Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

3,463 results · page 15 of 70

Jan 14, 2026Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the administrative interface within the Tools StCVE-2025-71165 · Other software · Typesetter · reported by VulnCheckMedium 4.8
Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the administrative interface within the Tools Status functionality. The path parameter is reflected into the HTML response without proper output encoding in include/admin/Tools/Status.php. An authenticated attacker can supply crafted input containing HTML or JavaScript, resulting in arbitrary script execution in the context of an authenticated user's browser session.
Product
Typesetter
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 14, 2026Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the Editing component.CVE-2025-71164 · Other software · Typesetter · reported by VulnCheckMedium 4.8
Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the Editing component. The images parameter (submitted as images[] in a POST request) is reflected into an HTML href attribute without proper context-aware output encoding in include/tool/Editing.php. An authenticated attacker with editing privileges can supply a JavaScript pseudo-protocol (e.g., javascript:) to trigger arbitrary JavaScript execution in the context of the victim's browser session.
Product
Typesetter
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 14, 2026List Site Contributors: Reflected Cross-Site ScriptingCVE-2026-0594 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The List Site Contributors plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'alpha' parameter in versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
List Site Contributors
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update List Site Contributors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 13, 2026Webgrind 1.1 and before contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts via the file pCVE-2023-54341 · Other software · jokkedk · reported by VulnCheckMedium 5.1
Webgrind 1.1 and before contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts via the file parameter in index.php. The application does not sufficiently encode user-controlled inputs, allowing attackers to execute arbitrary JavaScript in victim's browsers by crafting malicious URLs.
Product
Webgrind
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com exploit-db.com
Jan 13, 2026Zstore, now referred to as Zippy CRM, 6.5.4 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts through unCVE-2023-53985 · Other software · Zippy · reported by VulnCheckMedium 5.1
Zstore, now referred to as Zippy CRM, 6.5.4 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts through unvalidated input parameters. Attackers can submit crafted payloads in manual insertion points to execute arbitrary JavaScript code in victim's browser context.
Product
Zstore
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 13, 2026Prowise Reflect version 1.0.9 contains a remote keystroke injection vulnerability that allows attackers to send keyboard events through an exposed WebSocket on CVE-2022-50925 · Other software · Prowise · reported by VulnCheckHigh 8.6
Prowise Reflect version 1.0.9 contains a remote keystroke injection vulnerability that allows attackers to send keyboard events through an exposed WebSocket on port 8082. Attackers can craft malicious web pages to inject keystrokes, opening applications and typing arbitrary text by sending specific WebSocket messages.
Product
Prowise Reflect
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com prowise.com
Jan 13, 2026Testa 3.5.1 contains a reflected cross-site scripting vulnerability in the login.php redirect parameter that allows attackers to inject malicious scripts.CVE-2022-50896 · Other software · Testa · reported by VulnCheckMedium 5.1
Testa 3.5.1 contains a reflected cross-site scripting vulnerability in the login.php redirect parameter that allows attackers to inject malicious scripts. Attackers can craft a specially encoded payload in the redirect parameter to execute arbitrary JavaScript in victim's browser context.
Product
Testa
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record web.archive.org exploit-db.com
Jan 13, 2026A CORS misconfiguration in Eramba Community and Enterprise Editions v3.26.0 allows an attacker-controlled Origin header to be reflected in the Access-Control-AlCVE-2025-55462 · Other software · Eramba · reported by MITREMedium 6.5
A CORS misconfiguration in Eramba Community and Enterprise Editions v3.26.0 allows an attacker-controlled Origin header to be reflected in the Access-Control-Allow-Origin response along with Access-Control-Allow-Credentials: true. This permits malicious third-party websites to perform authenticated cross-origin requests against the Eramba API, including endpoints like /system-api/login and /system-api/user/me. The response includes sensitive user session data (ID, name, email, access groups), which is accessible to the attacker's JavaScript. This flaw enables full session hijack and data exfiltration without user interaction. Eramba versions 3.23.3 and earlier were tested and appear unaffected. The vulnerability is present in default installations, requiring no custom configuration.
