PT-2025-50854

The Category Dropdown List plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $ SERVER'PHP SELF' variable in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2025-58239

CVE-2025-58239 describes a stored cross-site scripting vulnerability in the WordPress plugin “Category Dropdown” (WP Category Dropdown) by GCS Design, affecting versions up to 1.9 (input handling during web page generation is not properly neutralized). The CVE entry notes stored XSS as the vulner...

WordPress Country State City Dropdown CF7 plugin <= 2.7.2 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Krzysztof Zając in WordPress Plugin Country State City Dropdown CF7 versions = 2.7.2...

CVE-2021-38353 Dropdown and scrollable Text <= 2.0 Reflected Cross-Site Scripting

The Dropdown and scrollable Text WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the content parameter found in the /index.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0...