by Andrea Landonio allows a remote attacker to trick an authenticated user into submitting a forged request that injects persistent malicious script. Because the injected payload is stored and served to other users, its execution crosses a security scope (S:C), amplifying impact beyond the tricked victim. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.02%, 5th percentile), indicating negligible near-term mass-exploitation pressure.

A stored cross-site scripting (XSS) vulnerability can be exploited via cross-site request forgery (CSRF) in the NikanWP WooCommerce Reporting plugin for WordPress up to version 1.0.0. This allows remote attackers to trick an administrator into performing actions that inject malicious scripts into the plugin's reporting data, which then executes in the victim's browser when viewing the reports. No active exploitation or public exploit code is known, and the EPSS exploitation probability is extremely low (0.02%).

CSRF in Reloadly plugin for WordPress allows stored XSS via a crafted request lacking anti-CSRF tokens, enabling an attacker to inject persistent scripts by tricking an admin. The vulnerability affects all versions up to 2.0.1, with a CVSS base score of 7.1, but EPSS indicates only a 0.02% chance of exploitation, and no active exploitation or public exploit code is known.

Stored cross-site scripting (XSS) in icc0rz H5P WordPress plugin versions 1.16.0 and earlier allows authenticated users with limited privileges to inject malicious scripts that execute in the browsers of other users viewing affected content. The vulnerability stems from improper input sanitization during web page generation and requires user interaction (UI:R) to trigger, affecting confidentiality, integrity, and availability with a CVSS score of 6.5. Despite the moderate CVSS rating, the EPSS score of 0.02% indicates very low real-world exploitation probability at time of analysis, with no public exploit code or active exploitation confirmed.

Cross-Site Request Forgery (CSRF) in the Did Prestashop Display WordPress plugin (versions ≤1.0.30) allows unauthenticated attackers to inject persistent malicious scripts (stored XSS) by tricking an authenticated administrator into clicking a crafted link. The vulnerability carries a CVSS 3.1 base score of 7.1, but no active exploitation or public exploit code is known, and the EPSS exploitation probability is only 0.02%.

Stored cross-site scripting in the Next Page, Not Next Post WordPress plugin up to version 0.3.0 allows authenticated attackers with low privileges to inject malicious web scripts. These scripts execute in the browser of any user viewing the affected page, potentially leading to session hijacking, defacement, or redirection. The vulnerability has a low EPSS score (0.02%) and no known active exploitation or public exploit code at this time.

Stored cross-site scripting in the wp-mapbox-gl-js plugin for WordPress allows low-privilege authenticated attackers to inject arbitrary web scripts. When a victim views a page containing the malicious map, the script executes in their browser, enabling session hijacking, defacement, or credential theft. EPSS predicts extremely low exploitation probability and no active exploitation or public exploit code is known.

Stored Cross-Site Scripting (XSS) in the Events Maker WordPress plugin (≤ 1.6.14) allows authenticated users with low privileges to inject malicious scripts into event-related content. When a victim views the crafted event page, the script executes in their browser, potentially leading to session theft, defacement, or redirection. At time of analysis, no active exploitation or public proof-of-concept has been identified, and EPSS indicates a very low exploitation probability (0.02%).

Stored cross-site scripting (XSS) in the Blox Lite WordPress plugin (version <= 1.2.8) allows authenticated users with content creation privileges to inject arbitrary web scripts. When an administrator or high-privilege user views the affected content, the injected script executes in their browser, potentially leading to session hijacking, site defacement, or phishing. The vulnerability has a low EPSS score (0.02%) and no evidence of active exploitation, though public exploit code may be possible given the nature of XSS.

Stored Cross-S

Stored Cross-Site Scripting (XSS) in the WordPress plugin Post List Featured Image allows authenticated attackers with low privileges to inject malicious scripts that execute in other users' browsers. Versions up to and including 0.5.9 are affected. Exploitation requires an authenticated session and user interaction, with no active exploitation or public exploit known at time of analysis; EPSS reflects a very low exploitation probability (0.02%).

Content injection via stored script-tag HTML in the xSmart WordPress theme through version 1.2.9.4 allows low-privileged authenticated users to embed unsanitized HTML - including script-bearing tags - into pages served to other site visitors. The flaw originates from inadequate output escaping in the Jthemes-developed theme and is classified as CWE-80 (Basic XSS / HTML tag injection). No public exploit code or active exploitation has been identified; EPSS sits at 0.02% (6th percentile), consistent with low threat-actor interest at time of analysis.

