Total
34649 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-2806 | 1 Tagdiv | 1 Tagdiv Composer | 2025-06-04 | N/A | 6.1 MEDIUM |
| The tagDiv Composer plugin for WordPress, used by the Newspaper theme, is vulnerable to Reflected Cross-Site Scripting via the ‘data’ parameter in all versions up to, and including, 5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. | |||||
| CVE-2025-4127 | 1 Wpsemplugins | 1 Wp Seo Structured Data Schema | 2025-06-04 | N/A | 5.4 MEDIUM |
| The WP SEO Structured Data Schema plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Price Range’ parameter in all versions up to, and including, 2.7.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts that will execute whenever an administrator accesses the plugin settings page. | |||||
| CVE-2025-3077 | 1 Muffingroup | 1 Betheme | 2025-06-04 | N/A | 5.4 MEDIUM |
| The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button shortcode and Custom CSS field in all versions up to, and including, 28.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2025-3276 | 1 Sktthemes | 1 Skt Blocks | 2025-06-04 | N/A | 5.4 MEDIUM |
| The SKT Blocks – Gutenberg based Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Carousel block in all versions up to, and including, 1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2025-0839 | 1 Digitalzoomstudio | 1 Zoomsounds | 2025-06-04 | N/A | 5.4 MEDIUM |
| The ZoomSounds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 6.91 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2024-22048 | 1 Gov.uk | 1 Govuk Tech Docs | 2025-06-04 | N/A | 6.1 MEDIUM |
| govuk_tech_docs versions from 2.0.2 to before 3.3.1 are vulnerable to a cross-site scripting vulnerability. Malicious JavaScript may be executed in the user's browser if a malicious search result is displayed on the search page. | |||||
| CVE-2024-22725 | 1 Orthanc-server | 1 Orthanc | 2025-06-04 | N/A | 6.1 MEDIUM |
| Orthanc versions before 1.12.2 are affected by a reflected cross-site scripting (XSS) vulnerability. The vulnerability was present in the server's error reporting. | |||||
| CVE-2024-27186 | 1 Joomla | 1 Joomla\! | 2025-06-04 | N/A | N/A |
| The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions. | |||||
| CVE-2024-40743 | 1 Joomla | 1 Joomla\! | 2025-06-04 | N/A | N/A |
| The stripImages and stripIframes methods didn't properly process inputs, leading to XSS vectors. | |||||
| CVE-2024-40745 | 1 Convert Forms Project | 1 Convert Forms | 2025-06-04 | N/A | N/A |
| Reflected Cross site scripting vulnerability in Convert Forms component for Joomla in versions before 4.4.8. | |||||
| CVE-2024-40748 | 1 Joomla | 1 Joomla\! | 2025-06-04 | N/A | N/A |
| Lack of output escaping in the id attribute of menu lists. | |||||
| CVE-2024-40747 | 1 Joomla | 1 Joomla\! | 2025-06-04 | N/A | N/A |
| Various module chromes didn't properly process inputs, leading to XSS vectors. | |||||
| CVE-2024-10144 | 1 Robosoft | 1 Robo Gallery | 2025-06-04 | N/A | N/A |
| The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.22 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||
| CVE-2024-10107 | 1 Seedprod | 1 Rafflepress | 2025-06-04 | N/A | N/A |
| The Giveaways and Contests by RafflePress WordPress plugin before 1.12.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||
| CVE-2024-10054 | 1 Happyforms | 1 Happyforms | 2025-06-04 | N/A | N/A |
| The Happyforms WordPress plugin before 1.26.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||
| CVE-2024-11109 | 1 Ljapps | 1 Wp Google Review Slider | 2025-06-04 | N/A | N/A |
| The WP Google Review Slider WordPress plugin before 15.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||
| CVE-2024-10145 | 1 Devpups | 1 Social Pug | 2025-06-04 | N/A | N/A |
| The Hubbub Lite WordPress plugin before 1.34.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||
| CVE-2024-10504 | 1 Reputeinfosystems | 1 Arforms | 2025-06-04 | N/A | N/A |
| The Contact Form, Survey, Quiz & Popup Form Builder WordPress plugin before 1.7.1 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks. | |||||
| CVE-2024-3996 | 1 Shapedplugin | 1 Smart Post Show | 2025-06-04 | N/A | N/A |
| The Smart Post Show WordPress plugin before 2.4.28 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | |||||
| CVE-2025-4852 | 1 Totolink | 2 A3002r, A3002r Firmware | 2025-06-04 | N/A | 3.4 LOW |
| A vulnerability, which was classified as problematic, has been found in TOTOLINK A3002R 2.1.1-B20230720.1011. This issue affects some unknown processing of the component VPN Page. The manipulation of the argument Comment leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. | |||||