CVE-2025-22792 | ByteOS Network

Vulnerability Details :

CVE-2025-22792

Assigner-Patchstack

Assigner Org ID-21595511-bba5-4825-b968-b78d1f9984a3

Published At-19 May, 2025 | 16:00

Updated At-28 Apr, 2026 | 16:11

WordPress Js O3 Lite theme <= 1.5.8.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jinwen Js O3 Lite allows Reflected XSS.This issue affects Js O3 Lite: from n/a through 1.5.8.2.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:Patchstack

Assigner Org ID:21595511-bba5-4825-b968-b78d1f9984a3

Published At:19 May, 2025 | 16:00

Updated At:28 Apr, 2026 | 16:11

▼CVE Numbering Authority (CNA)

WordPress Js O3 Lite theme <= 1.5.8.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jinwen Js O3 Lite allows Reflected XSS.This issue affects Js O3 Lite: from n/a through 1.5.8.2.

Affected Products

Vendor

Product

Collection URL

https://wordpress.org/themes

Package Name

js-o3-lite

Default Status

unaffected

Versions

Affected

From n/a through 1.5.8.2 (custom)

Problem Types

Type	CWE ID	Description
CWE	CWE-79	CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Type: CWE

CWE ID: CWE-79

Description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Metrics

Version	Base score	Base severity	Vector
3.1	7.1	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Version: 3.1

Base score: 7.1

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Impacts

CAPEC ID	Description
CAPEC-591	CAPEC-591 Reflected XSS

CAPEC ID: CAPEC-591

Description: CAPEC-591 Reflected XSS

Credits

finder

justakazh (Patchstack Alliance)

References

Hyperlink	Resource
https://patchstack.com/database/wordpress/theme/js-o3-lite/vulnerability/wordpress-js-o3-lite-theme-1-5-8-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve	vdb-entry

Hyperlink: https://patchstack.com/database/wordpress/theme/js-o3-lite/vulnerability/wordpress-js-o3-lite-theme-1-5-8-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve

Resource:

vdb-entry

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

Source:audit@patchstack.com

Published At:19 May, 2025 | 16:15

Updated At:23 Apr, 2026 | 15:23

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jinwen Js O3 Lite js-o3-lite allows Reflected XSS.This issue affects Js O3 Lite: from n/a through <= 1.5.8.2.

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	7.1	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Type: Secondary

Version: 3.1

Base score: 7.1

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Weaknesses

CWE ID	Type	Source
CWE-79	Secondary	audit@patchstack.com

CWE ID: CWE-79

Type: Secondary

Source: audit@patchstack.com

References

Hyperlink	Source	Resource
https://patchstack.com/database/Wordpress/Theme/js-o3-lite/vulnerability/wordpress-js-o3-lite-theme-1-5-8-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve	audit@patchstack.com	N/A

Hyperlink: https://patchstack.com/database/Wordpress/Theme/js-o3-lite/vulnerability/wordpress-js-o3-lite-theme-1-5-8-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve

Source: audit@patchstack.com

Resource: N/A

Similar CVEs

2439Records found

Matching Score-4

Assigner-Spanish National Cybersecurity Institute, S.A. (INCIBE)

Matching Score-4

Assigner-Spanish National Cybersecurity Institute, S.A. (INCIBE)

CVSS Score-7.1||HIGH

EPSS-0.09% / 26.06%

||

7 Day CHG~0.00%

Published-06 Aug, 2024 | 13:01

Updated-15 Aug, 2024 | 16:56

Cross-Site Scripting (XSS) vulnerability in Janobe products

Cross-Site Scripting (XSS) vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'Attendance', 'attenddate' and 'YearLevel' parameters in '/AttendanceMonitoring/report/attendance_print.php'.

Vendor-janobe

Product-school_attendence_monitoring_system school_event_management_system School Event Management System School Attendance Monitoring System

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.44% / 63.26%

||

7 Day CHG~0.00%

Published-17 Apr, 2025 | 15:48

Updated-28 Apr, 2026 | 16:11

WordPress File Icons Plugin <= 2.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BjornW File Icons file-icons allows Reflected XSS.This issue affects File Icons: from n/a through <= 2.1.

Vendor-BjornW

Product-File Icons

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-GitHub, Inc.