Cross-Site Request Forgery in the WP Business Hours WordPress plugin through version 1.4 allows attackers to inject arbitrary web scripts via stored XSS. An unauthenticated attacker can craft a malicious link that, when clicked by an authenticated administrator, triggers a CSRF request to the vulnerable plugin, resulting in persistent script execution in the browsers of other site visitors. The vulnerability has a CVSS score of 7.1 (High) but a very low EPSS exploitation probability (0.02%), and no active exploitation or public proof-of-concept is known.

Stored cross-site scripting via cross-site request forgery in the Awesome Testimonials WordPress plugin up to version 2.2.1 allows unauthenticated attackers to inject malicious scripts that execute in the browsers of site visitors. Exploitation requires a logged-in administrator to be tricked into clicking a crafted link, but no other special configuration is necessary. No active exploitation or public proof-of-concept has been identified at this time.

DOM-based cross-site scripting (XSS) in RomanCode MapSVG WordPress plugin versions up to 8.7.22 allows remote attackers to inject malicious scripts into web pages viewed by other users. The vulnerability requires user interaction (UI:R) and affects the confidentiality and integrity of web sessions. Although the CVSS score is 6.1 (medium), the EPSS exploitation probability is very low at 0.02%, and no public exploit code or active exploitation has been identified; this suggests the practical attack likelihood is minimal despite the moderate CVSS rating.

DOM-based cross-site scripting (XSS) in Marquee Addons for Elementor WordPress plugin versions through 3.8.2 allows remote attackers to inject malicious scripts through improper input neutralization during web page generation. The vulnerability requires user interaction (UI:R) and affects the confidentiality and integrity of affected websites. While CVSS scores 6.1 (medium), the 0.02% EPSS percentile indicates low real-world exploitation probability despite public awareness.

Stored cross-site scripting (XSS) in the Usercentrics CMP WordPress plugin (versions up to 1.0.9) allows authenticated administrator-level attackers to inject arbitrary JavaScript that executes in other users' browsers. Successful exploitation can lead to session hijacking, credential theft, or defacement of the consent management interface. No active exploitation or publicly available proof-of-concept has been identified at time of analysis, and EPSS indicates very low exploitation probability.

Stored cross-site scripting in the Tooltipy (bluet-keywords-tooltip-generator) WordPress plugin through version 5.5.9 allows an authenticated attacker with low privileges to inject persistent malicious scripts into keyword tooltip data. When any site visitor views a page rendering the poisoned tooltip, the script executes in their browser under the site's origin, enabling session hijacking, credential theft, or further client-side attacks. No public exploit or active exploitation has been identified; EPSS is 0.02%, reflecting minimal current threat actor interest.

Stored cross-site scripting in the Opal Service WordPress plugin (<=1.9.1) allows authenticated attackers to inject scripts that execute in the context of other users' sessions. The vulnerability arises from improper input neutralization during page generation, potentially leading to data theft or unauthorized actions. No active exploitation or public proof-of-concept has been identified, and EPSS risk is minimal.

Stored cross-site scripting in SiteGround Email Marketing plugin for WordPress <=1.7.1 allows authenticated attackers with low-privilege accounts to inject scripts that execute in the context of users who view the affected page, potentially leading to session hijacking or unauthorized actions. The vulnerability, reported by Patchstack, has a medium CVSS score (6.5) but a very low EPSS exploitation probability (0.02%) with no known public exploit or active exploitation at this time.

Stored cross-site scripting in the Rock Convert WordPress plugin (≤3.0.1) enables low-privilege authenticated users to inject scripts that execute in the browsers of other users viewing compromised pages, potentially hijacking sessions or phishing credentials. No active exploitation or public exploit code is known, and EPSS estimates a very low (0.02%) chance of exploitation. The risk is moderate for sites with untrusted users, but elevated for admin accounts that view the injected content.

