CVE-2025-6378 Responsive Food and Drink Menu <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via display_pdf_menus Shortcode

The Responsive Food and Drink Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's displaypdfmenus shortcode in all versions up to, and including, 2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

CVE-2025-6538

CVE-2025-6538 affects the WordPress plugin “Post Rating and Review” (all versions ≤ 1.3.4). Root cause: insufficient input sanitization and output escaping in the class parameter, enabling stored XSS. Impact: authenticated attackers with Contributor+ access can inject scripts executed when users ...

CVE-2025-6538 Post Rating and Review <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter

The Post Rating and Review plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2025-5488 WP Masonry & Infinite Scroll <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The WP Masonry & Infinite Scroll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wmis' shortcode in all versions up to, and including, 2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-5488 WP Masonry & Infinite Scroll <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The WP Masonry & Infinite Scroll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wmis' shortcode in all versions up to, and including, 2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-5488

CVE-2025-5488 affects the WordPress plugin WP Masonry & Infinite Scroll. The vulnerability is a Stored Cross-Site Scripting (XSS) in the plugin’s wmis shortcode, present in all versions up to and including 2.2, caused by insufficient input sanitization and output escaping on user-supplied attribu...

CVE-2025-5588 Image Editor by Pixo <= 2.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via download Parameter

The Image Editor by Pixo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘download’ parameter in all versions up to, and including, 2.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-leve...

CVE-2025-5588 Image Editor by Pixo <= 2.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via download Parameter

The Image Editor by Pixo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘download’ parameter in all versions up to, and including, 2.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-leve...

CVE-2025-5535 e.nigma buttons <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

The e.nigma buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button' shortcode in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-5535

CVE-2025-5535 affects the WordPress plugin e.nigma buttons (versions

PT-2025-26928 · WordPress · Countdown

Name of the Vulnerable Software and Affected Versions: Countdown plugin for WordPress versions up to, and including, 2.0.1 Description: The issue is related to Stored Cross-Site Scripting via the clientId parameter due to insufficient input sanitization and output escaping. This allows...

PT-2025-26931 · WordPress · Webcam

Name of the Vulnerable Software and Affected Versions: web-cam plugin for WordPress versions up to, and including, 1.0 Description: The issue is related to Stored Cross-Site Scripting via the slug parameter due to insufficient input sanitization and output escaping. This allows authenticated...

PT-2025-26915 · WordPress · Event Rsvp/Simple Event Management Plugin

Name of the Vulnerable Software and Affected Versions: The Event RSVP and Simple Event Management Plugin versions up to, and including, 4.1.0 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on user-supplied attributes in...

PT-2025-26947 · WordPress · Ultimate Addons For Contact Form 7

Name of the Vulnerable Software and Affected Versions: Ultra Addons for Contact Form 7 plugin for WordPress versions 3.5.11 through 3.5.19 Description: The issue is related to Stored Cross-Site Scripting via the Database module due to insufficient input sanitization and output escaping. The...

PT-2025-26923 · WordPress · Responsive Food/Drink Menu

Name of the Vulnerable Software and Affected Versions: The Responsive Food and Drink Menu plugin for WordPress versions up to, and including, 2.3 Description: The issue is related to Stored Cross-Site Scripting via the plugin's display pdf menus shortcode due to insufficient input sanitization an...

PT-2025-26924 · WordPress · Wp-Photonav

Name of the Vulnerable Software and Affected Versions: WP-PhotoNav plugin for WordPress versions up to, and including, 1.2.2 Description: The issue is related to Stored Cross-Site Scripting via the plugin's photonav shortcode due to insufficient input sanitization and output escaping on...

PT-2025-26921 · WordPress · Wp Soundsystem

Name of the Vulnerable Software and Affected Versions: WP SoundSystem plugin for WordPress versions up to, and including, 3.4.2 Description: The issue is related to Stored Cross-Site Scripting via the plugin's wpsstm-track shortcode due to insufficient input sanitization and output escaping on...

PT-2025-26913 · WordPress · Wp Masonry & Infinite Scroll

Name of the Vulnerable Software and Affected Versions: WP Masonry & Infinite Scroll plugin for WordPress versions up to, and including, 2.2 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'wmis' shortcode due to insufficient input sanitization and output escaping...

PT-2025-26930 · WordPress · Namasha By Mdesign

Name of the Vulnerable Software and Affected Versions: Namasha By Mdesign plugin for WordPress versions up to, and including, 1.2.00 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated attackers wit...

PT-2025-26945 · WordPress · Royal Elementor Addons

Name of the Vulnerable Software and Affected Versions: The Royal Elementor Addons plugin for WordPress versions up to, and including, 1.7.1024 Description: The issue is related to Stored Cross-Site Scripting via multiple widgets due to insufficient input sanitization and output escaping on...