Matching Score-4

Assigner-GitHub, Inc.

CVSS Score-7.1||HIGH

EPSS-0.59% / 69.44%

||

7 Day CHG~0.00%

Published-06 Jul, 2022 | 18:00

Updated-22 Apr, 2025 | 17:51

Improper handling of email input in next-auth

NextAuth.js is a complete open source authentication solution for Next.js applications. An attacker can pass a compromised input to the e-mail [signin endpoint](https://next-auth.js.org/getting-started/rest-api#post-apiauthsigninprovider) that contains some malicious HTML, tricking the e-mail server to send it to the user, so they can perform a phishing attack. Eg.: `balazs@email.com, <a href="http://attacker.com">Before signing in, claim your money!</a>`. This was previously sent to `balazs@email.com`, and the content of the email containing a link to the attacker's site was rendered in the HTML. This has been remedied in the following releases, by simply not rendering that e-mail in the HTML, since it should be obvious to the receiver what e-mail they used: next-auth v3 users before version 3.29.8 are impacted. (We recommend upgrading to v4, as v3 is considered unmaintained. next-auth v4 users before version 4.9.0 are impacted. If for some reason you cannot upgrade, the workaround requires you to sanitize the `email` parameter that is passed to `sendVerificationRequest` and rendered in the HTML. If you haven't created a custom `sendVerificationRequest`, you only need to upgrade. Otherwise, make sure to either exclude `email` from the HTML body or efficiently sanitize it.

Vendor-nextauth.js nextauthjs

Product-next-auth next-auth

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-4.70% / 89.49%

||

7 Day CHG~0.00%

Published-12 Jun, 2023 | 14:19

Updated-28 Apr, 2026 | 16:08

WordPress Zotpress Plugin <= 7.3.3 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Katie Seaborn Zotpress plugin <= 7.3.3 versions.

Vendor-zotpress_project Katie Seaborn

Product-zotpress Zotpress

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.11% / 29.14%

||

7 Day CHG~0.00%

Published-26 Mar, 2025 | 14:24

Updated-28 Apr, 2026 | 16:11

WordPress MicroPayments Paid Membership plugin <= 3.2.4 - Reflected Cross-Site Scripting vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in videowhisper MicroPayments paid-membership allows Reflected XSS.This issue affects MicroPayments: from n/a through <= 3.2.4.

Vendor-videowhisper

Product-MicroPayments

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.35% / 57.27%

||

7 Day CHG~0.00%

Published-03 Mar, 2025 | 13:30

Updated-11 May, 2026 | 23:50

WordPress Authors Autocomplete Meta Box plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rachel Cherry Authors Autocomplete Meta Box authors-autocomplete-meta-box allows Reflected XSS.This issue affects Authors Autocomplete Meta Box: from n/a through <= 1.2.

Vendor-Rachel Cherry

Product-Authors Autocomplete Meta Box

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-GitHub, Inc.

Matching Score-4

Assigner-GitHub, Inc.

CVSS Score-7.1||HIGH

EPSS-0.44% / 63.47%

||

7 Day CHG~0.00%

Published-01 Aug, 2022 | 20:30

Updated-23 Apr, 2025 | 17:55

Cross Site Scripting possible in DSpace JSPUI spellcheck and autocomplete tools

DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI spellcheck "Did you mean" HTML escapes the data-spell attribute in the link, but not the actual displayed text. Similarly, the JSPUI autocomplete HTML does not properly escape text passed to it. Both are vulnerable to XSS. This vulnerability only impacts the JSPUI. Users are advised to upgrade. There are no known workarounds for this issue.

Vendor-duraspace DSpace

Product-dspace DSpace

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.35% / 57.27%

||

7 Day CHG~0.00%

Published-03 Mar, 2025 | 13:30

Updated-28 Apr, 2026 | 16:11

WordPress Meta Accelerator plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yuichiro ABE Meta Accelerator meta-accelerator allows Reflected XSS.This issue affects Meta Accelerator: from n/a through <= 1.0.4.

Vendor-Yuichiro ABE

Product-Meta Accelerator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.09% / 24.99%

||

7 Day CHG~0.00%

Published-15 Mar, 2025 | 21:57

Updated-28 Apr, 2026 | 16:11

WordPress Random Image Selector plugin <= 1.5.6 - Reflected Cross-Site Scripting vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kdmurray Random Image Selector random-image-selector allows Reflected XSS.This issue affects Random Image Selector: from n/a through <= 2.4.