Product
Eramba
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record discussions.eramba.org
Jan 9, 2026Lesson Plan Book: Reflected Cross-Site ScriptingCVE-2025-13893 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Lesson Plan Book plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Lesson Plan Book
Affected
up to 1.3
What to do
Affects up to 1.3. Update Lesson Plan Book to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 9, 2026MG AdvancedOptions: Reflected Cross-Site ScriptingCVE-2025-13892 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The MG AdvancedOptions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
MG AdvancedOptions
Affected
up to 1.2
What to do
Affects up to 1.2. Update MG AdvancedOptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 9, 2026Shabat Keeper: Reflected Cross-Site ScriptingCVE-2025-13701 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Shabat Keeper plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $_SERVER['PHP_SELF'] parameter in all versions up to, and including, 0.4.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Shabat Keeper
Affected
up to 0.4.4
What to do
Affects up to 0.4.4. Update Shabat Keeper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 9, 2026Top Position Google Finance: Reflected Cross-Site ScriptingCVE-2025-13895 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Top Position Google Finance plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and including, 0.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Top Position Google Finance
Affected
up to 0.1.0
What to do
Affects up to 0.1.0. Update Top Position Google Finance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2026V-SOL GPON/EPON OLT Platform v2.03 contains multiple reflected cross-site scripting vulnerabilities due to improper input sanitization in various script parametCVE-2019-25284 · Other software · Guangzhou V · reported by VulnCheckMedium 5.1
V-SOL GPON/EPON OLT Platform v2.03 contains multiple reflected cross-site scripting vulnerabilities due to improper input sanitization in various script parameters. Attackers can exploit these vulnerabilities by injecting malicious HTML and script code to execute arbitrary scripts in a victim's browser session.
Product
V-SOL GPON/EPON OLT Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cxsecurity.com exchange.xforce.ibmcloud.com
Jan 7, 2026HBLPAY Payment Gateway for WooCommerce: Reflected Cross-Site ScriptingCVE-2025-14875 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The HBLPAY Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘cusdata’ parameter in all versions up to, and including, 5.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
HBLPAY Payment Gateway for WooCommerce
Affected
up to 5.0.0
What to do
Affects up to 5.0.0. Update HBLPAY Payment Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 7, 2026WP Photo Album Plus: Reflected Cross-Site ScriptingCVE-2025-14835 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The WP Photo Album Plus plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘shortcode’ parameter in all versions up to, and including, 9.1.05.008 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP Photo Album Plus
Affected
up to 9.1.05.008
What to do
Affects up to 9.1.05.008. Update WP Photo Album Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2026WP Widget Changer: Reflected Cross-Site ScriptingCVE-2025-14131 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Widget Changer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP Widget Changer
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update WP Widget Changer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2026Post Like Dislike: Reflected Cross-Site ScriptingCVE-2025-14130 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Post Like Dislike plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Post Like Dislike
Affected
up to 1.0
What to do
Affects up to 1.0. Update Post Like Dislike to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2026Stumble! for: Reflected Cross-Site ScriptingCVE-2025-14128 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Stumble! for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Stumble! for
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Stumble! for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2026Testimonial Master: Reflected Cross-Site ScriptingCVE-2025-14127 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Testimonial Master plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and including, 0.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Testimonial Master
Affected
up to 0.2.1
What to do
Affects up to 0.2.1. Update Testimonial Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2026Starred Review: Reflected Cross-Site ScriptingCVE-2025-14118 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Starred Review plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the PHP_SELF variable in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Starred Review
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Starred Review to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 7, 2026Premmerce WooCommerce Customers Manager: Reflected Cross-Site ScriptingCVE-2025-13369 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Premmerce WooCommerce Customers Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'money_spent_from', 'money_spent_to', 'registered_from', and 'registered_to' parameters in all versions up to, and including, 1.1.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link.
