CVE-2024-13667

The Uncode theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mle-description’ parameter in all versions up to, and including, 2.9.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level acces...

CVE-2024-13691

The Uncode theme for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'uncoderecordMedia' function in all versions up to, and including, 2.9.1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read arbitrary...

CVE-2025-0866

The Legoeso PDF Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘checkedVals’ parameter in all versions up to, and including, 1.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes i...

CVE-2024-13802

The Bandsintown Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bandsintownevents' shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-1328 Typed JS: A typewriter style animation <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via typespeed Parameter

The Typed JS: A typewriter style animation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘typespeed’ parameter in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...

CVE-2025-1328

CVE-2025-1328 refers to the Typed JS WordPress plugin vulnerability: a stored XSS via the typespeed parameter in the plugin’s code. The issue affects all versions up to 1.2.0 and can be exploited by authenticated users with Contributor-level access or higher to inject scripts that execute when pa...

CVE-2025-1328 Typed JS: A typewriter style animation <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via typespeed Parameter

The Typed JS: A typewriter style animation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘typespeed’ parameter in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...

CVE-2024-13802

CVE-2024-13802 – Bandsintown Events plugin for WordPress : All versions up to 1.3.1 are affected by a Stored XSS in the bandsintown_events shortcode due to insufficient input sanitization and output escaping. Exploitation requires authenticated access at contributor level or higher, enabling inje...

CVE-2024-13855 Prime Addons for Elementor <= 2.0.1 - Authenticated (Contributor+) Insecure Direct Object Reference via pae_global_block Shortcode

The Prime Addons for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.1 via the paeglobalblock shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

CVE-2024-13855

CVE-2024-13855 affects Prime Addons for Elementor (WordPress) via Insecure Direct Object Reference in pae_global_block. From Wordfence data: all versions up to 2.0.1 are vulnerable; exploitation requires authenticated access at Contributor level or higher to extract information from non-public po...

CVE-2025-0866

The CVE-2025-0866 entry concerns Legoeso PDF Manager for WordPress. The vulnerability is a time-based SQL Injection in the checkedVals parameter, affecting all versions up to 1.2.2. It requires authenticated access at Author level or higher and enables an attacker to append SQL queries to existin...

CVE-2024-13748 Ultimate Classified Listings <= 1.4 Authenticated (Administrator+) Stored Cross-Site Scripting via Title Parameter

The Ultimate Classified Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Title parameter in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-11895

The Online Payments – Get Paid with PayPal, Square & Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.20.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes...

CVE-2024-13465

The aBlocks – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "Table Of Content" Block, specifically in the "markerView" attribute, in all versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping. This mak...

CVE-2024-13575

The Web Stories Enhancer – Level Up Your Web Stories plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'webstoriesenhancer' shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes...

CVE-2025-0897

The CVE CVE-2025-0897 affects the WordPress plugin “Modal Window – create popup modal window” and is a stored Cross-Site Scripting flaw exposed through the iframeBox shortcode in versions up to 6.1.5. The issue stems from insufficient input sanitization and output escaping of user-provided attrib...

CVE-2025-0897 Modal Window <= 6.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via iframeBox Shortcode

The Modal Window – create popup modal window plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'iframeBox' shortcode in all versions up to, and including, 6.1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2025-1064

The CVE-2025-1064 issue affects the WordPress plugin Login/Signup Popup (Inline Form + Woocommerce). It enables Stored XSS via the xoo_el_action shortcode due to insufficient input sanitization/output escaping on user-supplied attributes. Vulnerable versions include all up to 2.8.5. Attack scenar...

CVE-2024-13155

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Transparent Split Hero widget in all versions up to, and including, 1.5.140 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2024-13155

CVE-2024-13155 affects Unlimited Elements For Elementor (WordPress) up to version 1.5.140, with a Stored XSS via the Transparent Split Hero widget. Exploitation requires authenticated access (contributor+); an attacker can inject scripts that run when users load injected pages. Patch guidance fro...