CVE-2025-3302

The CVE-2025-3302 entry concerns Xagio SEO – AI Powered SEO for WordPress. Affected are all versions up to and including 7.1.0.16, vulnerable to Unauthenticated Stored Cross-Site Scripting via HTTP_REFERER due to insufficient input sanitization and output escaping. The vulnerability was partially...

CVE-2025-4666

The Zotpress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘nickname’ parameter in all versions up to, and including, 7.3.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and...

CVE-2025-4666 ZotPress <= 7.3.15 - Authenticated (Author+) Stored Cross-Site Scripting via 'nickname'

The Zotpress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘nickname’ parameter in all versions up to, and including, 7.3.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and...

CVE-2025-4666

CVE-2025-4666 (Zotpress for WordPress) : Stored Cross-Site Scripting via the nickname parameter affects Zotpress versions up to 7.3.15. Reported as exploitable by authenticated attackers with Author-level access and above. Root cause: insufficient input sanitization/output escaping. Impact: scrip...

CVE-2025-4666 ZotPress <= 7.3.15 - Authenticated (Author+) Stored Cross-Site Scripting via 'nickname'

The Zotpress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘nickname’ parameter in all versions up to, and including, 7.3.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and...

PT-2025-25204 · WordPress · Xagio Seo

Name of the Vulnerable Software and Affected Versions: Xagio SEO – AI Powered SEO plugin for WordPress versions up to, and including, 7.1.0.16 Description: The Xagio SEO – AI Powered SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTTP REFERER parameter due to...

PT-2025-25210 · WordPress · The Events Calendar

Name of the Vulnerable Software and Affected Versions: The Events Calendar plugin for WordPress versions up to, and including, 6.13.2 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping via the data-date- parameters. This...

CVE-2025-4774

The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-countdown attribute of Countdown widget in all versions up to, and including, 4.11.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2025-4577

The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-color attribute in all versions up to, and including, 4.3.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-2918

The Ultimate Blocks – WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-2918

The Ultimate Blocks – WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

BIT-MARIADB-MIN-2020-15180

A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in wsrepsstmethod allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system's confidentiality, integrity, and...

CVE-2025-2918 Ultimate Blocks – WordPress Blocks Plugin <= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

The Ultimate Blocks – WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-4577

The CVE entry CVE-2025-4577 concerns the Smash Balloon Social Post Feed (Custom Facebook Feed) WordPress plugin. Connected sources confirm a Stored Cross-Site Scripting (XSS) vulnerability via the data-color attribute in all versions up to and including 4.3.1, caused by insufficient input sanitiz...

CVE-2025-2918

CVE-2025-2918 — Ultimate Blocks (WordPress Blocks Plugin) is a stored cross-site scripting vulnerability in the plugin for WordPress, exploitable via multiple widgets. Affected versions: up to and including 3.3.3, with the issue caused by insufficient input sanitization and output escaping. Explo...

CVE-2025-4774 Premium Addons for Elementor <= 4.11.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget

The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-countdown attribute of Countdown widget in all versions up to, and including, 4.11.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2025-4774

The CVE-2025-4774 entry concerns the Premium Addons for Elementor WordPress plugin. A Stored Cross-Site Scripting (XSS) flaw exists in the Countdown widget via the data-countdown attribute due to insufficient input sanitization and output escaping. The vulnerability is present in all versions up ...

MainWP: Reflected XSS in "Cost Tracker" Notes Field

The reflected Cross-Site Scripting XSS vulnerability was discovered in the "Notes" input field of the Cost Tracker section in MainWP Version 5.4.0.11. Arbitrary user input in this field was reflected back and executed immediately upon saving, due to the lack of proper input sanitization and outpu...

CVE-2025-3076

The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘buttontext’ parameter in all versions up to, and including, 3.29.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-3076 Elementor Pro <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘buttontext’ parameter in all versions up to, and including, 3.29.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...