Product
Premmerce WooCommerce Customers Manager
Affected
up to 1.1.14
What to do
Affects up to 1.1.14. Update Premmerce WooCommerce Customers Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 31, 2025COMMAX Biometric Access Control System 1.0.0 contains an unauthenticated reflected cross-site scripting vulnerability in cookie parameters 'CMX_ADMIN_NM' and 'CCVE-2021-47743 · Other software · COMMAX Co., Ltd. · reported by VulnCheckMedium 5.1
COMMAX Biometric Access Control System 1.0.0 contains an unauthenticated reflected cross-site scripting vulnerability in cookie parameters 'CMX_ADMIN_NM' and 'CMX_COMPLEX_NM'. Attackers can inject malicious HTML and JavaScript code into these cookie values to execute arbitrary scripts in a victim's browser session.
Product
COMMAX Biometric Access Control System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cxsecurity.com exchange.xforce.ibmcloud.com
Dec 30, 2025ISOinsight developed by NetVision Information has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitraryCVE-2025-15355 · Other software · NetVision Information · reported by twcert@cert.org.twMedium 5.1
ISOinsight developed by NetVision Information has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.
Product
ISOinsight
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Dec 24, 2025A reflected cross-site scripting (XSS) vulnerability in MyNET up to v26.08 allows attackers to execute arbitrary code in the context of a user's browser via injCVE-2024-40317 · Other software · Airc · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in MyNET up to v26.08 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload into the parameter HTTP.
Product
Mynet
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record miguelsantareno.github.io airc.pt
Dec 24, 2025MyNET up to v26.08 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the ficheiro parameter.CVE-2024-35322 · Other software · Airc · reported by MITREMedium 6.1
MyNET up to v26.08 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the ficheiro parameter.
Product
Mynet
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record miguelsantareno.github.io airc.pt
Dec 23, 2025A reflected Cross-Site Scripting (XSS) vulnerability has been identified in TechStore version 1.0.CVE-2025-66845 · Other software · Nooncarlett · reported by MITREMedium 6.1
A reflected Cross-Site Scripting (XSS) vulnerability has been identified in TechStore version 1.0. The user_name endpoint reflects the id query parameter directly into the HTML response without output encoding or sanitization, allowing execution of arbitrary JavaScript code in a victim’s browser.
Product
Techstore
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com
Dec 22, 2025Cobian Reflector 0.9.93 RC1 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the password input field.CVE-2022-50689 · Other software · Cobiansoft · reported by VulnCheckMedium 6.9
Cobian Reflector 0.9.93 RC1 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the password input field. Attackers can paste a large 8000-byte buffer into the password field to trigger an application crash during SFTP task configuration.
Product
Cobian Reflector
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cobiansoft.com exploit-db.com
Dec 22, 2025A reflected cross-site scripting (XSS) vulnerability exists in FuguHub 8.1 when serving SVG files through the /fs/ file manager interface.CVE-2025-65790 · Other software · Realtimelogic · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability exists in FuguHub 8.1 when serving SVG files through the /fs/ file manager interface. FuguHub does not sanitize or restrict script execution inside SVG content. When a victim opens a crafted SVG containing an inline <script> element, the browser executes the attacker-controlled JavaScript.
Product
Fuguhub
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fuguhub.com github.com
Dec 22, 2025MyNET up to v26.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the src parameter.CVE-2024-25812 · Other software · Airc · reported by MITREMedium 6.1
MyNET up to v26.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the src parameter.
Product
Mynet
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com airc.pt
Dec 22, 2025MyNET up to v26.08 was discovered to contain a Reflected cross-site scripting (XSS) vulnerability via the msgtipo parameter.CVE-2024-35321 · Other software · Airc · reported by MITREMedium 4.3
MyNET up to v26.08 was discovered to contain a Reflected cross-site scripting (XSS) vulnerability via the msgtipo parameter.
