Total
38280 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-45387 | 1 Osticket | 1 Osticket | 2025-06-05 | N/A | 5.4 MEDIUM |
| osTicket prior to v1.17.6 and v1.18.2 are vulnerable to Broken Access Control Vulnerability in /scp/ajax.php. | |||||
| CVE-2025-3584 | 1 Thenewsletterplugin | 1 Newsletter | 2025-06-05 | N/A | 4.8 MEDIUM |
| The Newsletter WordPress plugin before 8.8.2 does not sanitise and escape some of its Subscription settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||
| CVE-2025-3662 | 1 Colorlib | 1 Fancybox | 2025-06-05 | N/A | 6.1 MEDIUM |
| The FancyBox for WordPress plugin before 3.3.6 does not escape captions and titles attributes before using them to populate galleries' caption fields. The issue was received as a Contributor+ Stored XSS, however one of our researcher (Marc Montpas) escalated it to an Unauthenticated Stored XSS | |||||
| CVE-2024-39031 | 1 Silverpeas | 1 Silverpeas | 2025-06-05 | N/A | 5.4 MEDIUM |
| In Silverpeas Core <= 6.3.5, in Mes Agendas, a user can create new events and add them to their calendar. Additionally, users can invite others from the same domain, including administrators, to these events. A standard user can inject an XSS payload into the "Titre" and "Description" fields when creating an event and then add the administrator or any user to the event. When the invited user (victim) views their own profile, the payload will be executed on their side, even if they do not click on the event. | |||||
| CVE-2024-11831 | 2025-06-04 | N/A | 5.4 MEDIUM | ||
| A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package. | |||||
| CVE-2025-2892 | 1 Aioseo | 1 All In One Seo | 2025-06-04 | N/A | 6.4 MEDIUM |
| The All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post Meta Description and Canonical URL parameters in all versions up to, and including, 4.8.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2025-3862 | 1 Contest-gallery | 1 Contest Gallery | 2025-06-04 | N/A | 6.4 MEDIUM |
| Contest Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 26.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2025-3468 | 1 Basixonline | 1 Nex-forms | 2025-06-04 | N/A | 6.4 MEDIUM |
| The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the clean_html and form_fields parameters in all versions up to, and including, 8.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2025-2806 | 1 Tagdiv | 1 Tagdiv Composer | 2025-06-04 | N/A | 6.1 MEDIUM |
| The tagDiv Composer plugin for WordPress, used by the Newspaper theme, is vulnerable to Reflected Cross-Site Scripting via the ‘data’ parameter in all versions up to, and including, 5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. | |||||
| CVE-2025-4127 | 1 Wpsemplugins | 1 Wp Seo Structured Data Schema | 2025-06-04 | N/A | 6.4 MEDIUM |
| The WP SEO Structured Data Schema plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Price Range’ parameter in all versions up to, and including, 2.7.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts that will execute whenever an administrator accesses the plugin settings page. | |||||
| CVE-2025-3077 | 1 Muffingroup | 1 Betheme | 2025-06-04 | N/A | 6.4 MEDIUM |
| The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button shortcode and Custom CSS field in all versions up to, and including, 28.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2025-3276 | 1 Sktthemes | 1 Skt Blocks | 2025-06-04 | N/A | 6.4 MEDIUM |
| The SKT Blocks – Gutenberg based Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Carousel block in all versions up to, and including, 1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2025-0839 | 1 Digitalzoomstudio | 1 Zoomsounds | 2025-06-04 | N/A | 6.4 MEDIUM |
| The ZoomSounds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 6.91 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2024-22725 | 1 Orthanc-server | 1 Orthanc | 2025-06-04 | N/A | 6.1 MEDIUM |
| Orthanc versions before 1.12.2 are affected by a reflected cross-site scripting (XSS) vulnerability. The vulnerability was present in the server's error reporting. | |||||
| CVE-2024-22048 | 1 Gov.uk | 1 Govuk Tech Docs | 2025-06-04 | N/A | 6.1 MEDIUM |
| govuk_tech_docs versions from 2.0.2 to before 3.3.1 are vulnerable to a cross-site scripting vulnerability. Malicious JavaScript may be executed in the user's browser if a malicious search result is displayed on the search page. | |||||
| CVE-2024-27186 | 1 Joomla | 1 Joomla\! | 2025-06-04 | N/A | 6.1 MEDIUM |
| The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions. | |||||
| CVE-2024-40743 | 1 Joomla | 1 Joomla\! | 2025-06-04 | N/A | 6.1 MEDIUM |
| The stripImages and stripIframes methods didn't properly process inputs, leading to XSS vectors. | |||||
| CVE-2024-40745 | 1 Convert Forms Project | 1 Convert Forms | 2025-06-04 | N/A | 5.4 MEDIUM |
| Reflected Cross site scripting vulnerability in Convert Forms component for Joomla in versions before 4.4.8. | |||||
| CVE-2024-40747 | 1 Joomla | 1 Joomla\! | 2025-06-04 | N/A | 6.1 MEDIUM |
| Various module chromes didn't properly process inputs, leading to XSS vectors. | |||||
| CVE-2024-40748 | 1 Joomla | 1 Joomla\! | 2025-06-04 | N/A | 7.5 HIGH |
| Lack of output escaping in the id attribute of menu lists. | |||||