CVE-2025-14040

The Automotive Car Dealership Business WordPress Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Call to Action' custom fields in all versions up to, and including, 13.4. This is due to insufficient input sanitization and output escaping on user-supplied attributes in th...

CVE-2025-15491

The Post Slides WordPress plugin through 1.0.1 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as with contributor or higher roles to perform LFI attacks...

PT-2025-50806

The Simple post listing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class name' parameter in the postlist shortcode in all versions up to, and including, 0.2. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This makes ...

EUVD-2025-201519

The Extra Post Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the extra-images shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...

CVE-2025-8427

The Beaver Builder Plugin Starter Version plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘autoplay’ parameter in all versions up to, and including, 2.9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...

CVE-2023-5335

The Buzzsprout Podcasting plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'buzzsprout' shortcode in versions up to, and including, 1.8.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers...

PT-2022-16336 · WordPress · Lana Downloads Manager

Name of the Vulnerable Software and Affected Versions: Lana Downloads Manager WordPress plugin versions prior to 1.8.0 Description: The issue allows for an arbitrary file download, which can be exploited by users with Contributor permissions or higher. Recommendations: For versions prior to 1.8.0...

CVE-2022-33191: Improper Neutralization of Input During Web Page Generation

Authenticated contributor or higher user role Stored Cross-Site Scripting XSS vulnerability in Chinmoy Paul's Testimonials plugin = 3.0.1 at WordPress...

CVE-2022-28612: Improper Access Control

Improper Access Control vulnerability leading to multiple Authenticated contributor or higher user role Stored Cross-Site Scripting XSS vulnerabilities in Muneeb's Custom Popup Builder plugin = 1.3.1 at WordPress...

CVE-2022-29406: Improper Neutralization of Input During Web Page Generation

Multiple Authenticated contributor or higher user role Stored Cross-Site Scripting XSS vulnerabilities in DynamicWebLab's WordPress Team Manager plugin = 1.6.9 at WordPress...

CVE-2022-29443: Improper Neutralization of Input During Web Page Generation

Multiple Authenticated contributor or higher user role Stored Cross-Site Scripting XSS vulnerabilities in Nicdark's Hotel Booking plugin = 3.0 at WordPress...

CVE-2022-29440: Improper Neutralization of Input During Web Page Generation

Multiple Authenticated contributor or higher user role Stored Cross-Site Scripting XSS vulnerabilities in Promotion Slider plugin = 3.3.4 at WordPress...

CVE-2022-29426: Improper Neutralization of Input During Web Page Generation

Authenticated contributor or higher user role Reflected Cross-Site Scripting XSS vulnerability in 2J Slideshow Team's Slideshow, Image Slider by 2J plugin = 1.3.54 at WordPress...

CVE-2022-29449: Improper Neutralization of Input During Web Page Generation

Authenticated contributor or higher user role Stored Cross-Site Scripting XSS vulnerability in Opal Hotel Room Booking plugin = 1.2.7 at WordPress...