Vendor-kdmurray

Product-Random Image Selector

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.35% / 57.27%

||

7 Day CHG~0.00%

Published-03 Mar, 2025 | 13:30

Updated-28 Apr, 2026 | 16:11

WordPress WP Find Your Nearest Plugin <= 0.3.1 - CSRF to Settings Change vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SocialEvolution WP Find Your Nearest wp-find-your-nearest allows Reflected XSS.This issue affects WP Find Your Nearest: from n/a through <= 0.3.1.

Vendor-SocialEvolution

Product-WP Find Your Nearest

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.35% / 57.27%

||

7 Day CHG~0.00%

Published-03 Mar, 2025 | 13:30

Updated-28 Apr, 2026 | 16:11

WordPress Yahoo BOSS Plugin <= 0.7 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Josh Harrison Yahoo BOSS yahoo-boss allows Reflected XSS.This issue affects Yahoo BOSS: from n/a through <= 0.7.

Vendor-Josh Harrison

Product-Yahoo BOSS

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.13% / 32.01%

||

7 Day CHG~0.00%

Published-13 Feb, 2025 | 13:52

Updated-28 Apr, 2026 | 16:11

WordPress Naver Syndication V2 plugin <= 0.8.3 - CSRF to Stored Cross-Site Scripting vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in badrHan Naver Syndication V2 badr-naver-syndication allows Stored XSS.This issue affects Naver Syndication V2: from n/a through <= 0.8.3.

Vendor-badrHan

Product-Naver Syndication V2

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.27% / 50.43%

||

7 Day CHG~0.00%

Published-31 Mar, 2025 | 12:55

Updated-28 Apr, 2026 | 16:12

WordPress Useinfluence plugin <= 1.0.8 - Cross Site Request Forgery (CSRF) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ramanparashar Useinfluence useinfluence allows Stored XSS.This issue affects Useinfluence: from n/a through <= 1.0.8.

Vendor-ramanparashar

Product-Useinfluence

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.23% / 45.91%

||

7 Day CHG~0.00%

Published-03 Mar, 2025 | 13:30

Updated-28 Apr, 2026 | 16:11

WordPress sidebarTabs Plugin <= 3.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nghorta sidebarTabs sidebartabs allows Reflected XSS.This issue affects sidebarTabs: from n/a through <= 3.1.

Vendor-nghorta

Product-sidebarTabs

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.23% / 45.91%

||

7 Day CHG~0.00%

Published-03 Mar, 2025 | 13:30

Updated-28 Apr, 2026 | 16:11

WordPress WP Frontend Submit Plugin <= 1.1.0 - Reflected Cross-Site Scripting vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in newbiesup WP Frontend Submit wp-frontend-submit allows Reflected XSS.This issue affects WP Frontend Submit: from n/a through <= 1.1.0.

Vendor-newbiesup

Product-WP Frontend Submit

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.23% / 45.91%

||

7 Day CHG~0.00%

Published-26 Mar, 2025 | 14:24

Updated-28 Apr, 2026 | 16:11

WordPress Bitcoin / AltCoin Payment Gateway for WooCommerce plugin <= 1.7.6 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeSolz Bitcoin / AltCoin Payment Gateway for WooCommerce woo-altcoin-payment-gateway allows Reflected XSS.This issue affects Bitcoin / AltCoin Payment Gateway for WooCommerce: from n/a through <= 1.7.6.

Vendor-CodeSolz

Product-Bitcoin / AltCoin Payment Gateway for WooCommerce

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.23% / 45.18%

||

7 Day CHG~0.00%

Published-26 Mar, 2025 | 14:24

Updated-28 Apr, 2026 | 16:11

WordPress Cookies Pro plugin <= 1.0 - CSRF to Stored XSS vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelpro Cookies Pro cookies-pro allows Reflected XSS.This issue affects Cookies Pro: from n/a through <= 1.0.

