WordPress Plugin Shortcode Generator Cross-Site Script Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-43036

Name of the Vulnerable Software and Affected Versions This-or-That plugin for WordPress versions prior to 1.0.5 Description The This-or-That plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'thisorthat' shortcode. Insufficient input sanitization and output escaping o...

PT-2025-43038

Name of the Vulnerable Software and Affected Versions Mixlr Shortcode versions up to and including 1.0.1 Description The Mixlr Shortcode plugin for WordPress has a Stored Cross-Site Scripting issue through the 'mixlr' shortcode. This is caused by inadequate input sanitization and output escaping ...

CVE-2025-11830: Improper Neutralization of Input During Web Page Generation

The WP Restaurant Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' parameter of the restaurantsummary shortcode in all versions up to, and including, 1.0.2. This is due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2025-43052

Name of the Vulnerable Software and Affected Versions Bg Book Publisher versions prior to 1.26 Description The Bg Book Publisher plugin for WordPress is susceptible to Stored Cross-Site Scripting through the book author post meta, which is rendered using the book author shortcode. The plugin does...

CVE-2025-10138: Improper Neutralization of Input During Web Page Generation

The This-or-That plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'thisorthat' shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-11810: Improper Neutralization of Input During Web Page Generation

The Print Button Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'print-button' shortcode in all versions up to, and including, 1.0.1. This is due to insufficient input sanitization and output escaping on the 'target' attribute. This makes it possible for...

WordPress plugin Simple YouTube Shortcode has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin... A cross-site scripti...

CVE-2025-11811: Improper Neutralization of Input During Web Page Generation

The Simple Youtube Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'embedyoutube' shortcode in all versions up to, and including, 1.1.3. This is due to insufficient input sanitization and output escaping on the 'id' attribute. This makes it possible for...

CVE-2025-11817: Improper Neutralization of Input During Web Page Generation

The Simple Tableau Viz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tableau' shortcode in all versions up to, and including, 2.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

WordPress Print Button Shortcode plugin <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by zakaria in WordPress Plugin Print Button Shortcode versions = 1.0.1...

WordPress plugin Mixlr Shortcode cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plug-in. A cross-site scriptin...

PT-2025-43053

Name of the Vulnerable Software and Affected Versions Simple Business Data plugin for WordPress versions up to and including 1.0.1 Description The Simple Business Data plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'simple business data' shortcode attributes. The...

CVE-2025-11807: Improper Neutralization of Input During Web Page Generation

The Mixlr Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mixlr' shortcode in all versions up to, and including, 1.0.1. This is due to insufficient input sanitization and output escaping on the 'url' attribute. This makes it possible for authenticated attacker...

PT-2025-43206

Name of the Vulnerable Software and Affected Versions Shortcode Generator versions through 1.1 Description The software contains a flaw related to improper input handling during web page creation, which allows for Reflected Cross-site Scripting XSS. This means that malicious code can be injected...

CVE-2025-11870: Improper Neutralization of Input During Web Page Generation

The Simple Business Data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'simplebusinessdata' shortcode attributes in all versions up to, and including, 1.0.1. This is due to the plugin not properly sanitizing user input or escaping output when embedding the type attribute...

PT-2025-43041

Name of the Vulnerable Software and Affected Versions Simple Youtube Shortcode plugin for WordPress versions up to and including 1.1.3 Description The Simple Youtube Shortcode plugin for WordPress is susceptible to Stored Cross-Site Scripting through the embed youtube shortcode. This is a result ...

WordPress plugin “Print Button Shortcode” cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2025-11872: Improper Neutralization of Input During Web Page Generation

The Material Design Iconic Font Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mdiconic' shortcode in all versions up to, and including, 2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...

CVE-2025-11804: Improper Neutralization of Input During Web Page Generation

The JB News Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute of the 'jbticker' shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated...