CVE-2026-2029

The CVE-2026-2029 entry describes a Stored XSS in the Livemesh Addons for Beaver Builder WordPress plugin, affecting all versions up to 3.9.2. The root cause is improper input sanitization: the shortcode attribute values in [labb_pricing_item] (title and value) are sanitized with wp_kses_post(), ...

PT-2026-22092

The Livemesh Addons for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the labb pricing item shortcode's title and value attributes in all versions up to, and including, 3.9.2 due to insufficient input sanitization and output escaping. Specifically, the plugi...

PT-2025-2203

Name of the Vulnerable Software and Affected Versions Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress versions up to and including 3.3.2 Description The issue is related to Stored Cross-Site Scripting via the Title value due to insufficient input...

CVE-2024-13517: Improper Neutralization of Input During Web Page Generation

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Title value in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2022-2516: Improper Neutralization of Input During Web Page Generation

The Visual Composer Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post/page 'Title' value in versions up to, and including, 45.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with access t...