Vendor-Pixelpro

Product-Cookies Pro

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.09% / 24.99%

||

7 Day CHG~0.00%

Published-15 Mar, 2025 | 21:57

Updated-28 Apr, 2026 | 16:11

WordPress WP Discord Post Plugin <= 2.1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nicola Mustone WP Discord Post wp-discord-post allows Reflected XSS.This issue affects WP Discord Post: from n/a through <= 2.1.0.

Vendor-Nicola Mustone

Product-WP Discord Post

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Siemens

Matching Score-4

Assigner-Siemens

CVSS Score-7.1||HIGH

EPSS-0.67% / 71.62%

||

7 Day CHG-0.44%

Published-10 May, 2022 | 09:47

Updated-09 Dec, 2025 | 16:17

A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not handle uploaded files correctly. An unauthenticated attacker could take advantage of this situation to store an XSS attack, which could - when a legitimate user accesses the error logs - perform arbitrary actions in the name of the user.

Vendor-Siemens AG

Product-7kg8551-0aa12-0aa0_firmware 7kg8550-0aa10-2aa0 7kg8501-0aa31-2aa0 7kg8500-0aa30-2aa0 7kg8551-0aa32-2aa0 7kg8551-0aa01-0aa0_firmware 7kg8551-0aa12-2aa0_firmware 7kg8550-0aa30-2aa0 7kg8501-0aa32-0aa0 7kg8551-0aa02-0aa0 7kg8501-0aa31-0aa0 7kg8501-0aa12-0aa0_firmware 7kg8500-0aa30-0aa0_firmware 7kg8501-0aa01-2aa0_firmware 7kg8551-0aa12-0aa0 7kg8501-0aa02-0aa0_firmware 7kg8551-0aa31-2aa0_firmware 7kg8551-0aa32-0aa0 7kg8551-0aa02-2aa0_firmware 7kg8501-0aa11-0aa0 7kg8551-0aa01-2aa0 7kg8500-0aa00-2aa0 7kg8551-0aa31-0aa0_firmware 7kg8501-0aa01-0aa0_firmware 7kg8551-0aa11-2aa0_firmware 7kg8500-0aa30-0aa0 7kg8501-0aa11-0aa0_firmware 7kg8500-0aa10-0aa0 7kg8550-0aa00-0aa0 7kg8500-0aa00-2aa0_firmware 7kg8501-0aa32-2aa0 7kg8500-0aa00-0aa0_firmware 7kg8501-0aa31-2aa0_firmware 7kg8550-0aa30-2aa0_firmware 7kg8551-0aa02-0aa0_firmware 7kg8550-0aa00-2aa0_firmware 7kg8501-0aa12-2aa0 7kg8551-0aa11-0aa0 7kg8501-0aa12-2aa0_firmware 7kg8550-0aa30-0aa0 7kg8501-0aa11-2aa0_firmware 7kg8501-0aa02-0aa0 7kg8551-0aa31-2aa0 7kg8551-0aa31-0aa0 7kg8500-0aa10-0aa0_firmware 7kg8551-0aa12-2aa0 7kg8551-0aa11-2aa0 7kg8501-0aa11-2aa0 7kg8501-0aa32-2aa0_firmware 7kg8500-0aa00-0aa0 7kg8551-0aa01-2aa0_firmware 7kg8551-0aa32-2aa0_firmware 7kg8550-0aa00-2aa0 7kg8550-0aa30-0aa0_firmware 7kg8500-0aa30-2aa0_firmware 7kg8551-0aa01-0aa0 7kg8550-0aa10-0aa0 7kg8500-0aa10-2aa0 7kg8501-0aa12-0aa0 7kg8550-0aa00-0aa0_firmware 7kg8500-0aa10-2aa0_firmware 7kg8501-0aa02-2aa0 7kg8551-0aa11-0aa0_firmware 7kg8550-0aa10-0aa0_firmware 7kg8551-0aa02-2aa0 7kg8551-0aa32-0aa0_firmware 7kg8501-0aa01-2aa0 7kg8501-0aa02-2aa0_firmware 7kg8501-0aa32-0aa0_firmware 7kg8501-0aa31-0aa0_firmware 7kg8501-0aa01-0aa0 7kg8550-0aa10-2aa0_firmware SICAM T

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.35% / 57.27%

||

7 Day CHG~0.00%

Published-03 Mar, 2025 | 13:30

Updated-28 Apr, 2026 | 16:11

WordPress Migrate Posts Plugin <=1.0 - Post Based Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DotsquaresLtd Migrate Posts migrate-post allows Reflected XSS.This issue affects Migrate Posts: from n/a through <= 1.0.

