CVE-2025-9490

The Popup Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 1.20.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access an...

CVE-2025-8200

The Mega Elements – Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown Timer widget in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2025-8906

The Widgets for Tiktok Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'trustindex-feed' shortcode in all versions up to, and including, 1.7.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-8200

CVE-2025-8200 affects Mega Elements – Addons for Elementor (WordPress): Stored Cross-Site Scripting via the Countdown Timer widget in all versions up to 1.3.2, caused by insufficient input sanitization and output escaping on user-supplied attributes. Exploitation requires at least contributor-lev...

CVE-2025-10178

CVE-2025-10178 is a stored XSS vulnerability in the CM Business Directory WordPress plugin, exploitable via the plugin shortcode cmbd_featured_image on pages. Affected versions are all up to and including 1.5.2. The issue arises from insufficient input sanitization and output escaping on user-sup...

CVE-2025-8906

CVE-2025-8906 affects the WordPress plugin Widgets for Tiktok Feed (Widgets for TikTok Feed) up to version 1.7.3, enabling Stored XSS via the trustindex-feed shortcode. Exploitation requires attacker with contributor-level access or higher to inject script that runs in pages viewed by users. Word...

PT-2025-39474

Name of the Vulnerable Software and Affected Versions CM Business Directory plugin for WordPress versions up to and including 1.5.2 Description The CM Business Directory plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'cmbd featured image' shortcode. This is due to...

PT-2025-39514

Name of the Vulnerable Software and Affected Versions TweetThis Shortcode plugin for WordPress versions prior to 1.8.1 Description The TweetThis Shortcode plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'tweetthis' shortcode. Insufficient input sanitization and outp...

PT-2025-39480

Name of the Vulnerable Software and Affected Versions Widgets for Tiktok Feed plugin for WordPress versions up to and including 1.7.3 Description The Widgets for Tiktok Feed plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'trustindex-feed' shortcode. This is due to...

PT-2025-39516

Name of the Vulnerable Software and Affected Versions Markdown Shortcode plugin for WordPress versions prior to 0.2.2 Description The Markdown Shortcode plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'markdown' shortcode. Insufficient input sanitization and output...

CVE-2025-9353

The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 7.6.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access an...

CVE-2025-8902

The Widget Options - Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dosidebar' shortcode in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-9353

The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 7.6.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access an...

CVE-2025-9353

The CVE CVE-2025-9353 affects the WordPress Themify Builder plugin up to version 7.6.9, where a Stored Cross-Site Scripting (XSS) flaw exists in multiple parameters due to insufficient input sanitization and output escaping. Exploitation requires authenticated access at Contributor level or highe...

CVE-2025-9541

The Markup Markdown WordPress plugin before 3.20.10 allows links to contain JavaScript which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

PT-2025-39245

Name of the Vulnerable Software and Affected Versions Themify Builder plugin for WordPress versions prior to 7.6.9 Description The software contains a Stored Cross-Site Scripting issue due to insufficient input sanitization and output escaping. This allows authenticated attackers with...

CVE-2025-8902

The Widget Options - Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dosidebar' shortcode in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-8902 Widget Options - Extended <= 5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Widget Options - Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dosidebar' shortcode in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2025-39113

Name of the Vulnerable Software and Affected Versions Widget Options - Extended plugin for WordPress versions prior to 5.2.2 Description The software is susceptible to Stored Cross-Site Scripting through the 'do sidebar' shortcode due to inadequate input sanitization and output escaping of...

CVE-2025-9541 Markup Markdown < 3.20.10 - Contributor+ Stored XSS

The Markup Markdown WordPress plugin before 3.20.10 allows links to contain JavaScript which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...