CVE-2026-4074 Quran Live Multilanguage <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Quran Live Multilanguage plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cheikh' and 'lang' shortcode attributes in all versions up to, and including, 1.0.3. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. Th...

CVE-2026-1607

The Surbma | Booking.com Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's surbma-bookingcom shortcode in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...

PT-2026-27301

Name of the Vulnerable Software and Affected Versions LearnDash LMS plugin for WordPress versions prior to 5.0.4 Description The software is susceptible to a blind time-based SQL injection through the filtersorderby order parameter within the 'learndash propanel template' AJAX action. This is a...

WordPress Target Video Easy Publish plugin <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via placeholder_img Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via placeholderimg Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin Target Video Easy Publish versions = 3.8.8...

CVE-2025-12837

The aThemes Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Call To Action widget in versions up to, and including, 1.1.5 due to insufficient input sanitization and output escaping on user-supplied values. This makes it possible for authenticated...

CVE-2025-9131

CVE-2025-9131 (Ogulo – 360° Tour, WordPress) Vulnerability type: Stored Cross-Site Scripting via the slug parameter in all versions up to and including 1.0.11. Exploitation requires authenticated access at Contributor level or higher; attacker can inject scripts that run when pages are viewed by ...

CVE-2025-8719 Translate This - Google Translate Web Element Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via base_lang Parameter

The Translate This gTranslate Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘baselang’ parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-8685

The Wp chart generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpchart shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

WordPress Portfolio – Filterable Masonry Portfolio Gallery for Professionals plugin <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin Portfolio – Filterable Masonry Portfolio Gallery for Professionals versions = 1.2.2...

WordPress The Post Grid plugin <= 7.7.11 - Authenticated (Contributor+) Information Disclosure vulnerability

Authenticated Contributor+ Information Disclosure vulnerability discovered by stealthcopter in WordPress Plugin The Post Grid versions = 7.7.11...

PT-2023-30385 · WordPress · Marco Milesi Anac Xml Bandi Di Gara Plugin

Name of the Vulnerable Software and Affected Versions: Marco Milesi ANAC XML Bandi di Gara plugin versions = 7.5 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attacker to inject malicious scripts into the website, which...

CVE-2023-45059

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Gumroad plugin = 3.1.0 versions...

PT-2023-32122 · WordPress · Geo My Wordpress

Name of the Vulnerable Software and Affected Versions: GEO my WordPress plugin versions up to, and including, 4.0 Description: The issue is related to Stored Cross-Site Scripting via shortcodes due to insufficient input sanitization and output escaping on user-supplied attributes. This allows...

CVE-2023-37983

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Noël Jackson Art Direction plugin = 0.2.4 versions...

PT-2023-19213 · Unknown · Muneeb Layer Slider

Name of the Vulnerable Software and Affected Versions: Muneeb Layer Slider plugin versions = 1.1.9.7 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability allows an attacker to inject malicious scripts into the website, potentially leading to...

CVE-2023-23701

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Andrew @ Geeenville Web Design Easy Sign Up plugin = 3.4.1 versions...

CVE-2023-23889

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Fullworks Quick Paypal Payments plugin = 5.7.25 versions...

CVE-2023-25040

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Vova Anokhin WordPress Shortcodes Plugin — Shortcodes Ultimate plugin = 5.12.6 versions...

CVE-2022-45843

Auth. contributor+ Stored Cross-Site Scripting vulnerability in Nextend Smart Slider 3 plugin = 3.5.1.9 versions...