We are tasked with synthesizing multi-source intelligence about CVE-2025-62910 into a comprehensive JSON analysis. Need to follow all rules. First, extract info from input: - CVE ID: CVE-2025-62910 - Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in deshine Video Gallery by Huzzaz huzzaz-video-gallery allows Stored XSS. This issue affects Video Gallery by Huzzaz: from n/a through <= 10.5. - CVSS: 6.5, vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L - CWE: CWE-79 - EPSS: 0.02%, percentile 7% - Reported by: audit@patchstack.com - Tags: XSS - References: [nvd] (None) https://patchstack.com/database/Wordpress/Plugin/huzzaz-video-gallery/vulnerability/wordpress-video-gallery-by-huzzaz-plugin-10-5-cross-site-scripting-xss-vulnerability?_s_id=cve Other info: patch information? No explicit patch version mentioned. Description says "from n/a through <= 10.5". No KEV status, no POC info. So exploitation status: "no public exploit identified at time of analysis". Need to note. Fields: 1. product_name: "1-3 words ONLY." The product is "Video Gallery by Huzzaz" (a WordPress plugin). Abbreviated? Could be "Video Gallery by Huzzaz" (3 words). Maybe "Huzzaz Video Gallery" as per description "Video Gallery by Huzzaz". I'll use "Huzzaz Video Gallery". 2. summary: 2-3 sentence plain-language synthesis. Must not start with generic "A vulnerability". Start with impact verb and product. For stored XSS, impact is "Stored cross-site scripting". So: "Stored cross-site scripting in the Huzzaz Video Gallery WordPress plugin <=10.5 allows authenticated attackers...". But check CVSS: PR:L (requires low privileges), UI:R (user interaction required for exploitation). So an attacker with low privileges (e.g., contributor) can inject a script that will be stored and executed when an admin or other user views the page. Score 6.5, medium. EPSS low. No active exploitation. So summary: "Stored cross-site scripting in the Huzzaz

Stored cross-site scripting (XSS) in the WordPress plugin Custom Post Type Attachment (custom-post-type-pdf-attachment) up to version 3.4.6 allows authenticated attackers with low privileges to inject malicious scripts that execute in the browsers of other users, potentially leading to session hijacking, defacement, or redirection to malicious sites. No active exploitation or public exploit code has been reported, but the vulnerability requires user interaction to trigger.

Stored cross-site scripting in the Query Posts WordPress plugin 0.3.2 and below allows an authenticated attacker with low privileges to inject malicious scripts that execute in the browser of users who view the affected page, leading to data theft or session hijacking. No active exploitation or public exploit code has been reported, and the EPSS exploitation probability is very low (0.02%).

Stored cross-site scripting in WordPress WP Geo plugin through version 3.5.1 enables authenticated attackers to inject malicious scripts that execute in victims' browsers. The vulnerability, reported by Patchstack, could allow session theft or content manipulation when a privileged user views a page containing the stored payload. No evidence of active exploitation exists, and the EPSS score is low (0.02%).

Stored cross-site scripting (XSS) in WPClever WPC Smart Messages for WooCommerce plugin versions up to 4.2.8 allows authenticated users with limited privileges to inject malicious scripts that execute in the browsers of other site visitors. The vulnerability requires user interaction (UI:R) and affects confidentiality and integrity through script injection, with a CVSS score of 5.4 reflecting moderate risk; however, the 0.02% EPSS score indicates minimal real-world exploitation probability at time of analysis, and no public exploit code or active exploitation has been confirmed.

Stored cross-site scripting in the Popular Posts by Webline WordPress plugin allows authenticated attackers to inject arbitrary web scripts into pages that will execute whenever a user accesses an affected page. The vulnerability affects plugin versions up to and including 1.1.1 and can lead to data theft or session hijacking when an administrator or other high-privilege user views the injected content. No active exploitation or public exploit code was identified at the time of analysis, and EPSS indicates a very low probability of widespread exploitation.

Stored cross-site scripting in Photospace Responsive WordPress plugin versions up to 2.2.0 allows authenticated administrators to inject malicious scripts that execute in the context of other users' sessions. The vulnerability, assigned CVE-2025-62899, can lead to limited compromise of confidentiality, integrity, and availability. With a very low EPSS score (0.02%) and no exploit code publicly available, current exploitation likelihood is minimal.

Stored cross-site scripting in the WordPress Links shortcode plugin up to version 1.8.3 allows authenticated attackers with low privileges to inject malicious scripts via the plugin's shortcode functionality. When a victim views a page containing the crafted shortcode, the injected script executes in their browser, leading to potential session theft, content manipulation, or redirection. No active exploitation or public exploit is reported, and EPSS indicates a low exploitation probability.

Improper neutralization of HTML script tags in WP Recipe Maker through version 10.0.x enables reflected cross-site scripting (XSS) attacks against users. The vulnerability affects the Brecht WP Recipe Maker WordPress plugin and requires user interaction (clicking a malicious link) to exploit. An attacker can inject arbitrary JavaScript into the page context, achieving code execution in the victim's browser with potential to steal session tokens or perform actions on behalf of authenticated users. The vulnerability has low real-world exploitation probability (EPSS 0.02%) and does not appear to be actively exploited in the wild.