Product
Mynet
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 22, 2025MyNET up to v26.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the msg parameter.CVE-2024-25814 · Other software · Airc · reported by MITREMedium 6.1
MyNET up to v26.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the msg parameter.
Product
Mynet
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com airc.pt
Dec 22, 2025Reflected cross-site scripting (XSS) vulnerability in ClinCapture EDC 3.0 and 2.2.3, allowing an unauthenticated remote attacker to execute JavaScript code in tCVE-2025-65270 · Other software · Clincapture · reported by MITREMedium 6.1
Reflected cross-site scripting (XSS) vulnerability in ClinCapture EDC 3.0 and 2.2.3, allowing an unauthenticated remote attacker to execute JavaScript code in the context of the victim's browser.
Product
Captivate Electronic Data Capture
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com clincapture.com
Dec 20, 2025Product Table for WooCommerce: Reflected Cross-Site ScriptingCVE-2025-12398 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Product Table for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search_key' parameter in all versions up to, and including, 5.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Product Table for WooCommerce
Affected
up to 5.0.8
What to do
Affects up to 5.0.8. Update Product Table for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 19, 2025Overstock Affiliate Links: Reflected Cross-Site ScriptingCVE-2025-13624 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Overstock Affiliate Links plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` parameter in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Overstock Affiliate Links
Affected
up to 1.1
What to do
Affects up to 1.1. Update Overstock Affiliate Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 19, 2025Attachments Handler: Reflected Cross-Site ScriptingCVE-2025-12581 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Attachments Handler plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Attachments Handler
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update Attachments Handler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 18, 2025A Reflected Cross-Site Scripting (XSS) vulnerability in yohanawi Hotel Management System (commit 87e004a) allows a remote attacker to execute arbitrary web scriCVE-2025-63949 · Other software · Yohanawi · reported by MITREMedium 6.1
A Reflected Cross-Site Scripting (XSS) vulnerability in yohanawi Hotel Management System (commit 87e004a) allows a remote attacker to execute arbitrary web script via the 'error' parameter in pages/room.php.
Product
Hotel Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 18, 2025A Reflected Cross-Site Scripting (XSS) vulnerability exists in phpMsAdmin version 2.2 in the database_mode.php file.CVE-2025-63947 · Other software · Craigtaub · reported by MITREMedium 5.4
A Reflected Cross-Site Scripting (XSS) vulnerability exists in phpMsAdmin version 2.2 in the database_mode.php file. An attacker can execute arbitrary web script or HTML via the dbname parameter after a user is authenticated.
Product
Phpmsadmin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 18, 2025A reflected cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the Pages dashboard widget configuration diCVE-2024-58319 · Other software · Kentico · reported by VulnCheckMedium 5.1
A reflected cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the Pages dashboard widget configuration dialog. Attackers can exploit this vulnerability to execute malicious scripts in administrative users' browsers.
Product
Xperience
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record devnet.kentico.com vulncheck.com
Dec 18, 2025A reflected cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scripts via page preview URLs.CVE-2023-53738 · Other software · Kentico · reported by VulnCheckMedium 5.1
A reflected cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scripts via page preview URLs. Attackers can exploit this vulnerability to execute arbitrary scripts in users' browsers during page preview interactions.
Product
Xperience
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record devnet.kentico.com vulncheck.com
Dec 18, 2025A reflected cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scripts in the administration interface.CVE-2023-53736 · Other software · Kentico · reported by VulnCheckMedium 5.1
A reflected cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scripts in the administration interface. Attackers can exploit this vulnerability to execute arbitrary scripts within the administrative context.
Product
Xperience
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record devnet.kentico.com vulncheck.com
Dec 18, 2025A reflected cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via administration input fields in the Rich texCVE-2022-50681 · Other software · Kentico · reported by VulnCheckMedium 5.1
A reflected cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via administration input fields in the Rich text editor component. Attackers can exploit this vulnerability to execute arbitrary scripts in users' browsers.
Product
Xperience
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record devnet.kentico.com vulncheck.com
Dec 17, 2025Reflected cross-site scripting (XSS) in SLiMS (slims9_bulian) before 9.6.0 via improper handling of $_SERVER['PHP_SELF' ] in index.php/sysconfig.inc.php, which CVE-2025-65233 · Other software · Slims Project · reported by MITREMedium 6.1
Reflected cross-site scripting (XSS) in SLiMS (slims9_bulian) before 9.6.0 via improper handling of $_SERVER['PHP_SELF' ] in index.php/sysconfig.inc.php, which allows remote attackers to execute arbitrary JavaScript in a victim's browser by supplying a crafted URL path.
Product
Slims
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 17, 2025A reflected cross-site scripting (XSS) vulnerability in RiteCMS v3.1.0 allows attackers to execute arbitrary code in the context of a user's browser via a craftCVE-2025-67170 · Other software · Ritecms · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in RiteCMS v3.1.0 allows attackers to execute arbitrary code in the context of a user's browser via a crafted payload.
Product
Ritecms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 16, 2025In JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings pageCVE-2025-68268 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.4
In JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings page
Product
TeamCity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jetbrains.com
Dec 16, 2025In JetBrains TeamCity before 2025.11 reflected XSS was possible on VCS Root setupCVE-2025-68165 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.4
In JetBrains TeamCity before 2025.11 reflected XSS was possible on VCS Root setup
Product
TeamCity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jetbrains.com
Dec 15, 2025JLex GuestBook 1.6.4 contains a reflected cross-site scripting vulnerability in the 'q' URL parameter that allows attackers to inject malicious scripts.CVE-2023-53882 · Other software · jlexart · reported by VulnCheckMedium 5.1
JLex GuestBook 1.6.4 contains a reflected cross-site scripting vulnerability in the 'q' URL parameter that allows attackers to inject malicious scripts. Attackers can craft malicious links with XSS payloads to steal session tokens or execute arbitrary JavaScript in victims' browsers.
Product
JLex GuestBook
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jlexart.com exploit-db.com
Dec 15, 2025Lucee 5.4.2.17 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through administrative inCVE-2023-53880 · Other software · Lucee · reported by VulnCheckMedium 4.8
Lucee 5.4.2.17 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through administrative interface parameters. Attackers can craft specific payloads targeting admin pages like server.cfm and web.cfm to execute arbitrary JavaScript in victim's browser sessions.
Product
Lucee
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com lucee.org
Dec 15, 2025Jorani 1.0.3 contains a reflected cross-site scripting vulnerability in the language parameter that allows attackers to inject malicious scripts.CVE-2023-53870 · Other software · Jorani · reported by VulnCheckMedium 5.1
Jorani 1.0.3 contains a reflected cross-site scripting vulnerability in the language parameter that allows attackers to inject malicious scripts. Attackers can craft XSS payloads in the language parameter to execute arbitrary JavaScript and potentially steal user session information.
Product
Jorani
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jorani.org exploit-db.com
Dec 15, 2025A reflected cross-site scripting (XSS) vulnerability in the component /index.php/cuzh4 of PHP Inventory Management System 1 allows attackers to execute arbitrarCVE-2023-36337 · Other software · Inventory Management System Project · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in the component /index.php/cuzh4 of PHP Inventory Management System 1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Product
Inventory Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com github.com
Dec 13, 2025WP to LinkedIn Auto Publish: Reflected Cross-Site ScriptingCVE-2025-12077 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP to LinkedIn Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage in all versions up to, and including, 1.9.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP to LinkedIn Auto Publish
Affected
up to 1.9.8
What to do
Affects up to 1.9.8. Update WP to LinkedIn Auto Publish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.