CVE-2024-12851: Improper Neutralization of Input During Web Page Generation

The Element Pack Elementor Addons Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customattributes parameter of the Cookie Consent Widget in all versions up to, and including, 5.10.14 due to...

PT-2025-1965 · WordPress · Element Pack Elementor Addons

Name of the Vulnerable Software and Affected Versions: Element Pack Elementor Addons versions up to, and including, 5.10.14 Description: The issue concerns a Stored Cross-Site Scripting vulnerability in the Element Pack Elementor Addons plugin for WordPress. This vulnerability is due to...

PT-2025-3733 · WordPress · Piotnet Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Piotnet Addons For Elementor plugin for WordPress versions up to, and including, 2.4.31 Description: The issue is related to Stored Cross-Site Scripting via the plugin's Heading widget due to insufficient input sanitization and output escapin...

CVE-2024-12205: Improper Neutralization of Input During Web Page Generation

The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the TF E Slider Widget in all versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2025-3292 · Huawei · Emui +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue concerns improper access control in the home screen widget module. Successful exploitation of this vulnerability may affect availability. Ther...

PT-2025-3281 · Unknown · Widget Framework Module

Name of the Vulnerable Software and Affected Versions: Widget framework module affected versions not specified Description: The issue concerns a vulnerability of input parameters not being verified in the widget framework module. Successful exploitation of this vulnerability may affect...

CVE-2024-56437: Improper Input Validation

Vulnerability of input parameters not being verified in the widget framework module Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2024-56448: Improper Control of Generation of Code

Vulnerability of improper access control in the home screen widget module Impact: Successful exploitation of this vulnerability may affect availability...

WordPress News Ticker Widget for Elementor plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara Kinorth in WordPress Plugin News Ticker Widget for Elementor versions = 1.3.2...

CVE-2025-22520

Cross-Site Request Forgery CSRF vulnerability in Tock Tock Widget tock-widget allows Cross Site Request Forgery.This issue affects Tock Widget: from n/a through = 1.1...

CVE-2025-22515 WordPress Show Google Analytics widget plugin <= 1.5.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Simon Chuang Show Google Analytics widget allows Stored XSS.This issue affects Show Google Analytics widget: from n/a through 1.5.4...

CVE-2025-22520

CVE-2025-22520 – Tock Widget CSRF (Cross-Site Request Forgery) Connected sources confirm a CSRF vulnerability affecting the Tock Widget (Tock Widget,

CVE-2025-22520 WordPress Tock Widget Plugin <= 1.1 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Tock Tock Widget tock-widget allows Cross Site Request Forgery.This issue affects Tock Widget: from n/a through = 1.1...

CVE-2025-22520 WordPress Tock Widget Plugin <= 1.1 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Tock Tock Widget tock-widget allows Cross Site Request Forgery.This issue affects Tock Widget: from n/a through = 1.1...

WordPress Axact Author List Widget Plugin <= 3.1.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin KNR Author List Widget versions = 3.1.1...

WordPress Tock Widget Plugin <= 1.1 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by 0xd4rk5id3 Patchstack Alliance in WordPress Plugin Tock Widget versions = 1.1...

WordPress Featured Page Widget Plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Featured Page Widget versions = 2.2...

WordPress Category Posts Widget plugin < 4.9.18 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Category Posts Widget versions 4.9.18...

WordPress Toggles Shortcode and Widget plugin <= 1.14 - Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting vulnerability discovered by Yamil in WordPress Plugin Toggles Shortcode and Widget versions = 1.14...

CVE-2024-9638

The Category Posts Widget WordPress plugin before 4.9.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...