Cross-Site Request Forgery (CSRF) in the Multilang Contact Form WordPress plugin (≤ 1.5) allows an attacker to inject stored cross-site scripting (XSS) payloads by tricking an authenticated administrator into clicking a malicious link. The stored XSS can then execute in the context of other users viewing the affected page, leading to cookie theft, session hijacking, or defacement. No public exploit code or active exploitation has been identified, and the EPSS score is very low (0.02%), indicating minimal current probability of large-scale attacks.

Stored Cross-Site Scripting vulnerability in ACF Recent Posts Widget WordPress plugin allows authenticated users with contributor-level access to inject malicious scripts into pages. Affects versions up to 5.9.3. EPSS score is very low (0.02%) and no public exploit or KEV listing identified, reducing immediate exploitation risk.

DOM-based cross-site scripting (XSS) in King Addons for Elementor plugin versions up to 51.1.61 allows authenticated users with low privileges to inject malicious scripts that execute in other users' browsers when they interact with affected pages. The vulnerability requires user interaction (clicking a link) and affects the confidentiality and integrity of website content, with an EPSS score of 0.02% indicating low real-world exploitation probability despite the moderate CVSS rating of 5.4.

Cross-site request forgery enables stored XSS injection in WordPress Pricing Table builder plugin versions up to 1.5.3. Remote unauthenticated attackers can trick authenticated WordPress administrators into executing malicious requests that inject persistent JavaScript payloads into pricing table configurations. EPSS score of 0.02% (4th percentile) indicates low observed exploitation probability, and no active exploitation has been confirmed via CISA KEV. The changed scope (S:C) in CVSS vector indicates potential for broader site compromise beyond the plugin's security context.

DOM-based cross-site scripting (XSS) in RexTheme WP VR WordPress plugin up to version 8.5.48 allows authenticated users with low privileges to inject malicious scripts that execute in other users' browsers with site-wide scope. The vulnerability requires user interaction (UI:R) and affects confidentiality, integrity, and availability equally. Exploitation requires valid WordPress account credentials but carries moderate real-world risk given the low EPSS score (0.02%) and authenticated requirement despite the CVSS 6.5 rating.

Reflected cross-site scripting in Mingsoft MCMS v6.0.1 allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by delivering a crafted URL containing a malicious payload. The CVSS scope change (S:C) indicates impact extends beyond the web application itself into the victim's browser trust context, enabling session hijacking or credential theft. No public exploit identified at time of analysis beyond the referenced GitHub gist, and EPSS of 0.22% (13th percentile) signals very low current exploitation interest.

Stored cross-site scripting on the KeeneticOS 'Wireless ISP' page enables a physically proximate attacker to compromise a Keenetic router by injecting a malicious payload-likely via a crafted nearby wireless network name (SSID)-that executes in an authenticated administrator's browser session. Successful exploitation allows the attacker to create additional users with full administrative permissions, resulting in complete device takeover. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS probability stands at 0.03%, indicating limited current exploitation activity.

Reflected cross-site scripting in Proliz Software OBS (Student Affairs Information System) prior to V26.0401 allows remote attackers to execute arbitrary JavaScript in a victim's browser session after luring them to click a crafted link. The high CVSS of 7.6 reflects unauthenticated network exploitation with high confidentiality impact, though no public exploit identified at time of analysis and EPSS data was not provided. The flaw was reported by Turkey's national CERT (USOM), indicating regional relevance for Turkish higher-education institutions that use this Student Affairs platform.

Reflected XSS in AcBakImzala, ArkSigner's document signing application, affects all versions before v5.1.4 and allows unauthenticated remote attackers to inject and execute malicious scripts in a victim's browser. The attack requires the victim to interact with a crafted URL, limiting automated exploitation, but the low attack complexity and absence of authentication requirements make social-engineering-based delivery straightforward. No public exploit code or CISA KEV listing has been identified; EPSS is very low at 0.03% (9th percentile), consistent with limited observed exploitation interest at this time.

Stored Cross-Site Scripting (XSS) can be injected into WordPress sites running the Video Blogster Lite plugin up to version 1.2 via a Cross-Site Request Forgery (CSRF) attack. An unauthenticated attacker can trick an authenticated administrator into clicking a crafted link, leading to persistent JavaScript execution in the browsers of site visitors. There is no evidence of active exploitation or public exploit code at this time, and the EPSS model predicts a very low probability of widespread use.

