CVE-2026-107098

The Royal Addons for Elementor WordPress plugin, in versions before 1.7.1070 , is vulnerable to Stored Cross-Site Scripting (XSS) . The issue stems from a failure to properly sanitise and escape size settings within one of its map widgets before they are concatenated into an HTML attribute . This...

CVE-2026-107098 Royal Elementor Addons 1.7.1037 - 1.7.1069 - Contributor+ Stored XSS via Google Maps Widget Height Setting

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not sanitise and escape one of its map widget's size settings before concatenating it into an HTML attribute, allowing users with the Contributor role or above to inject JavaScript that runs in the browser of any user who views...

WordPress Royal Elementor Addons and Template plugin <= 1.7.1001 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Google Maps Widget vulnerability

Authenticated Contributor+ DOM-Based Stored Cross-Site Scripting via Google Maps Widget vulnerability discovered by zer0gh0st in WordPress Plugin Royal Elementor Addons versions = 1.7.1001...

EUVD-2025-31687

Malicious code in bioql PyPI...

EUVD-2024-49696

Malicious code in bioql PyPI...

EUVD-2024-46525

Malicious code in bioql PyPI...

EUVD-2023-24101

Malicious code in bioql PyPI...

EUVD-2025-27647

Malicious code in bioql PyPI...

CVE-2025-8624

The Nexa Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Google Maps widget in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-8624

The Nexa Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Google Maps widget in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-8624 Nexa Blocks <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps Widget

The Nexa Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Google Maps widget in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-8624 Nexa Blocks <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps Widget

The Nexa Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Google Maps widget in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-8624: Improper Neutralization of Input During Web Page Generation

The Nexa Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Google Maps widget in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

PT-2025-39944

Name of the Vulnerable Software and Affected Versions Nexa Blocks plugin for WordPress versions prior to 1.1.1 Description The Nexa Blocks plugin for WordPress is susceptible to Stored Cross-Site Scripting through the Google Maps widget. This is due to inadequate input sanitization and output...

CVE-2025-8689

The Elements Plus! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Comparison, HotSpot Plus, and Google Maps widgets in all versions up to, and including, 2.16.4 due to insufficient input sanitization and output escaping on user supplied attributes. This...

CVE-2025-8689

CVE-2025-8689 : Elements Plus! for WordPress is vulnerable to Stored Cross‑Site Scripting in versions up to 2.16.4 via the plugin’s Image Comparison, HotSpot Plus, and Google Maps widgets. An authenticated attacker with contributor+ privileges can inject scripts that execute when users load an in...

CVE-2025-7845 Stratum – Elementor Widgets <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Google Maps and Image Hotspot Widgets

The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Advanced Google Maps and Image Hotspot widgets in all versions up to, and including, 1.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. Thi...

CVE-2025-4944

CVE-2025-4944 covers the LA-Studio Element Kit for Elementor WordPress plugin. It is vulnerable to stored XSS in all versions up to 1.5.2 via Image Compare and Google Maps widgets due to insufficient input sanitization and output escaping on user-supplied attributes. The vulnerability allows auth...

CVE-2024-5289

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps widget parameters in all versions up to, and including, 3.2.42 due to insufficient input sanitization and output escaping. This makes it possibl...

CVE-2024-9059

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps widget in all versions up to, and including, 1.7.1001 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...