Skip to content
OpenAdvisories

Vendor

xavinnydek

2 known vulnerabilities.

Products

Xavin's Review Ratings 1 Xavin's List Subpages 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.4
    CVE-2025-4220

    Xavin's List Subpages <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Xavin&#039;s List Subpages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'xls' shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes.…

    xavinnydek Xavin&#039;s List Subpages Web / CMS
  • Medium 6.4
    CVE-2025-4170

    Xavin's Review Ratings <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Xavin&#039;s Review Ratings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'xrr' shortcode in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping on user supplied attribut…

    xavinnydek Xavin&#039;s Review Ratings Web / CMS