Vendor-DotsquaresLtd

Product-Migrate Posts

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.35% / 57.27%

||

7 Day CHG~0.00%

Published-03 Mar, 2025 | 13:30

Updated-28 Apr, 2026 | 16:11

WordPress User Role plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ehabstar User Role user-roles allows Reflected XSS.This issue affects User Role: from n/a through <= 1.0.

Vendor-ehabstar

Product-User Role

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.11% / 29.14%

||

7 Day CHG~0.00%

Published-26 Mar, 2025 | 14:24

Updated-28 Apr, 2026 | 16:11

WordPress GNUCommerce Plugin <= 1.5.4 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kagla GNUCommerce gnucommerce allows Reflected XSS.This issue affects GNUCommerce: from n/a through <= 1.5.4.

Vendor-kagla

Product-GNUCommerce

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.19% / 40.39%

||

7 Day CHG~0.00%

Published-26 Mar, 2025 | 14:24

Updated-28 Apr, 2026 | 16:11

WordPress WP Contact Form III Plugin <= 1.6.2d - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KKWangen WP Contact Form III wp-contact-form-iii allows Reflected XSS.This issue affects WP Contact Form III: from n/a through <= 1.6.2d.

Vendor-KKWangen

Product-WP Contact Form III

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.35% / 57.27%

||

7 Day CHG~0.00%

Published-03 Mar, 2025 | 13:30

Updated-28 Apr, 2026 | 16:11

WordPress SW Plus Plugin <= 2.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shalomworld SW Plus shalom-world-media-gallery allows Reflected XSS.This issue affects SW Plus: from n/a through <= 2.1.

Vendor-shalomworld

Product-SW Plus

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.11% / 29.74%

||

7 Day CHG~0.00%

Published-26 Mar, 2025 | 14:24

Updated-28 Apr, 2026 | 16:11

WordPress In Stock Mailer for WooCommerce Plugin <= 2.1.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Frank In Stock Mailer for WooCommerce in-stock-mailer-for-woocommerce allows Reflected XSS.This issue affects In Stock Mailer for WooCommerce: from n/a through <= 2.1.1.

Vendor-Frank

Product-In Stock Mailer for WooCommerce

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.23% / 45.91%

||

7 Day CHG~0.00%

Published-03 Mar, 2025 | 13:30

Updated-28 Apr, 2026 | 16:11

WordPress Uncomplicated SEO plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Antonio Sanchez Uncomplicated SEO uncomplicated-seo allows Reflected XSS.This issue affects Uncomplicated SEO: from n/a through <= 1.2.

Vendor-Antonio Sanchez

Product-Uncomplicated SEO

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.21% / 42.75%

||

7 Day CHG~0.00%

Published-03 Mar, 2025 | 13:30

Updated-28 Apr, 2026 | 16:11

WordPress TTT Crop Plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gabrielperezs TTT Crop ttt-crop allows Reflected XSS.This issue affects TTT Crop: from n/a through <= 1.0.

Vendor-gabrielperezs

Product-TTT Crop

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.09% / 24.99%

||

7 Day CHG~0.00%

Published-15 Mar, 2025 | 21:57

Updated-28 Apr, 2026 | 16:11

WordPress WP AntiDDOS Plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zzmaster WP AntiDDOS wpantiddos allows Reflected XSS.This issue affects WP AntiDDOS: from n/a through <= 2.0.

Vendor-zzmaster

Product-WP AntiDDOS

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.09% / 24.99%

||

7 Day CHG~0.00%

Published-15 Mar, 2025 | 21:57

Updated-28 Apr, 2026 | 16:11

WordPress Debug-Bar-Extender Plugin <= 0.5 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Thorsten Ott Debug-Bar-Extender debug-bar-extender allows Reflected XSS.This issue affects Debug-Bar-Extender: from n/a through <= 0.5.

