25024 matches found
CVE-2025-7502 WPBakery Page Builder for WordPress <= 8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
The WPBakery Page Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several shortcodes in all versions up to, and including, 8.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...
CVE-2025-6690
CVE-2025-6690: WP Tournament Registration (WordPress) is affected by a Stored Cross-Site Scripting via the field parameter in versions up to and including 1.3.0. Authenticated attackers with Contributor-level access or higher can inject scripts that run in pages viewed by other users. Connected s...
CVE-2025-6690 WP Tournament Registration <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via field Parameter
The WP Tournament Registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘field’ parameter in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2025-6256
Flex Guten — Multile Blocks (WordPress plugin) versions up to 1.2.5 are affected by Stored Cross-Site Scripting via the thumbnailHoverEffect parameter, caused by insufficient input sanitization and output escaping. Exploitation requires Contributor-level access or higher from authenticated users,...
CVE-2025-6256 Flex Guten <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via thumbnailHoverEffect Parameter
The Flex Guten plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘thumbnailHoverEffect’ parameter in all versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2025-6256 Flex Guten <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via thumbnailHoverEffect Parameter
The Flex Guten plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘thumbnailHoverEffect’ parameter in all versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2025-6259
The CVE-2025-6259 entry refers to a stored XSS vulnerability in the WordPress esri-map-view plugin (
Cross-site Scripting (XSS)
Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper input sanitization in the Conversation Messages Dashboard page. An attacker can execute arbitrary scripts in the context of a user's browser by...
PT-2025-32032 · WordPress · Esri-Map-View
Name of the Vulnerable Software and Affected Versions: esri-map-view plugin for WordPress versions through 1.2.3 Description: The esri-map-view plugin for WordPress is susceptible to Stored Cross-Site Scripting through the plugin’s esri-map-view shortcode. Insufficient input sanitization and outp...
PT-2025-32099 · WordPress · Elementskit Elementor Addons/Templates
Name of the Vulnerable Software and Affected Versions: Element Pack Elementor Addons and Templates versions through 8.1.5 Description: The Element Pack Elementor Addons and Templates plugin for WordPress is susceptible to Stored Cross-Site Scripting due to insufficient input sanitization and outp...
PT-2025-32031 · WordPress · Flex Guten
Name of the Vulnerable Software and Affected Versions: Flex Guten plugin for WordPress versions up to and including 1.2.5 Description: The Flex Guten plugin for WordPress is susceptible to Stored Cross-Site Scripting via the thumbnailHoverEffect parameter due to insufficient input sanitization an...
PT-2025-32033 · WordPress · Wp Tournament Registration
Name of the Vulnerable Software and Affected Versions: WP Tournament Registration versions prior to 1.3.1 Description: The WP Tournament Registration plugin for WordPress is susceptible to Stored Cross-Site Scripting via the field parameter due to insufficient input sanitization and output...
PT-2025-32098 · WordPress +1 · Exclusive Addons For Elementor +1
Name of the Vulnerable Software and Affected Versions: Exclusive Addons for Elementor versions up to and including 2.7.9.4 Description: The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting through the Countdown Widget due to insufficient input...
PT-2025-32118 · WordPress · Gutenverse
Name of the Vulnerable Software and Affected Versions: Gutenverse versions up to and including 3.1.0 Description: The Gutenverse plugin for WordPress is susceptible to Stored Cross-Site Scripting through the plugin’s Animated Text and Fun Fact blocks. Insufficient input sanitization and output...
WordPress plugin esri-map-view 跨站脚本漏洞
WordPress esri-map-view is used to embed Esri/ArcGIS maps or scenes in websites. The plugin realizes map display through short code, supports selecting base map, setting initial view angle, adding custom layers, pop-up information window and other functions, and can embed preconfigured web maps o...
PT-2025-32097 · WordPress · Betheme
Name of the Vulnerable Software and Affected Versions: Betheme theme for WordPress versions prior to 28.1.4 Description: The Betheme theme for WordPress is susceptible to Stored Cross-Site Scripting through an Elementor display setting. Insufficient input sanitization and output escaping allows...
CVE-2025-8295
The Employee Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccessmsg’ parameter in all versions up to, and including, 4.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-lev...
CVE-2025-8294
The Download Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access a...
CVE-2025-8294 Download Counter <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via name Parameter
The Download Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access a...