Stored cross-site scripting in the Werk aan de Muur WordPress plugin (≤1.5) allows authenticated users with high privileges to inject malicious scripts that execute in other administrators’ browser contexts, potentially leading to session hijacking or content manipulation. No public exploit code found; not listed in CISA KEV or reported as actively exploited. EPSS score indicates very low exploitation probability.

Stored cross-site scripting vulnerability in the Colibri Page Builder WordPress plugin allows authenticated editors or administrators to inject malicious scripts into pages. When other users view the affected page, the script executes, potentially leading to limited data theft, defacement, or session hijacking. Exploitation requires high privileges and user interaction; no active exploitation or public exploit code is known, and EPSS predicts a very low exploitation probability (0.02%).

Reflected cross-site scripting in the Easy WooCommerce Customizer WordPress plugin (versions up to and including 1.0.2) allows unauthenticated remote attackers to inject arbitrary JavaScript into a victim's browser session by tricking them into clicking a crafted URL. The vulnerability carries a changed scope (S:C), meaning injected script runs in the victim's browser context and can access cookies, session tokens, or perform actions on behalf of the authenticated user. No public exploit code has been identified and EPSS probability is minimal at 0.03%, indicating very low current real-world exploitation activity.

Stored cross-site scripting in the Doctreat WordPress Theme through version 1.6.7 allows authenticated attackers to inject HTML and script code, enabling client-side code injection in visitors' browsers. Exploitation requires a contributor-level WordPress account but no user interaction from the victim. No public exploit code or active exploitation has been reported; EPSS indicates a very low likelihood of widespread attacks.

Reflected XSS in the NEX-Forms LITE WordPress plugin (all versions prior to 8.2) allows unauthenticated remote attackers to inject and execute malicious JavaScript in a victim's browser by luring them to a crafted URL. The script runs in the browser's page context with scope change, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit code or active exploitation has been identified; the EPSS score of 0.03% at the 8th percentile reflects negligible current exploitation activity.

Reflected cross-site scripting in WP Tactical Popup plugin for WordPress (≤1.1) allows unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser via a crafted URL. Exploitation requires user interaction (clicking a malicious link), potentially leading to session hijacking or content manipulation. No active exploitation or public exploit has been identified at this time.

Reflected Cross-Site Scripting (XSS) in the Munzir myshouts-shoutbox WordPress plugin (versions ≤ 0.9) allows unauthenticated attackers to inject and execute arbitrary web scripts in a victim’s browser by tricking them into clicking a crafted link. The vulnerability arises from improper neutralization of user input during web page generation, enabling script execution in the context of the affected site. No active exploitation or public exploit code has been identified, and EPSS indicates a low probability of real-world exploitation (0.03%).

Reflected cross-site scripting in the WordPress Likert Survey Master plugin allows unauthenticated attackers to inject arbitrary web scripts via a crafted URL. Successful exploitation requires tricking an administrator into clicking the link while authenticated, potentially leading to session hijacking or malicious actions performed in the victim's browser context. No active exploitation or public exploit code has been identified, and the EPSS score indicates very low exploit likelihood (0.07%).

Stored cross-site scripting in the Toast Mobile Menu WordPress plugin (<=1.0.8) allows unauthenticated attackers to inject malicious scripts that execute when a user views an infected page, potentially leading to session hijacking or content manipulation. No active exploitation or public proof-of-concept is confirmed at time of analysis, and the EPSS score indicates a low probability of real-world attacks.

Reflected cross-site scripting in the MultiSite Clone Duplicator WordPress plugin through version 1.5.3 allows attackers to execute arbitrary JavaScript in victims' browsers when they click a crafted link. Successful exploitation could lead to session hijacking, data theft, or unauthorized actions on behalf of the user. No active exploitation or public exploits are known, and EPSS predicts very low exploitation likelihood (0.06%).

Reflected cross-site scripting (XSS) in the Contact Form by Supsystic WordPress plugin (versions through 1.7.36) allows unauthenticated remote attackers to execute malicious JavaScript in victims' browsers via crafted URLs. The vulnerability enables session hijacking, credential theft, and malicious actions performed in the context of the victim's authenticated session. EPSS probability indicates low exploitation likelihood (0.07%, 22nd percentile) with no public exploit identified at time of analysis.

Reflected Cross-Site Scripting (XSS) in WordPress plugin oik-privacy-policy versions ≤1.4.10 allows remote attackers to execute arbitrary JavaScript in victims' browsers. Exploitation requires user interaction (victim must click malicious link). EPSS probability is low (0.07%, 22nd percentile), and no active exploitation is confirmed. Reported by Patchstack security audit team, indicating professional vulnerability disclosure.