Vendor-Thorsten Ott

Product-Debug-Bar-Extender

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Siemens

Matching Score-4

Assigner-Siemens

CVSS Score-7.1||HIGH

EPSS-0.65% / 71.17%

||

7 Day CHG-0.43%

Published-10 May, 2022 | 09:47

Updated-09 Dec, 2025 | 16:17

A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not properly handle the input of a GET request parameter. The provided argument is directly reflected in the web server response. This could allow an unauthenticated attacker to perform reflected XSS attacks.

Vendor-Siemens AG

Product-7kg8551-0aa12-0aa0_firmware 7kg8550-0aa10-2aa0 7kg8501-0aa31-2aa0 7kg8500-0aa30-2aa0 7kg8551-0aa32-2aa0 7kg8551-0aa01-0aa0_firmware 7kg8551-0aa12-2aa0_firmware 7kg8550-0aa30-2aa0 7kg8501-0aa32-0aa0 7kg8551-0aa02-0aa0 7kg8501-0aa31-0aa0 7kg8501-0aa12-0aa0_firmware 7kg8500-0aa30-0aa0_firmware 7kg8501-0aa01-2aa0_firmware 7kg8551-0aa12-0aa0 7kg8501-0aa02-0aa0_firmware 7kg8551-0aa31-2aa0_firmware 7kg8551-0aa32-0aa0 7kg8551-0aa02-2aa0_firmware 7kg8501-0aa11-0aa0 7kg8551-0aa01-2aa0 7kg8500-0aa00-2aa0 7kg8551-0aa31-0aa0_firmware 7kg8501-0aa01-0aa0_firmware 7kg8551-0aa11-2aa0_firmware 7kg8500-0aa30-0aa0 7kg8501-0aa11-0aa0_firmware 7kg8500-0aa10-0aa0 7kg8550-0aa00-0aa0 7kg8500-0aa00-2aa0_firmware 7kg8501-0aa32-2aa0 7kg8500-0aa00-0aa0_firmware 7kg8501-0aa31-2aa0_firmware 7kg8550-0aa30-2aa0_firmware 7kg8551-0aa02-0aa0_firmware 7kg8550-0aa00-2aa0_firmware 7kg8501-0aa12-2aa0 7kg8551-0aa11-0aa0 7kg8501-0aa12-2aa0_firmware 7kg8550-0aa30-0aa0 7kg8501-0aa11-2aa0_firmware 7kg8501-0aa02-0aa0 7kg8551-0aa31-2aa0 7kg8551-0aa31-0aa0 7kg8500-0aa10-0aa0_firmware 7kg8551-0aa12-2aa0 7kg8551-0aa11-2aa0 7kg8501-0aa11-2aa0 7kg8501-0aa32-2aa0_firmware 7kg8500-0aa00-0aa0 7kg8551-0aa01-2aa0_firmware 7kg8551-0aa32-2aa0_firmware 7kg8550-0aa00-2aa0 7kg8550-0aa30-0aa0_firmware 7kg8500-0aa30-2aa0_firmware 7kg8551-0aa01-0aa0 7kg8550-0aa10-0aa0 7kg8500-0aa10-2aa0 7kg8501-0aa12-0aa0 7kg8550-0aa00-0aa0_firmware 7kg8500-0aa10-2aa0_firmware 7kg8501-0aa02-2aa0 7kg8551-0aa11-0aa0_firmware 7kg8550-0aa10-0aa0_firmware 7kg8551-0aa02-2aa0 7kg8551-0aa32-0aa0_firmware 7kg8501-0aa01-2aa0 7kg8501-0aa02-2aa0_firmware 7kg8501-0aa32-0aa0_firmware 7kg8501-0aa31-0aa0_firmware 7kg8501-0aa01-0aa0 7kg8550-0aa10-2aa0_firmware SICAM T

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.23% / 45.91%

||

7 Day CHG~0.00%

Published-03 Mar, 2025 | 13:30

Updated-28 Apr, 2026 | 16:11

WordPress WP Church Center Plugin <= 1.3.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpchurchteam WP Church Center wp-church-center allows Reflected XSS.This issue affects WP Church Center: from n/a through <= 1.3.3.

Vendor-wpchurchteam

Product-WP Church Center

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.23% / 45.91%

||

7 Day CHG~0.00%

Published-03 Mar, 2025 | 13:30

Updated-28 Apr, 2026 | 16:11

WordPress DL Leadback Plugin <= 1.2.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DyadyaLesha DL Leadback dl-leadback allows Reflected XSS.This issue affects DL Leadback: from n/a through <= 1.2.1.

