PT-2025-5223 · Unknown · Enhanced Youtube Shortcode

Name of the Vulnerable Software and Affected Versions: Enhanced YouTube Shortcode versions prior to 2.0.1 le Pixel Solitaire Enhanced YouTube Shortcode versions prior to 2.0.1 Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-si...

PT-2025-5176

Name of the Vulnerable Software and Affected Versions GMap Shortcode versions prior to 2.0 Description The issue is related to improper neutralization of input during web page generation, which allows DOM-Based XSS. This is a type of Cross-site Scripting attack. Recommendations For versions prior...

WordPress plugin GMap Shortcode has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2025-23893: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Manny Costales GMap Shortcode gmap-shortcode allows DOM-Based XSS.This issue affects GMap Shortcode: from n/a through = 2.0...

PT-2025-5123 · WordPress · Easy Shortcode Buttons

Name of the Vulnerable Software and Affected Versions: Easy Shortcode Buttons versions n/a through 1.2 Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that an attacker can inject malicio...

WordPress plugin Twitter Shortcode cross-site request forgeing vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

CVE-2025-23896: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in thom4 Mindmeister Shortcode mindmeister-shortcode allows DOM-Based XSS.This issue affects Mindmeister Shortcode: from n/a through = 1.0...

WordPress plugin PDF.js Shortcode cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerabili...

WordPress plugin Enhanced YouTube Shortcode has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2025-2146 · WordPress · Wp Responsive Tabs

Name of the Vulnerable Software and Affected Versions: WP Responsive Tabs plugin for WordPress versions up to, and including, 1.2.9 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'wprtabs' shortcode due to insufficient input sanitization and output escaping on...

PT-2025-5221

Name of the Vulnerable Software and Affected Versions arul PDF.js Shortcode versions n/a through 1.0 Description The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker can inject malicious...

CVE-2025-23569: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Kelvin Ng Shortcode in Comment shortcode-in-comment allows Stored XSS.This issue affects Shortcode in Comment: from n/a through = 1.1.1...

PT-2025-5091

Name of the Vulnerable Software and Affected Versions RocaPress Horizontal Line Shortcode versions n/a through 1.0 Description The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means an attacker can inject...

PT-2025-5179

Name of the Vulnerable Software and Affected Versions Mindmeister Shortcode versions n/a through 1.0 Description The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting', which allows DOM-Based XSS in Oncle Tom Mindmeister Shortcode...

WordPress plugin Mindmeister Shortcode cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2025-22743

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Mohsin Rasool Twitter Bootstrap Collapse aka Accordian Shortcode twitter-bootstrap-collapse-aka-accordian-shortcode allows DOM-Based XSS.This issue affects Twitter Bootstrap Collapse aka Accordian...

WordPress Motors plugin <= 1.4.43 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Custom Title vulnerability

Authenticated Subscriber+ Arbitrary Shortcode Execution via Custom Title vulnerability discovered by WordFence in WordPress Plugin Motors versions = 1.4.43...

WordPress Contact Form With Shortcode plugin <= 4.2.5 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Le Ngoc Anh Patchstack Alliance in WordPress Plugin Contact Form With Shortcode versions = 4.2.5...

CVE-2024-12593 PDF for WPForms + Drag and Drop Template Builder <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via yeepdf_dotab Shortcode

The PDF for WPForms + Drag and Drop Template Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's yeepdfdotab shortcode in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This...

CVE-2024-12593

CVE-2024-12593 affects the WordPress plugin PDF for WPForms + Drag and Drop Template Builder. It is a Stored Cross-Site Scripting vulnerability in the yeepdf_dotab shortcode caused by insufficient input sanitization and output escaping on user-provided attributes. Impact: authenticated attackers ...