CVE Vulnerability Catalog

The Library Bookshelves plugin (up to version 5.11) has a Stored Cross-site Scripting vulnerability due to improper input neutralization during web page generation.

The Zoho Billing plugin (up to version 4.1) has a DOM-Based XSS vulnerability due to improper input neutralization during web page generation.

The Photo Gallery by Ays plugin (versions up to 6.3.8) contains a DOM-Based Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation.

The Emergency Password Reset plugin (emergency-password-reset) is vulnerable to Cross-Site Request Forgery. This issue affects versions from n/a through <= 9.3.

The WPeMatico RSS Feed Fetcher plugin by etruel is vulnerable to exposure of sensitive system information to an unauthorized control sphere. This issue affects WPeMatico RSS Feed Fetcher versions from n/a through 2.8.10 and allows retrieval of embedded sensitive data.

The Bot Block – Stop Spam Referrals in Google Analytics plugin has a Stored XSS vulnerability due to improper input neutralization during web page generation. This affects versions up to and including 2.6.

The Piotnet Forms WordPress plugin has a Cross-Site Request Forgery (CSRF) vulnerability that allows CSRF attacks. This affects all versions up to and including 1.0.30.

The Double the Donation plugin has a Stored XSS vulnerability due to improper input neutralization during web page generation. This affects versions up to and including 2.0.0.

The AnyClip Luminous Studio plugin (anyclip-media) contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through <= 1.3.3.

The Heureka plugin by Heureka Group contains a missing authorization vulnerability, allowing access to functionality not properly constrained by ACLs. This affects Heureka versions up to and including 1.1.0.

The Epeken All Kurir WordPress plugin is vulnerable to Stored XSS (Cross-Site Scripting) due to improper input neutralization during web page generation. The issue affects versions up to and including 2.0.6.

The WP Compress plugin (wp-compress-image-optimizer) for WordPress has a missing authorization vulnerability, allowing access to functionality not properly constrained by ACLs. This affects versions up to 6.50.54.

A Cross-Site Scripting (XSS) vulnerability was discovered in the ARD meal reservation service. The vulnerability exists in the transactionID GET parameter on the transaction confirmation page. Due to improper input validation and output encoding, an attacker can inject malicious JavaScript code that executes in the user's browser.

The AffiliateWP – External Referral Links WordPress plugin is vulnerable to Stored XSS due to improper input neutralization. The issue affects versions up to and including 1.2.0.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in davaxi Goracash goracash allows Stored XSS. This issue affects Goracash: from n/a through <= 1.1.

A Cross Site Scripting vulnerability was found in PivotX CMS version 3.0.0 RC 3. This flaw allows a remote attacker to execute arbitrary JavaScript code via the subtitle field.

SQL Injection vulnerability in ARD GEC en Lign software before version 2025-04-23 allows a remote attacker to escalate privileges via GET parameters in index.php.

Stored cross-site scripting (XSS) vulnerability in the notifications widget in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92. A remote attacker can inject arbitrary web script or HTML via a crafted payload injected into a publication's "Name" text field.

Profession Fit 5.0.99 Build 44910 allows authorization bypass via direct requests to /api/challenges/{id} and URLs for eversports, user-management, and plane pages.

Podatność CVE-2025-9035 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w platformie Virtual Library firmy Horato Internet Technologies Ind. And Trade Inc., co pozwala na ataki typu Reflected XSS.