deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-3487
Published: 2025-04-17
Description: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘limit’ parameter in all versions up to, and including, 1.42.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/forminator/tags/1.41.2/assets/js/front/front.loader.js#L320; https://plugins.trac.wordpress.org/browser/forminator/tags/1.41.2/assets/js/front/front.multi.js#L1006; https://plugins.trac.wordpress.org/changeset/3274844/
CVE: CVE-2025-3760
Published: 2025-04-17
Description: A stored cross-site scripting (XSS) vulnerability exists with radio button type custom fields in Liferay Portal 7.2.0 through 7.4.3.129, and Liferay DXP 2024.Q4.1 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.9, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, 7.3 GA through update 36, and 7.2 GA through fix pack 20 allows remote authenticated attackers to inject malicious JavaScript into a page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-3760
CVE: CVE-2025-29015
Published: 2025-04-17
Description: Code Astro Internet Banking System 2.0.0 is vulnerable to Cross Site Scripting (XSS) via the name parameter in /admin/pages_account.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/b1tm4r/CVE-2025-29015; https://www.cvedetails.com/vulnerability-list/opxss-1/cross-site-scripting.html
CVE: CVE-2022-26323
Published: 2025-04-17
Description: Incorrect Use of Privileged APIs vulnerability in OpenText™ Operations Bridge Manager, OpenText™ Operations Bridge Suite (Containerized), OpenText™ UCMDB ( Classic and Containerized) allows Privilege Escalation. 

The vulnerability could allow authenticated attackers to elevate user privileges. This issue affects Operations Bridge Manager: through 2021.05; Operations Bridge Suite (Containerized): through 2021.05; UCMDB ( Classic and Containerized): through 2021.05.
CWE: CWE-648
References: https://portal.microfocus.com/s/article/KM000039040?language=en_US; https://portal.microfocus.com/s/article/KM000039044?language=en_US
CVE: CVE-2025-25234
Published: 2025-04-17
Description: Omnissa UAG contains a Cross-Origin Resource Sharing (CORS) bypass vulnerability. A malicious actor with network access to UAG may be able to bypass administrator-configured CORS restrictions to gain access to sensitive networks.
CVSS Score: 7.1 (HIGH)
CWE: CWE-942
References: https://static.omnissa.com/sites/default/files/OMSA-2025-0002.pdf; https://www.omnissa.com/omnissa-security-response/
CVE: CVE-2025-29040
Published: 2025-04-17
Description: An issue in dlink DIR 823x 240802 allows a remote attacker to execute arbitrary code via the target_addr key value and the function 0x41737c
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://gist.github.com/xyqer1/b3bebe4967a[PII_REDACTED]738f0be45ce; https://github.com/xyqer1/Dlink-dir-823x-diag_ping-target_addr-CommandInjection; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2025-29041
Published: 2025-04-17
Description: An issue in dlink DIR 823x 240802 allows a remote attacker to execute arbitrary code via the target_addr key value and the function 0x41710c
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://gist.github.com/xyqer1/101b7308bdf8618d8be30bd1d09ddd38; https://github.com/xyqer1/Dlink-dir-823x-diag_nslookup-target_addr-CommandInjection; https://www.dlink.com/en/security-bulletin/
CVE: CVE-2025-29044
Published: 2025-04-17
Description: Buffer Overflow vulnerability in Netgear- R61 router V1.0.1.28 allows a remote attacker to execute arbitrary code via the QUERY_STRING key value
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://gist.github.com/xyqer1/09fe6488a6655776c8c5d33e630a0f2a; https://github.com/xyqer1/Netgear-R6100-cgiMain-QUERY_STRING-StackOverflow?tab=readme-ov-file; https://gist.github.com/xyqer1/09fe6488a6655776c8c5d33e630a0f2a
CVE: CVE-2025-29045
Published: 2025-04-17
Description: Buffer Overflow vulnerability in ALFA_CAMPRO-co-2.29 allows a remote attacker to execute arbitrary code via the newap_text_0 key value