Reflected cross-site scripting in NextMove Lite (WordPress thank-you page plugin) versions ≤2.24.0 allows unauthenticated remote attackers to execute malicious JavaScript in victim browsers via crafted URLs. The vulnerability requires user interaction (clicking a malicious link) but achieves scope change per CVSS vector, enabling session hijacking, credential theft, or malicious actions under victim's WordPress session. EPSS score of 0.03% (8th percentile) indicates low probability of mass exploitation, though XSS vulnerabilities are commonly used in targeted social engineering campaigns against WordPress site administrators.

Reflected cross-site scripting in the CropRefine WordPress plugin (<= 1.2.1) allows unauthenticated attackers to inject arbitrary web scripts by tricking a user into clicking a crafted link. The vulnerability, reported by Patchstack, has a CVSS 7.1 high severity but a very low EPSS exploitation probability (0.03%), and no active exploitation or public exploit code has been identified.

Reflected cross-site scripting in bbPress Notify plugin versions up to 2.19.5 allows unauthenticated remote attackers to execute malicious JavaScript in victim browsers through crafted URLs. The vulnerability stems from improper input sanitization during web page generation (CWE-79). With CVSS 7.1 and changed scope (S:C), successful exploitation enables session hijacking, credential theft, and malicious actions in the victim's context. EPSS score of 0.03% (8th percentile) indicates low observed exploitation probability, and no active exploitation is confirmed (not in CISA KEV), though Patchstack has publicly documented the vulnerability.

Reflected cross-site scripting in Robokassa payment gateway for WooCommerce (versions ≤1.8.5) allows remote attackers to execute malicious JavaScript in victim browsers through specially crafted URLs. The scope-change CVSS flag indicates attackers can impact resources beyond the vulnerable plugin itself, potentially compromising WooCommerce admin sessions or customer payment data. EPSS probability is low (0.03%, 8th percentile), and no active exploitation or public POC has been identified at time of analysis.

Reflected cross-site scripting in Email Attachment by Order Status & Products WordPress plugin versions ≤1.0.1 allows remote unauthenticated attackers to execute arbitrary JavaScript in victim browsers through low-complexity attacks requiring user interaction. The vulnerability enables cross-site scope impact (S:C), allowing attackers to compromise confidentiality, integrity, and availability at a low level across security boundaries. No active exploitation or public POC is confirmed at time of analysis, with EPSS data unavailable for this recently published CVE.

Stored cross-site scripting (XSS) in Crocoblock JetElements For Elementor plugin through version 2.7.8 allows authenticated users with low privileges to inject malicious scripts that execute in the browsers of site visitors, potentially compromising site integrity and user sessions. The vulnerability requires user interaction (UI:R) and affects authenticated users (PR:L), limiting immediate blast radius but posing persistent risk to WordPress installations using this Elementor extension.

Stored XSS in Crocoblock JetEngine WordPress plugin versions 3.7.3 and earlier allows authenticated users with limited privileges to inject malicious scripts that execute in the browsers of other users, including administrators. The vulnerability requires user interaction (UI:R) to trigger and affects confidentiality, integrity, and availability with limited scope. With EPSS at 0.07% and no KEV status indicating active exploitation, this represents a low-probability but real risk requiring patching in multi-user WordPress environments.

Stored cross-site scripting (XSS) in Crocoblock JetBlocks For Elementor plugin versions up to 1.3.18 allows authenticated users with low privileges to inject malicious scripts that execute in the browsers of other site visitors. The vulnerability requires user interaction (UI:R) and affects confidentiality and integrity, with an EPSS score of 0.06% indicating very low real-world exploitation likelihood despite the moderate CVSS 5.4 rating.

Reflected cross-site scripting (XSS) in Crocoblock JetBlog WordPress plugin through version 2.4.4 allows authenticated users to inject malicious scripts that execute in other users' browsers when they interact with crafted links. The vulnerability requires user interaction (UI:R) and authenticated access (PR:L), limiting but not eliminating real-world risk; EPSS score of 0.07% indicates low exploitation probability despite the moderate CVSS 6.5 rating.