Vendor-DyadyaLesha

Product-DL Leadback

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.23% / 45.91%

||

7 Day CHG~0.00%

Published-03 Mar, 2025 | 13:30

Updated-28 Apr, 2026 | 16:11

WordPress Image Rotator plugin <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in appten Image Rotator appten-image-rotator allows Reflected XSS.This issue affects Image Rotator: from n/a through <= 2.0.

Vendor-appten

Product-Image Rotator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.09% / 25.68%

||

7 Day CHG~0.00%

Published-29 Mar, 2024 | 17:14

Updated-28 Apr, 2026 | 16:09

WordPress Combo Blocks plugin <= 2.2.74 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Post Grid allows Reflected XSS.This issue affects Post Grid: from n/a through 2.2.74.

Vendor-PickPlugins

Product-Post Grid

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.18% / 38.86%

||

7 Day CHG~0.00%

Published-31 Jan, 2025 | 08:24

Updated-11 May, 2026 | 23:24

WordPress GD Mail Queue Plugin <= 4.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Milan Petrovic GD Mail Queue gd-mail-queue allows Reflected XSS.This issue affects GD Mail Queue: from n/a through <= 4.3.

Vendor-Milan Petrovic

Product-GD Mail Queue

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.18% / 39.64%

||

7 Day CHG~0.00%

Published-27 Jan, 2025 | 14:22

Updated-11 May, 2026 | 23:21

WordPress Edwiser Bridge plugin <= 3.0.8 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WisdmLabs Edwiser Bridge edwiser-bridge allows Reflected XSS.This issue affects Edwiser Bridge: from n/a through <= 3.0.8.

Vendor-wisdmlabs WisdmLabs

Product-edwiser_bridge Edwiser Bridge

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.18% / 38.86%

||

7 Day CHG~0.00%

Published-14 Feb, 2025 | 12:44

Updated-11 May, 2026 | 23:32

WordPress Contact Form With Shortcode plugin <= 4.2.5 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aviplugins.com Contact Form With Shortcode contact-form-with-shortcode allows Reflected XSS.This issue affects Contact Form With Shortcode: from n/a through <= 4.2.5.

Vendor-aviplugins.com

Product-Contact Form With Shortcode

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.18% / 38.86%

||

7 Day CHG~0.00%

Published-14 Feb, 2025 | 12:44

Updated-11 May, 2026 | 23:32

WordPress Intro Tour Tutorial DeepPresentation plugin <= 6.5.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomáš Groulík Intro Tour Tutorial DeepPresentation dp-intro-tours allows Reflected XSS.This issue affects Intro Tour Tutorial DeepPresentation: from n/a through <= 6.5.2.

Vendor-Tomáš Groulík

Product-Intro Tour Tutorial DeepPresentation

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-14.40% / 94.51%

||

7 Day CHG~0.00%

Published-27 Mar, 2024 | 12:51

Updated-11 May, 2026 | 20:57

WordPress Unlimited Elements for Elementor plugin <= 1.5.93 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through <= 1.5.93.

Vendor-unlimited-elements Unlimited Elements

Product-unlimited_elements_for_elementor Unlimited Elements For Elementor (Free Widgets, Addons, Templates)

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.17% / 38.00%

||

7 Day CHG-0.01%

Published-15 Apr, 2025 | 11:59

Updated-28 Apr, 2026 | 16:12

WordPress FS Poster plugin <= 6.5.8 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fs-code FS Poster fs-poster allows Reflected XSS.This issue affects FS Poster: from n/a through <= 6.5.8.

Vendor-fs-code

Product-FS Poster

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.11% / 29.14%

||

7 Day CHG~0.00%

Published-24 Jan, 2025 | 17:24

Updated-12 May, 2026 | 23:47

WordPress Atarim plugin <= 4.0.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Stored XSS.This issue affects Atarim: from n/a through <= 4.0.8.

Vendor-Vito Peleg

Product-Atarim

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.15% / 35.12%

||

7 Day CHG~0.00%

Published-31 Jan, 2025 | 08:24

Updated-28 Apr, 2026 | 16:11

WordPress Advanced Dynamic Pricing for WooCommerce Plugin <= 4.9.0 -Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in algol.plus Advanced Dynamic Pricing for WooCommerce advanced-dynamic-pricing-for-woocommerce allows Reflected XSS.This issue affects Advanced Dynamic Pricing for WooCommerce: from n/a through <= 4.9.0.