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://gist.github.com/xyqer1/16f6b44ef062374bc32c12952c7b81f8; https://github.com/xyqer1/ALFA-WiFi-CampPro-APSecurity-newap_text_0; https://gist.github.com/xyqer1/16f6b44ef062374bc32c12952c7b81f8
CVE: CVE-2025-29046
Published: 2025-04-17
Description: Buffer Overflow vulnerability inALFA WiFi CampPro router ALFA_CAMPRO-co-2.29 allows a remote attacker to execute arbitrary code via the GAPSMinute3 key value
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://gist.github.com/xyqer1/7f9970240aec0af412caee79271a5be5; https://github.com/xyqer1/ALFA-WiFi-CampPro-GreenAP-GAPSMinute3; https://gist.github.com/xyqer1/7f9970240aec0af412caee79271a5be5
CVE: CVE-2025-29047
Published: 2025-04-17
Description: Buffer Overflow vulnerability inALFA WiFi CampPro router ALFA_CAMPRO-co-2.29 allows a remote attacker to execute arbitrary code via the hiddenIndex in the function StorageEditUser
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://gist.github.com/xyqer1/74adbc0249eeacf762fb4d33cf93a0f5; https://github.com/xyqer1/ALFA-WiFi-CampPro-StorageEditUser-hiddenIndex; https://gist.github.com/xyqer1/74adbc0249eeacf762fb4d33cf93a0f5
CVE: CVE-2025-3651
Published: 2025-04-17
Description: Improper Verification of Source of a Communication Channel in Work Desktop for Mac versions 10.8.1.46 and earlier

 allows attackers to execute arbitrary commands via unauthorized access to the Agent service. 

This has been remediated in Work Desktop for Mac version 10.8.2.33.
CWE: CWE-346, CWE-668
References: https://docs.imanage.com/security/CVE-2025-3651.html
CVE: CVE-2024-12530
Published: 2025-04-17
Description: Uncontrolled Search Path Element vulnerability in OpenText Secure Content Manager on Windows allows DLL Side-Loading.This issue affects Secure Content Manager: 23.4.

End-users can potentially exploit the vulnerability to execute malicious code in the trusted context of the thick-client application.
CWE: CWE-427
References: https://portal.microfocus.com/s/article/KM000040073?
CVE: CVE-2024-55238
Published: 2025-04-17
Description: OpenMetadata <=1.4.1 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the WorkflowDAO interface. The workflowtype and status parameters can be used to build a SQL query.
CVSS Score: 7.1 (HIGH)
CWE: CWE-89
References: https://gist.github.com/javadk/68c597cdb94768dab31a3219c2ad9904; https://github.com/open-metadata/OpenMetadata/blob/98945cb2db87ebb325d3a72131f049abffcba345/openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/CollectionDAO.java#L4243; https://github.com/open-metadata/OpenMetadata/blob/98945cb2db87ebb325d3a72131f049abffcba345/openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/CollectionDAO.java#L4247
CVE: CVE-2024-56518
Published: 2025-04-17
Description: Hazelcast Management Center through 6.0 allows remote code execution via a JndiLoginModule user.provider.url in a hazelcast-client XML document (aka a client configuration file), which can be uploaded at the /cluster-connections URI.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://docs.hazelcast.com/management-center/6.0-snapshot/getting-started/install; https://gist.github.com/azraelxuemo/c3d42739aa3306a41111ef603dc65b4c
CVE: CVE-2025-22340
Published: 2025-04-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 Data Dash data-dash allows Stored XSS.This issue affects Data Dash: from n/a through <= 1.2.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/data-dash/vulnerability/wordpress-data-dash-plugin-1-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22565
Published: 2025-04-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bill Zimmerman vooPlayer v4 vooplayer allows Reflected XSS.This issue affects vooPlayer v4: from n/a through <= 4.0.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/vooplayer/vulnerability/wordpress-vooplayer-v4-plugin-4-0-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22636
Published: 2025-04-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vicente Ruiz Gálvez VR-Frases vr-frases allows Reflected XSS.This issue affects VR-Frases: from n/a through <= 4.0.1.
