Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

3,466 results · page 22 of 70

May 6, 2025A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.5, 2024.Q3.1 throuCVE-2025-4388 · Other software · Liferay · reported by security@liferay.comMedium 6.9
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the modules/apps/marketplace/marketplace-app-manager-web.
Product
Portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record liferay.dev
May 5, 2025A reflected cross-site scripting (XSS) vulnerability was discovered in Output Messenger before 2.0.63, where unsanitized input could be injected into the web apCVE-2025-27921 · Other software · Srimax · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability was discovered in Output Messenger before 2.0.63, where unsanitized input could be injected into the web application’s response. This vulnerability occurs when user-controlled input is reflected back into the browser without proper sanitization or encoding.
Product
Output Messenger
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record outputmessenger.com srimax.com
May 3, 2025Inedo ProGet through 2024.22 allows remote attackers to reach restricted functionality through the C# reflection layer, as demonstrated by causing a denial of sCVE-2025-47244 · Other software · Inedo · reported by MITREHigh 7.3
Inedo ProGet through 2024.22 allows remote attackers to reach restricted functionality through the C# reflection layer, as demonstrated by causing a denial of service (when an attacker executes a loop calling RestartWeb) or obtaining potentially sensitive information. Exploitation can occur if Anonymous access is enabled, or if there is a successful CSRF attack.
Product
ProGet
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.inedo.com forums.inedo.com
May 2, 2025OpenGrok 1.13.25 has a reflected Cross-Site Scripting (XSS) issue when producing the history view page.CVE-2025-21572 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.1
OpenGrok 1.13.25 has a reflected Cross-Site Scripting (XSS) issue when producing the history view page. This happens through improper handling of path segments. The application reflects unsanitized user input into the HTML output.
Product
OpenGrok
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com
Apr 29, 2025Reflected Cross-Site Scripting (XSS) vulnerability in Bookgy.CVE-2025-40616 · Other software · Bookgy · reported by cve-coordination@incibe.esMedium 5.1
Reflected Cross-Site Scripting (XSS) vulnerability in Bookgy. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the "IDRESERVA" parameter in /bkg_imprimir_comprobante.php.
Product
Bookgy
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Apr 29, 2025Reflected Cross-Site Scripting (XSS) vulnerability in Bookgy.CVE-2025-40615 · Other software · Bookgy · reported by cve-coordination@incibe.esMedium 5.1
Reflected Cross-Site Scripting (XSS) vulnerability in Bookgy. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the "TEXTO" parameter in /api/api_ajustes.php.
Product
Bookgy
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Apr 27, 2025The eHRMS from 104 Corporation has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codCVE-2025-3706 · Other software · 104 Corporation · reported by twcert@cert.org.twMedium 6.1
The eHRMS from 104 Corporation has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.
Product
eHRMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Apr 27, 2025Ververica Platform 2.14.0 contain an Reflected XSS vulnerability via a namespaces/default/formats URI.CVE-2025-46689 · Other software · Ververica · reported by MITREMedium 5.4
Ververica Platform 2.14.0 contain an Reflected XSS vulnerability via a namespaces/default/formats URI.
Product
Ververica Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 27, 2025Karaz Karazal through 2025-04-14 allows reflected XSS via the lang parameter to the default URI.CVE-2025-46657 · Other software · Karaz · reported by MITREHigh 7.2
Karaz Karazal through 2025-04-14 allows reflected XSS via the lang parameter to the default URI.
Product
Karazal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 25, 2025Custom Admin-Bar Favorites: Reflected Cross-Site ScriptingCVE-2025-3868 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Custom Admin-Bar Favorites plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'menuObject' parameter in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Custom Admin-Bar Favorites
Affected
up to 0.1
What to do
Affects up to 0.1. Update Custom Admin-Bar Favorites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Apr 22, 2025A cross-site scripting (reflected XSS) vulnerability was found in Mettler Toledo FreeWeight.Net Web Reports Viewer 8.4.0 (440).CVE-2025-43952 · Other software · reported by MITREMedium 6.1
A cross-site scripting (reflected XSS) vulnerability was found in Mettler Toledo FreeWeight.Net Web Reports Viewer 8.4.0 (440). It allows an attacker to inject malicious scripts via the IW_SessionID_ parameter.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com mt.com
Apr 20, 2025The KnowBe4 Security Awareness Training application before 2020-01-10 allows reflected XSS.CVE-2020-36844 · Other software · KnowBe4 · reported by MITREMedium 6.1
The KnowBe4 Security Awareness Training application before 2020-01-10 allows reflected XSS. The response has a SCRIPT element that sets window.location.href to a JavaScript URL.
Product
Security Awareness Training
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record doyler.net
Apr 18, 2025Coupon Affiliates – Affiliate Plugin for WooCommerce: Reflected Cross-Site ScriptingCVE-2025-3598 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Coupon Affiliates – Affiliate Plugin for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the commission_summary parameter in all versions up to, and including, .6.3.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Coupon Affiliates – Affiliate Plugin for WooCommerce
Affected
up to .6.3.0
What to do
Affects up to .6.3.0. Update Coupon Affiliates – Affiliate Plugin for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 15, 2025In Ubuntu, gnome-control-center did not properly reflect SSH remote login status when the system was configured to use systemd socket activation for openssh-serCVE-2023-5616 · Other software · Canonical Ltd. · reported by security@ubuntu.comMedium 4.9
In Ubuntu, gnome-control-center did not properly reflect SSH remote login status when the system was configured to use systemd socket activation for openssh-server. This could unknowingly leave the local machine exposed to remote SSH access contrary to expectation of the user.
Product
Ubuntu's gnome-control-center
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugs.launchpad.net ubuntu.com
Apr 14, 2025Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SicommNet BASEC on SaaS allows Reflected XSS, XSS TCVE-2025-22373 · Other software · SicommNet · reported by csirt@divd.nlHigh 8.7
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SicommNet BASEC on SaaS allows Reflected XSS, XSS Through HTTP Query Strings, Rendering of Arbitrary HTML and alternation of CSS Styles This issue affects BASEC: from 14 Dec 2021.
Product
BASEC
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record basec.sicomm.net csirt.divd.nl
Apr 14, 2025Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Reflected XSS (Cross-site Scripting) attacks.CVE-2024-49707 · Other software · SoftCOM · reported by cvd@cert.plMedium 5.1
Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Reflected XSS (Cross-site Scripting) attacks. An attacker might trick a user into filling a form designed for resetting user's password with a malicious script, what causes the script to run in user's context. This vulnerability has been patched in version 79.0
Product
iKSORIS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl iksoris.pl
Apr 14, 2025Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Reflected XSS (Cross-site Scripting) attacks.CVE-2024-13598 · Other software · SoftCOM · reported by cvd@cert.plMedium 5.1
Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Reflected XSS (Cross-site Scripting) attacks. Using a functionality of creating new form fields one creates new parameters vulnerable to XSS attacks. A user tricked into filling such a form with a malicious script will run the code in their's context. This vulnerability has been patched in version 79.0
Product
iKSORIS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl iksoris.pl
Apr 14, 2025Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Reflected XSS (Cross-site Scripting) attacks.CVE-2024-13597 · Other software · SoftCOM · reported by cvd@cert.plMedium 5.1
Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Reflected XSS (Cross-site Scripting) attacks. An attacker might trick a user into filling a form sent to login panel at /softcom/ with a malicious script, what causes the script to run in user's context. This vulnerability has been patched in version 79.0
Product
iKSORIS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl iksoris.pl
Apr 14, 2025Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Reflected XSS (Cross-site Scripting) attacks.CVE-2024-10090 · Other software · SoftCOM · reported by cvd@cert.plMedium 5.1
Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Reflected XSS (Cross-site Scripting) attacks. An attacker might trick a user into filling a form designed for adding users with a malicious script, what causes the script to run in user's context. This vulnerability has been patched in version 79.0
Product
iKSORIS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl iksoris.pl
Apr 14, 2025Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Reflected XSS (Cross-site Scripting) attacks.CVE-2024-10088 · Other software · SoftCOM · reported by cvd@cert.plMedium 5.1
Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Reflected XSS (Cross-site Scripting) attacks. An attacker might trick a user into filling a login form with a malicious script, what causes the script to run in user's context. This vulnerability has been patched in version 79.0
Product
iKSORIS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl iksoris.pl
Apr 14, 2025Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Reflected XSS (Cross-site Scripting) attacks.CVE-2024-10087 · Other software · SoftCOM · reported by cvd@cert.plMedium 5.3
Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Reflected XSS (Cross-site Scripting) attacks. An attacker might craft a link containing a malicious script, which then gets directly embedded in references to other resources, what causes the script to run in user's context multiple times. This vulnerability has been patched in version 79.0
Product
iKSORIS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl iksoris.pl
Apr 11, 2025Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Reflected Cross-Site ScriptingCVE-2025-2269 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘image_id’ parameter in all versions up to, and including, 1.8.34 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrative user into performing an action such as clicking on a link.
Product
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
Affected
up to 1.8.34
What to do
Affects up to 1.8.34. Update Photo Gallery by 10Web – Mobile-Friendly Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 11, 2025Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for: Reflected Cross-Site ScriptingCVE-2025-3421 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'form_id' parameter in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 8, 2025ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability.CVE-2025-30292 · Websites & servers · Adobe · reported by AdobeMedium 6.1
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Product
ColdFusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com
Apr 8, 2025A vulnerability in the Captive Portal of an AOS-10 GW and AOS-8 Controller/Mobility Conductor could allow a remote attacker to conduct a reflected cross-site scCVE-2025-27084 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 5.4
A vulnerability in the Captive Portal of an AOS-10 GW and AOS-8 Controller/Mobility Conductor could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack. Successful exploitation could enable the attacker to execute arbitrary script code in the victim's browser within the context of the affected interface.
Product
HPE Aruba Networking AOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com
Apr 8, 2025Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to obtain admin privileges.CVE-2025-22466 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75High 8.2
Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to obtain admin privileges. User interaction is required.
Product
Endpoint Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forums.ivanti.com
Apr 8, 2025Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to execute arbitrary javascCVE-2025-22465 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75Medium 6.1
Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to execute arbitrary javascript in a victim's browser. Unlikely user interaction is required.
Product
Endpoint Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forums.ivanti.com
Apr 2, 2025Video Url: Reflected Cross-Site ScriptingCVE-2025-3098 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Video Url plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.0.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Video Url
Affected
up to 1.0.0.3
What to do
Affects up to 1.0.0.3. Update Video Url to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 2, 2025Gift Certificate Creator: Reflected Cross-Site ScriptingCVE-2025-2483 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Gift Certificate Creator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘receip_address’ parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Gift Certificate Creator
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Gift Certificate Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Mar 31, 2025Xorcom CompletePBX is vulnerable to a reflected cross-site scripting (XSS) in the administrative control panel.CVE-2025-30006 · Other software · Xorcom · reported by VulnCheckMedium 6.1
Xorcom CompletePBX is vulnerable to a reflected cross-site scripting (XSS) in the administrative control panel. This issue affects CompletePBX: all versions up to and including 5.2.35
Product
CompletePBX
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vulncheck.com xorcom.com
Mar 31, 2025An unsafe reflection vulnerability in Kentico Xperience allows an unauthenticated attacker to kill the current process, leading to a Denial-of-Service conditionCVE-2025-2794 · Other software · Kentico · reported by VulnCheckHigh 8.7
An unsafe reflection vulnerability in Kentico Xperience allows an unauthenticated attacker to kill the current process, leading to a Denial-of-Service condition. This issue affects Xperience: through 13.0.180.
Product
Xperience
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record devnet.kentico.com vulncheck.com
Mar 31, 2025phpIPAM through 1.7.3 has a reflected Cross-Site Scripting (XSS) vulnerability in the install scripts.CVE-2024-55093 · Websites & servers · phpIPAM · reported by MITREMedium 5.4
phpIPAM through 1.7.3 has a reflected Cross-Site Scripting (XSS) vulnerability in the install scripts.
Product
phpIPAM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Mar 31, 2025A Reflected Cross-Site Scripting (XSS) vulnerability has been discovered in FAST LTA Silent Brick WebUI, allowing attackers to inject malicious JavaScript code CVE-2025-2072 · Other software · FAST LTA · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfMedium 5.1
A Reflected Cross-Site Scripting (XSS) vulnerability has been discovered in FAST LTA Silent Brick WebUI, allowing attackers to inject malicious JavaScript code into web pages viewed by users. This issue arises when user-supplied input is improperly handled and reflected directly in the output of a web page without proper sanitization or encoding. Exploiting this vulnerability, an attacker can execute arbitrary JavaScript in the context of the victim's browser, potentially leading to session hijacking, data theft, and other malicious actions. Affected WebUI parameters are "h", "hd", "p", "pi", "s", "t", "x", "y".
Product
FAST LTA Silent Brick WebUI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fast-lta.de
Mar 28, 2025Reflected Cross-Site Scripting (XSS) vulnerability in version 1.0 of the Clinic Queuing System.CVE-2025-2870 · Other software · Clinic Queuing System · reported by cve-coordination@incibe.esMedium 4.8
Reflected Cross-Site Scripting (XSS) vulnerability in version 1.0 of the Clinic Queuing System. This vulnerability could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the page parameter in /patient_side.php.
Product
Clinic Queuing System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Mar 28, 2025Reflected Cross-Site Scripting (XSS) vulnerability in version 1.0 of the Clinic Queuing System.CVE-2025-2869 · Other software · Clinic Queuing System · reported by cve-coordination@incibe.esMedium 4.8
Reflected Cross-Site Scripting (XSS) vulnerability in version 1.0 of the Clinic Queuing System. This vulnerability could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the id parameter in /manage_user.php.
Product
Clinic Queuing System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Mar 28, 2025Reflected Cross-Site Scripting (XSS) vulnerability in version 1.0 of the Clinic Queuing System.CVE-2025-2868 · Other software · Clinic Queuing System · reported by cve-coordination@incibe.esMedium 4.8
Reflected Cross-Site Scripting (XSS) vulnerability in version 1.0 of the Clinic Queuing System. This vulnerability could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the page parameter in /index.php.
Product
Clinic Queuing System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Mar 28, 2025The tagDiv Composer plugin for WordPress, used by the Newspaper theme, is vulnerable to Reflected Cross-Site Scripting via the 'account_id' and 'account_usernamCVE-2025-2804 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The tagDiv Composer plugin for WordPress, used by the Newspaper theme, is vulnerable to Reflected Cross-Site Scripting via the 'account_id' and 'account_username' parameters in all versions up to, and including, 5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected
up to 5.3
What to do
Affects up to 5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record tagdiv.com wordfence.com
Mar 26, 2025MediaView: Reflected Cross-Site ScriptingCVE-2025-2481 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The MediaView plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id' parameter in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
MediaView
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update MediaView to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 25, 2025SH Email Alert: Reflected Cross-Site ScriptingCVE-2025-2165 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The SH Email Alert plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'mid' parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
SH Email Alert
Affected
up to 1.0
What to do
Affects up to 1.0. Update SH Email Alert to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Mar 25, 2025Smart Maintenance Mode: Reflected Cross-Site ScriptingCVE-2025-1490 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Smart Maintenance Mode plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘setstatus’ parameter in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Smart Maintenance Mode
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update Smart Maintenance Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Mar 25, 2025The TRMTracker web application is vulnerable to reflected Cross-site scripting attack.CVE-2025-27633 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comMedium 6.1
The TRMTracker web application is vulnerable to reflected Cross-site scripting attack. The application allows client-side code injection that might be used to compromise the confidentiality and integrity of the system.
Product
TRMTracker
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record publisher.hitachienergy.com
Mar 25, 2025Digital License Manager: Reflected Cross-Site ScriptingCVE-2025-2635 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Digital License Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg() function without appropriate escaping on the URL in all versions up to, and including, 1.7.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Digital License Manager
Affected
up to 1.7.3
What to do
Affects up to 1.7.3. Update Digital License Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 22, 2025Multi Video Box: Reflected Cross-Site ScriptingCVE-2025-2484 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Multi Video Box plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'video_id' and 'group_id' parameters in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Multi Video Box
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update Multi Video Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 22, 2025Gotcha | Gesture-based Captcha: Reflected Cross-Site ScriptingCVE-2025-2482 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Gotcha | Gesture-based Captcha plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'menu' parameter in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Gotcha | Gesture-based Captcha
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Gotcha | Gesture-based Captcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Mar 22, 2025Easy Custom Admin Bar: Reflected Cross-Site ScriptingCVE-2025-2479 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Easy Custom Admin Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘msg’ parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Easy Custom Admin Bar
Affected
up to 1.0
What to do
Affects up to 1.0. Update Easy Custom Admin Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Mar 22, 2025CryoKey: Reflected Cross-Site ScriptingCVE-2025-2477 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The CryoKey plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘ckemail’ parameter in all versions up to, and including, 2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
CryoKey
Affected
up to 2.4
What to do
Affects up to 2.4. Update CryoKey to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Mar 22, 2025Newsletters: Reflected Cross-Site ScriptingCVE-2024-13739 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Newsletters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the "to" parameter in all versions up to, and including, 4.9.9.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an admin user into performing an action such as clicking on a link.
Product
Newsletters
Affected
up to 4.9.9.7
What to do
Affects up to 4.9.9.7. Update Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 21, 2025Improper Neutralization of Input During Web Page Generation Cross-site Scripting vulnerability in Jalios JPlatform 10 allows for Reflected XSS and Stored XSS.ThCVE-2025-25035 · Other software · Jalios · reported by VulnCheckHigh 7.3
Improper Neutralization of Input During Web Page Generation Cross-site Scripting vulnerability in Jalios JPlatform 10 allows for Reflected XSS and Stored XSS.This issue affects JPlatform 10: before 10.0.8 (SP8), before 10.0.7 (SP7), before 10.0.6 (SP6) and Jalios Workplace 6.2, Jalios Workplace 6.1, Jalios Workplace 6.0, and Jalios Workplace 5.3 to 5.5
Product
JPlatform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.jalios.com issues.jalios.com
Mar 21, 2025Reflected Cross-Site Scripting (XSS) in ITIUM 6050 version 5.5.5.2-b3526 from Impact Technologies.CVE-2025-2597 · Other software · Impact Technologies · reported by cve-coordination@incibe.esMedium 5.1
Reflected Cross-Site Scripting (XSS) in ITIUM 6050 version 5.5.5.2-b3526 from Impact Technologies. This vulnerability could allow an attacker to execute malicious Javascript code via GET and POST requests to the ‘/index.php’ endpoint and injecting code into the ‘id_session.
Product
ITIUM 6050
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Mar 20, 2025A reflected cross-site scripting (XSS) vulnerability exists in phpipam/phpipam versions 1.5.0 through 1.6.0.CVE-2024-10727 · Websites & servers · phpipam · reported by security@huntr.devMedium 6.1
A reflected cross-site scripting (XSS) vulnerability exists in phpipam/phpipam versions 1.5.0 through 1.6.0. The vulnerability arises when the application receives data in an HTTP request and includes that data within the immediate response in an unsafe manner. This allows an attacker to execute arbitrary JavaScript in the context of the user's browser, potentially leading to full compromise of the user.
Product
phpipam/phpipam
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.