PT-2025-1883 · WordPress · Clinked Client Portal

Name of the Vulnerable Software and Affected Versions: Clinked Client Portal plugin for WordPress versions up to, and including, 1.9 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'clinked-login-button' shortcode due to insufficient input sanitization and output...

Cross-site Scripting (XSS)

YesWiki is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper validation in the attach component, where a non-existing resource in the file attribute generates a file upload button, allowing authenticated users with edit or comment permissions to inject malicious scripts...

CVE-2024-13548

The Power Ups for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'magic-button' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-13548 Power Ups for Elementor <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Power Ups for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'magic-button' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-24738

Cross-Site Request Forgery CSRF vulnerability in Jerry Rietveld Call Now Button call-now-button allows Cross Site Request Forgery.This issue affects Call Now Button: from n/a through = 1.4.13...

CVE-2025-24713

Cross-Site Request Forgery CSRF vulnerability in Wow-Company Button Generator – easily Button Builder button-generation allows Cross Site Request Forgery.This issue affects Button Generator – easily Button Builder: from n/a through = 3.1.1...

CVE-2025-24738 WordPress Call Now Button plugin <= 1.4.13 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Jerry Rietveld Call Now Button call-now-button allows Cross Site Request Forgery.This issue affects Call Now Button: from n/a through = 1.4.13...

CVE-2025-24738

CVE-2025-24738 is a CSRF vulnerability in the WordPress Call Now Button plugin (versions

CVE-2025-24713 WordPress Button Generator – easily Button Builder Plugin <= 3.1.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Wow-Company Button Generator – easily Button Builder button-generation allows Cross Site Request Forgery.This issue affects Button Generator – easily Button Builder: from n/a through = 3.1.1...

CVE-2025-24713

CVE-2025-24713 is a CSRF vulnerability in the WordPress plugin “Button Generator – easily Button Builder” (Wow-Company Button Generator). Public details indicate the issue affects versions up to 3.1.1 (vulnerability range: n/a through 3.1.1) and is classified as Cross-Site Request Forgery. The CV...

WordPress Call Now Button plugin <= 1.4.13 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin Call Now Button versions = 1.4.13...

WordPress Button Generator – easily Button Builder Plugin <= 3.1.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Khang Duong in WordPress Plugin Button Generator – easily Button Builder versions = 3.1.1...

CVE-2025-23839

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Asif Shakeel Sticky Button sticky-chat-button allows Stored XSS.This issue affects Sticky Button: from n/a through = 1.0...

CVE-2025-23839

CVE-2025-23839 is a Stored XSS vulnerability affecting the WordPress Sticky Button plugin, specifically the NotFound Sticky Button variant, with versions n/a through 1.0. The issue stems from improper input neutralization during web page generation, enabling stored cross-site scripting as describ...

CVE-2025-23839 WordPress Sticky Button plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Asif Shakeel Sticky Button sticky-chat-button allows Stored XSS.This issue affects Sticky Button: from n/a through = 1.0...

CVE-2025-23839 WordPress Sticky Button plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Asif Shakeel Sticky Button sticky-chat-button allows Stored XSS.This issue affects Sticky Button: from n/a through = 1.0...

WordPress plugin Button Generator – easily Button Builder 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress plugin Button Generator - easily...

PT-2025-5527 · Unknown · Button Generator

Name of the Vulnerable Software and Affected Versions: Button Generator – easily Button Builder versions n/a through 3.1.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. This means an attacker can trick a user into performing...

PT-2025-5550 · Unknown · Call Now Button

Name of the Vulnerable Software and Affected Versions: Call Now Button versions 1.4.13 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the Call Now Button, allowing unauthorized requests. The estimated number of potentially affected devices is not specified. There is no...

WordPress plugin Call Now Button 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...