Vendor-algol.plus AlgolPlus

Product-Advanced Dynamic Pricing for WooCommerce

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.18% / 38.86%

||

7 Day CHG~0.00%

Published-31 Jan, 2025 | 08:24

Updated-11 May, 2026 | 23:25

WordPress Cleanup – Directory Listing & Classifieds plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeglow Cleanup – Directory Listing & Classifieds WordPress Plugin cleanup-light allows Reflected XSS.This issue affects Cleanup – Directory Listing & Classifieds WordPress Plugin: from n/a through <= 1.0.4.

Vendor-themeglow

Product-Cleanup – Directory Listing & Classifieds WordPress Plugin

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.1||HIGH

EPSS-0.18% / 38.86%

||

7 Day CHG~0.00%

Published-29 Jul, 2024 | 00:00

Updated-14 Oct, 2025 | 18:04

An issue was discovered in Italtel i-MCS NFV 12.1.0-20211215. Stored Cross-site scripting (XSS) can occur via POST.

Vendor-italtel n/a italtel

Product-i-mcs_nfv n/a i-mcs_nfv

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.07% / 21.67%

||

7 Day CHG~0.00%

Published-19 Mar, 2024 | 14:18

Updated-28 Apr, 2026 | 16:09

WordPress Specific Content For Mobile plugin <= 0.1.9.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jose Mortellaro Specific Content For Mobile – Customize the mobile version without redirections allows Reflected XSS.This issue affects Specific Content For Mobile – Customize the mobile version without redirections: from n/a through 0.1.9.5.

Vendor-Jose Mortellaro

Product-Specific Content For Mobile – Customize the mobile version without redirections

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.18% / 38.86%

||

7 Day CHG~0.00%

Published-14 Feb, 2025 | 12:44

Updated-11 May, 2026 | 23:32

WordPress Uix Page Builder Plugin <= 1.7.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UIUX Lab Uix Page Builder uix-page-builder allows Reflected XSS.This issue affects Uix Page Builder: from n/a through <= 1.7.3.

Vendor-UIUX Lab

Product-Uix Page Builder

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.04% / 12.41%

||

7 Day CHG~0.00%

Published-03 Feb, 2025 | 14:22

Updated-28 Apr, 2026 | 16:11

WordPress BSK Forms Validation plugin <= 1.7 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bannersky BSK Forms Validation bsk-gravity-forms-custom-validation allows Reflected XSS.This issue affects BSK Forms Validation: from n/a through <= 1.7.

Vendor-BannerSky

Product-BSK Forms Validation

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.12% / 30.46%

||

7 Day CHG~0.00%

Published-19 Mar, 2024 | 13:16

Updated-28 Apr, 2026 | 16:09

WordPress Better Search plugin <= 3.3.0 - Stored Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebberZone Better Search – Relevant search results for WordPress allows Stored XSS.This issue affects Better Search – Relevant search results for WordPress: from n/a through 3.3.0.

Vendor-webberzone WebberZone

Product-better_search Better Search – Relevant search results for WordPress

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.24% / 47.38%

||

7 Day CHG~0.00%

Published-14 Feb, 2025 | 12:44

Updated-11 May, 2026 | 23:34

WordPress AcyMailing Plugin < 9.11.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing allows Reflected XSS.This issue affects AcyMailing SMTP Newsletter: from n/a through < 9.11.1.

Vendor-AcyMailing (Altavia Jetpulp SAS, formerly ACYBA)

Product-AcyMailing SMTP Newsletter

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.07% / 21.67%

||

7 Day CHG~0.00%

Published-19 Mar, 2024 | 14:54

Updated-28 Apr, 2026 | 16:09

WordPress WooThumbs for WooCommerce by Iconic plugin <= 5.5.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IconicWP WooThumbs for WooCommerce by Iconic allows Reflected XSS.This issue affects WooThumbs for WooCommerce by Iconic: from n/a through 5.5.3.

Vendor-Iconic

Product-WooThumbs for WooCommerce by Iconic

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')