Stored Cross-Site Scripting (XSS) in Crocoblock JetBlog WordPress plugin through version 2.4.4.1 allows authenticated users with low privileges to inject malicious scripts that persist in web pages and execute in the browsers of other site visitors, potentially compromising session tokens, stealing sensitive data, or performing unauthorized actions. EPSS score of 0.07% and lack of public exploit code indicate low real-world exploitation probability despite the moderate CVSS 6.5 score.

Reflected cross-site scripting (XSS) in Crocoblock JetSearch WordPress plugin versions through 3.5.10 allows unauthenticated remote attackers to execute arbitrary JavaScript in victim browsers via maliciously crafted URLs. The vulnerability requires user interaction (clicking a malicious link) but carries a changed scope, meaning successful exploitation can impact resources beyond the vulnerable component. EPSS probability is low (0.07%, 22nd percentile), indicating minimal observed exploitation attempts, and no public exploit code or CISA KEV listing exists at time of analysis.

DOM-based cross-site scripting (XSS) in Crocoblock JetWooBuilder plugin through version 2.1.20 allows authenticated users with low privileges to inject malicious scripts that execute in other users' browsers when they interact with affected pages. The vulnerability requires user interaction (UI:R per CVSS) and affects the plugin's web page generation functions. No public exploit code or active exploitation has been confirmed, though the issue carries a moderate CVSS score of 6.5 and low EPSS probability (0.07%, 22nd percentile) suggesting limited real-world attack incentive despite the authentication requirement being relatively low-barrier for WordPress environments.

Stored XSS vulnerability in Crocoblock JetWooBuilder WordPress plugin versions up to 2.1.20.1 allows authenticated users with low privileges to inject malicious scripts that execute in the browsers of other users viewing affected pages, potentially leading to session hijacking, credential theft, or defacement. The vulnerability requires user interaction (UI:R) from victims and affects the confidentiality, integrity, and availability of website content. No public exploit code or active exploitation has been confirmed at time of analysis.

DOM-based XSS in the Seriously Simple Podcasting WordPress plugin (versions through 3.11.1) enables a high-privileged attacker to inject malicious client-side scripts that execute in the browsers of visitors who subsequently view the affected podcast content. The CVSS vector (PR:H, UI:R) confirms this requires both admin-level WordPress access to introduce the payload and a victim's page interaction to trigger execution. With an EPSS of 0.02% (7th percentile), no CISA KEV listing, and no public exploit identified, real-world risk is low despite the network-accessible attack vector.

Stored cross-site scripting in Cinza Grid WordPress plugin versions up to 1.2.1 allows authenticated contributors and above to inject arbitrary JavaScript into pages via the 'cgrid_skin_content' post meta field, which executes when other users view the affected pages. The vulnerability stems from missing input sanitization and output escaping in backend processing functions. CVSS 6.4 reflects moderate impact with network-accessible attack surface, though exploitation requires valid WordPress contributor-level credentials.

Stored Cross-Site Scripting in WP-Force Images Download WordPress plugin versions up to 1.8 allows authenticated contributors and above to inject arbitrary JavaScript via the 'class' attribute of the 'wpfid' shortcode due to insufficient input sanitization and output escaping. The vulnerability executes malicious scripts in the browser of any user viewing an affected page, potentially enabling account compromise, malware distribution, or defacement with CVSS 6.4 (medium severity). No public exploit code or confirmed active exploitation has been identified at time of analysis.

Reflected XSS in City Guide (giSoft Information Technologies) before version 1.4.45 allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted URL. The CVSS Changed Scope (S:C) indicates the injected script can affect resources outside the vulnerable application's security domain - such as the user's broader browser session - enabling session theft, credential harvesting, or UI redirection. No public exploit identified at time of analysis, and an EPSS score of 0.03% at the 7th percentile reflects very low observed exploitation probability.

Cross-site scripting (XSS) in LogicalDOC Community Edition up to 9.2.1 allows authenticated attackers with user interaction to inject malicious scripts via contact form fields (First Name, Last Name, Company, Address, Phone, Mobile) on the /frontend.jsp Add Contact Page. Publicly available exploit code exists; EPSS score of 0.03% reflects low real-world exploitation probability despite public POC, likely due to authentication and user interaction requirements.

Stored cross-site scripting (XSS) in AFFiNE up to version 0.24.1 allows authenticated users to inject malicious scripts via the Avatar Upload Image endpoint, which are executed in the browsers of other users viewing the attacker's profile. The vulnerability requires user interaction (victim must view the malicious avatar) and authenticated access, resulting in limited but confirmed integrity impact. Public exploit code exists; vendor contact attempts yielded no response.

