PT-2025-7503

Name of the Vulnerable Software and Affected Versions Newpost Catch plugin for WordPress versions up to, and including, 1.3.19 Description The issue is related to Stored Cross-Site Scripting via the plugin's npc shortcode due to insufficient input sanitization and output escaping on user-supplied...

PT-2025-7352

Name of the Vulnerable Software and Affected Versions Autoship Cloud for WooCommerce Subscription Products plugin for WordPress versions up to, and including, 2.8.0 Description The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on...

CVE-2025-1328

The Typed JS: A typewriter style animation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘typespeed’ parameter in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...

CVE-2025-1328 Typed JS: A typewriter style animation <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via typespeed Parameter

The Typed JS: A typewriter style animation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘typespeed’ parameter in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...

PT-2025-7337

Name of the Vulnerable Software and Affected Versions Unlimited Elements For Elementor plugin for WordPress versions up to, and including, 1.5.140 Description The issue is related to Stored Cross-Site Scripting via the plugin's Transparent Split Hero widget due to insufficient input sanitization...

PT-2025-7488

Name of the Vulnerable Software and Affected Versions Login/Signup Popup Inline Form + Woocommerce plugin for WordPress versions up to, and including, 2.8.5 Description The issue concerns a Stored Cross-Site Scripting vulnerability via the plugin's xoo el action shortcode due to insufficient inpu...

PT-2025-7450

Name of the Vulnerable Software and Affected Versions Content Blocks Custom Post Widget plugin for WordPress versions up to, and including, 3.3.5 Description The issue is related to Stored Cross-Site Scripting via the content parameter within the plugin's shortcode Content Block due to insufficie...

CVE-2024-12069

The Lexicata plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.0.16. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute i...

CVE-2024-13462

CVE-2024-13462 (WP Wiki Tooltip, WordPress) : Stored XSS via the wiki shortcode in all versions up to 2.0.2; requires authenticated access at contributor level or higher to inject scripts, which execute when users load the affected pages. Connected data indicates a potential fix in 2.0.3, but ini...

CVE-2024-12069 Lexicata <= 1.0.16 - Reflected Cross-Site Scripting

The Lexicata plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.0.16. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute i...

CVE-2024-13390

The CVE CVE-2024-13390 affects the WordPress plugin 'ADFO – Custom data in admin dashboard' (versions

CVE-2025-1441 Royal Elementor Addons and Templates <= 1.7.1007 - Cross-Site Request Forgery to Reflected Cross-Site Scripting

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.1007. This is due to missing or incorrect nonce validation on the 'wprfilterwooproducts' function. This makes it possible for unauthenticated attacke...

PT-2025-7476

Name of the Vulnerable Software and Affected Versions YaySMTP and Email Logs: Amazon SES, SendGrid, Outlook, Mailgun, Brevo, Google and Any SMTP Service plugin for WordPress versions 2.4.9 through 2.6.2 Description The issue is related to Stored Cross-Site Scripting due to insufficient input...

PT-2025-7385

Name of the Vulnerable Software and Affected Versions Pure Chat – Live Chat & More! plugin for WordPress versions up to, and including, 2.31 Description The issue concerns Stored Cross-Site Scripting via the purechatWidgetName parameter due to insufficient input sanitization and output escaping...

PT-2025-7507

Name of the Vulnerable Software and Affected Versions The Royal Elementor Addons and Templates plugin for WordPress versions up to, and including, 1.7.1007 Description The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the wpr filter woo products...

CVE-2024-13339: Cross-Site Request Forgery (CSRF)

The DeBounce Email Validator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.8.0. This is due to missing or incorrect nonce validation on the 'debounceemailvalidator' page. This makes it possible for unauthenticated attackers to update...

CVE-2025-0521 Post SMTP <= 3.0.2 - Unauthenticated Stored Cross-Site Scripting

The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the from and subject parameter in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2024-13704

CVE-2024-13704 relates to the WordPress plugin Super Testimonials (also listed in Wordfence). It is a stored cross-site scripting (XSS) vulnerability via the st_user_title parameter in all versions up to 4.0.1, caused by insufficient input sanitization and output escaping. The impact is unauthent...

CVE-2024-11376 s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions <= 241216 - Reflected Cross-Site Scripting

The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 241114...

CVE-2024-13581 Simple Charts <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Simple Charts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'simplechart' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...