CVE-2025-8317

The Custom Word Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘angle’ parameter in all versions up to, and including, 0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

CVE-2025-45960

Cross Site Scripting vulnerability in tawk.to Live Chat v.1.6.1 allows a remote attacker to execute arbitrary code via the web application stores and displays user-supplied input without proper input validation or encoding...

i2A-Cronos 跨站脚本漏洞

i2A-Cronos is a sports center management and access control solution from i2A-Cronos. A cross-site scripting vulnerability exists in i2A-Cronos version 23.02.01.17, which originates from stored cross-site scripting and could lead to the execution of malicious code...

CVE-2024-56221

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Elicus WPMozo Addons Lite for Elementor wpmozo-addons-lite-for-elementor allows Stored XSS.This issue affects WPMozo Addons Lite for Elementor: from n/a through = 1.2.0...

CVE-2024-47299

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd coming-soon allows Stored XSS.This issue affects Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: fr...

CVE-2023-52118

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Event Manager WP User Profile Avatar allows Stored XSS.This issue affects WP User Profile Avatar: from n/a through 1.0...

CVE-2020-35946

An issue was discovered in the All in One SEO Pack plugin before 3.6.2 for WordPress. The SEO Description and Title fields are vulnerable to unsanitized input from a Contributor, leading to stored XSS...

CVE-2025-39520

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Wham Checkout Files Upload for WooCommerce checkout-files-upload-woocommerce allows Stored XSS.This issue affects Checkout Files Upload for WooCommerce: from n/a through = 2.2.0...

CVE-2025-31894 WordPress Ebook Downloader plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Infoway LLC Ebook Downloader ebook-downloader allows Stored XSS.This issue affects Ebook Downloader: from n/a through = 1.0...

PT-2025-14132 · Unknown · Dima Take Action

Name of the Vulnerable Software and Affected Versions: Dima Take Action versions 1.0.0 through 1.0.5 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This enables potential attackers to injec...

CVE-2025-22646

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in aThemes aThemes Addons for Elementor allows Stored XSS.This issue affects aThemes Addons for Elementor: from n/a through 1.0.8...

CVE-2025-22640 WordPress Paytm Payment Donation Plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Paytm Paytm Payment Donation allows Stored XSS.This issue affects Paytm Payment Donation: from n/a through 2.3.3...

CVE-2025-24727

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CodePeople Contact Form Email allows Stored XSS. This issue affects Contact Form Email: from n/a through 1.3.52...

PT-2025-5445 · Unknown · Restrict Anonymous Access

Name of the Vulnerable Software and Affected Versions: Restrict Anonymous Access versions 1.2 and earlier Description: The issue is related to improper neutralization of input during web page generation, which can lead to Cross-site Scripting XSS. Specifically, it is a Stored XSS vulnerability...

CVE-2024-12517 WooCommerce Cart Count Shortcode <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

The WooCommerce Cart Count Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cartbutton' shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

CVE-2024-53797

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Beaver Builder Beaver Builder beaver-builder-lite-version allows Stored XSS.This issue affects Beaver Builder: from n/a through = 2.8.4.3...

CVE-2024-48049

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Mighty Plugins Mighty Builder allows Stored XSS.This issue affects Mighty Builder: from n/a through 1.0.2...

CVE-2024-9703 Arconix Shortcodes <= 2.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Arconix Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button' shortcode in all versions up to, and including, 2.1.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

CVE-2024-44001

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in WP Royal Royal Elementor Addons allows Stored XSS.This issue affects Royal Elementor Addons: from n/a through 1.3.982...

PT-2024-30565 · Discourse · Discourse Placeholder Forms

Name of the Vulnerable Software and Affected Versions: Discourse Placeholder Forms affected versions not specified Description: The issue allows the creation of dynamic documentation but is affected by the injection of unsanitized and stored user input into the HTML of a post. This can potentiall...