CVSS Score: 8.2 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/vr-frases/vulnerability/wordpress-vr-frases-plugin-3-0-1-reflected-xss-to-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-22651
Published: 2025-04-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wppluginboxdev Stylish Google Sheet Reader stylish-google-sheet-reader allows Reflected XSS.This issue affects Stylish Google Sheet Reader: from n/a through <= 4.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/stylish-google-sheet-reader/vulnerability/wordpress-stylish-google-sheet-reader-plugin-4-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22655
Published: 2025-04-17
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Caio Web Dev CWD – Stealth Links cwd-stealth-links allows SQL Injection.This issue affects CWD – Stealth Links: from n/a through <= 1.3.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/cwd-stealth-links/vulnerability/wordpress-cwd-stealth-links-plugin-1-3-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-22692
Published: 2025-04-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rachanaS Sponsered Link sponsered-link allows Reflected XSS.This issue affects Sponsered Link: from n/a through <= 4.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/sponsered-link/vulnerability/wordpress-sponsered-link-plugin-4-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22771
Published: 2025-04-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Studio Hyperset The Great Firewords of China sensitive-chinese-words-scanner allows Stored XSS.This issue affects The Great Firewords of China: from n/a through <= 1.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/sensitive-chinese-words-scanner/vulnerability/wordpress-the-great-firewords-of-china-plugin-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22774
Published: 2025-04-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRUDLab CRUDLab Scroll to Top crudlab-scroll-to-top allows Reflected XSS.This issue affects CRUDLab Scroll to Top: from n/a through <= 1.0.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/crudlab-scroll-to-top/vulnerability/wordpress-crudlab-scroll-to-top-plugin-1-0-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22796
Published: 2025-04-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in platcom WP-Asambleas wp-asambleas allows Reflected XSS.This issue affects WP-Asambleas: from n/a through <= 2.85.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-asambleas/vulnerability/wordpress-wp-asambleas-plugin-2-85-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23443
Published: 2025-04-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Claire Ryan Author Showcase author-showcase allows Reflected XSS.This issue affects Author Showcase: from n/a through <= 1.4.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/author-showcase/vulnerability/wordpress-author-showcase-plugin-1-4-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23448
Published: 2025-04-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dastan800 visualslider Sldier visual-slider allows Reflected XSS.This issue affects visualslider Sldier: from n/a through <= 1.1.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/visual-slider/vulnerability/wordpress-visualslider-sldier-plugin-1-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23773
Published: 2025-04-17
Description: Missing Authorization vulnerability in mingocommerce Delete All Posts delele-all allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Delete All Posts: from n/a through <= 1.1.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/delele-all/vulnerability/wordpress-delete-all-posts-plugin-1-1-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-23782
Published: 2025-04-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TotalSuite TotalContest Lite totalcontest-lite allows Reflected XSS.This issue affects TotalContest Lite: from n/a through <= 2.8.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/totalcontest-lite/vulnerability/wordpress-totalcontest-lite-plugin-2-8-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23855
Published: 2025-04-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fyljp SpiderDisplay spiderdisplay allows Reflected XSS.This issue affects SpiderDisplay: from n/a through <= 1.9.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/spiderdisplay/vulnerability/wordpress-spiderdisplay-plugin-1-9-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23858
Published: 2025-04-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hiren Patel Custom Users Order custom-users-order allows Reflected XSS.This issue affects Custom Users Order: from n/a through <= 4.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/custom-users-order/vulnerability/wordpress-custom-users-order-plugin-4-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23906
Published: 2025-04-17
Description: Missing Authorization vulnerability in wpseek WordPress Dashboard Tweeter allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WordPress Dashboard Tweeter: from n/a through 1.3.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/wordpress-dashboard-twitter/vulnerability/wordpress-wordpress-dashboard-tweeter-plugin-1-3-2-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-23958
Published: 2025-04-17
Description: Missing Authorization vulnerability in FADI MED Editor Wysiwyg Background Color editor-wysiwyg-background-color allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Editor Wysiwyg Background Color: from n/a through <= 1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/editor-wysiwyg-background-color/vulnerability/wordpress-editor-wysiwyg-background-color-plugin-1-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-24539
Published: 2025-04-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in debounce DeBounce Email Validator debounce-io-email-validator allows Reflected XSS.This issue affects DeBounce Email Validator: from n/a through <= 5.6.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/debounce-io-email-validator/vulnerability/wordpress-debounce-email-validator-plugin-5-6-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24548
Published: 2025-04-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Autoglot Autoglot – Automatic WordPress Translation autoglot allows Reflected XSS.This issue affects Autoglot – Automatic WordPress Translation: from n/a through <= 2.4.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/autoglot/vulnerability/wordpress-autoglot-automatic-wordpress-translation-plugin-2-4-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24550
Published: 2025-04-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JobScore Job Manager job-manager-by-jobscore allows Stored XSS.This issue affects Job Manager: from n/a through <= 2.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/job-manager-by-jobscore/vulnerability/wordpress-job-manager-plugin-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24553
Published: 2025-04-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Akadrama Shipping with Venipak for WooCommerce wc-venipak-shipping allows Reflected XSS.This issue affects Shipping with Venipak for WooCommerce: from n/a through <= 1.22.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wc-venipak-shipping/vulnerability/wordpress-shipping-with-venipak-for-woocommerce-plugin-1-22-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24577
Published: 2025-04-17
Description: Missing Authorization vulnerability in Ays Pro Poll Maker poll-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Poll Maker: from n/a through <= 5.5.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/poll-maker/vulnerability/wordpress-poll-maker-plugin-5-5-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-24581
Published: 2025-04-17
Description: Missing Authorization vulnerability in Themefic Instantio instantio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Instantio: from n/a through <= 3.3.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/instantio/vulnerability/wordpress-instantio-plugin-3-3-7-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-24583
Published: 2025-04-17
Description: Missing Authorization vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 12 Step Meeting List: from n/a through <= 3.16.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/12-step-meeting-list/vulnerability/wordpress-12-step-meeting-list-plugin-3-16-5-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-24586
Published: 2025-04-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bitsstech Shipment Tracker for Woocommerce shipment-tracker-for-woocommerce allows Reflected XSS.This issue affects Shipment Tracker for Woocommerce: from n/a through <= 1.4.23.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/shipment-tracker-for-woocommerce/vulnerability/wordpress-shipment-tracker-for-woocommerce-plugin-1-4-23-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24619
Published: 2025-04-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webheadcoder WP Log Action wp-log-action allows Reflected XSS.This issue affects WP Log Action: from n/a through <= 0.51.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-log-action/vulnerability/wordpress-wp-log-action-plugin-0-51-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24621
Published: 2025-04-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Reflected XSS.This issue affects Arconix Shortcodes: from n/a through <= 2.1.15.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/arconix-shortcodes/vulnerability/wordpress-arconix-shortcodes-plugin-2-1-15-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24624
Published: 2025-04-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevItems HT Event ht-event allows Reflected XSS.This issue affects HT Event: from n/a through <= 1.4.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ht-event/vulnerability/wordpress-ht-event-wordpress-event-manager-plugin-for-elementor-plugin-1-4-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24637
Published: 2025-04-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Beacon Lead Magnets and Lead Capture beacon-by allows Reflected XSS.This issue affects Beacon Lead Magnets and Lead Capture: from n/a through <= 1.5.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/beacon-by/vulnerability/wordpress-beacon-lead-magnets-and-lead-capture-plugin-1-5-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24640
Published: 2025-04-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan-Lucian Stefancu Empty Tags Remover empty-tags-remover allows Reflected XSS.This issue affects Empty Tags Remover: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/empty-tags-remover/vulnerability/wordpress-empty-tags-remover-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24645
Published: 2025-04-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rob Scott Eazy Under Construction eazy-under-construction allows Reflected XSS.This issue affects Eazy Under Construction: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/eazy-under-construction/vulnerability/wordpress-eazy-under-construction-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve