Vulnerabilities > Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

DATE	CVE	VULNERABILITY TITLE	RISK
2025-05-30	CVE-2025-5259	The Minimal Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ parameter in all versions up to, and including, 1.7.3 due to insufficient input sanitization and output escaping. network low complexity CWE-79	6.4
2025-05-30	CVE-2025-48483	Cross-site Scripting vulnerability in Freescout FreeScout is a free self-hosted help desk and shared mailbox. network low complexity freescout CWE-79	5.4
2025-05-30	CVE-2025-48484	Cross-site Scripting vulnerability in Freescout FreeScout is a free self-hosted help desk and shared mailbox. network low complexity freescout CWE-79	5.4
2025-05-29	CVE-2025-4670	The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's edd_receipt shortcode in all versions up to, and including, 3.3.8.1 due to insufficient input sanitization and output escaping on user supplied attributes. network low complexity CWE-79	6.4
2025-05-29	CVE-2025-5122	The Map Block Leaflet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. network low complexity CWE-79	6.4
2025-05-29	CVE-2025-5286	The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘additional_settings’ parameter in all versions up to, and including, 5.3.6 due to insufficient input sanitization and output escaping. network low complexity CWE-79	6.4
2025-05-29	CVE-2025-4583	The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-plugin` attribute in all versions up to, and including, 6.9.0 due to insufficient input sanitization and output escaping. network low complexity CWE-79	5.4
2025-05-28	CVE-2025-4963	The WP Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.0.15 due to insufficient input sanitization and output escaping. network low complexity CWE-79	6.4
2025-05-28	CVE-2025-5082	The WP Attachments plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘attachment_id’ parameter in all versions up to, and including, 5.0.12 due to insufficient input sanitization and output escaping. network low complexity CWE-79	6.1
2025-05-27	CVE-2024-45094	IBM DS8900F and DS8A00 Hardware Management Console (HMC) is vulnerable to stored cross-site scripting. network low complexity CWE-79	5.5