Stored cross-site scripting in the MediaWiki WebAuthn extension allows authenticated, low-privilege attackers to inject malicious scripts via WebAuthn key names. When an administrator or another user views the key listing page, the script executes, potentially leading to session hijacking, content manipulation, or application disruption. No active exploitation or public exploit code has been reported.

Stored Cross-Site Scripting in CobbleStone Enterprise Contract Management Portal v22.4.0 allows a low-privileged, authenticated remote attacker to inject persistent malicious scripts into the application's chat box component. When a victim user views the chat, the injected script executes in their browser session, enabling session hijacking, credential theft, or in-application action forgery scoped to the vulnerable system. Notably, the vendor has disclosed that v22.4.0 is an obsolete, unsupported version no longer in active distribution, which substantially narrows the real-world attack surface. No public exploit identified at time of analysis, though a researcher writeup on Medium constitutes partial technical disclosure.

Stored cross-site scripting (XSS) in the Memberlite Shortcodes WordPress plugin through version 1.4.1 allows authenticated attackers to inject arbitrary web scripts. This vulnerability can lead to session hijacking or arbitrary actions executed in the context of the victim's browser when they view a page containing malicious shortcode content. No active exploitation or public exploit code has been identified at time of analysis.

Reflected XSS in Ilevia EVE X1 Server firmware (all versions through 4.7.18.0.eden) exposes unauthenticated network attackers to client-side code execution by injecting malicious payloads via the index.php endpoint on port 8080. A publicly available proof-of-concept exploit exists (ZSL-2025-5961), raising the practical risk above the 5.1 CVSS score alone would suggest. Critically, Ilevia has formally declined to issue a patch, leaving all deployed devices permanently unmitigated at the firmware level - the only vendor-sanctioned control is network segmentation.

Cross-site scripting (XSS) in Apeman ID71 EN75.8.53.20 allows authenticated remote attackers to inject malicious scripts via the alias parameter in /set_alias.cgi, requiring user interaction for payload execution. Publicly available exploit code exists, but EPSS score of 0.03% and vendor non-responsiveness suggest limited real-world exploitation despite confirmed POC availability.

Stored Cross-Site Scripting (XSS) in the Digiseller WordPress plugin up to version 1.3 allows authenticated contributors and above to inject arbitrary JavaScript via the 'ds' shortcode attributes due to insufficient input sanitization and output escaping. The injected scripts execute in the context of all users viewing the affected page, enabling session hijacking, credential theft, or malware distribution. CVSS 6.4 reflects network accessibility and lower-privileged attacker requirements; no public exploit code or active exploitation has been identified at time of analysis.

Stored Cross-Site Scripting in WP BookWidgets plugin for WordPress allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts via the 'bw_link' shortcode due to insufficient input sanitization and output escaping. When a user visits a page containing the injected shortcode, the malicious script executes in their browser context. This vulnerability affects all versions up to and including 0.9. No public exploit code or active exploitation in the wild has been confirmed at the time of analysis.

DOM-based Cross-Site Scripting in Adobe Connect 12.9 and earlier enables session hijacking when high-privileged administrators interact with attacker-crafted pages. Scope change to 'C' indicates the attacker can pivot beyond the vulnerable component's security boundary, allowing privileged session takeover that impacts both confidentiality and integrity at high levels. No active exploitation confirmed per CISA KEV at time of analysis. Adobe has released security advisory APSB25-70 addressing this vulnerability.

Reflected cross-site scripting (XSS) in FortiOS, FortiProxy, and FortiSASE allows unauthenticated remote attackers to inject and execute malicious scripts in a victim's browser by tricking them into clicking a crafted HTTP request link. The vulnerability spans a wide range of FortiOS versions from 6.4 through 7.6.3 and all FortiProxy 7.x branches, meaning a large installed base of Fortinet network security appliances is affected. A Siemens CERT advisory (SSA-864900) indicates this vulnerability also affects Siemens products that embed Fortinet components, broadening organizational impact. No public exploit or CISA KEV listing has been identified at time of analysis.

Firefox and Thunderbird allow cross-site scripting (XSS) attacks when a malicious page uses the type attribute of an OBJECT tag to override default browser behavior for resources served without a content-type header. An attacker can craft a malicious webpage that exploits this flaw to execute arbitrary JavaScript in the context of a vulnerable site that unsafely omits content-type headers, affecting Firefox versions before 144, Firefox ESR before 140.4, Thunderbird before 144, and Thunderbird ESR before 140.4. No public exploit code or active exploitation has been identified at time of analysis.