CVE-2025-9853 Optio Dentistry <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Optio Dentistry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'optio-lightbox' shortcode in all versions up to, and including, 2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-9853

Optio Dentistry for WordPress is vulnerable to a Stored Cross-Site Scripting (stored XSS) via the optio-lightbox shortcode in all versions up to 2.2. The root cause is insufficient input sanitization and output escaping on user-supplied attributes, enabling authenticated attackers with contributo...

CVE-2025-9849

The Html Social share buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'zmshbtn' shortcode in all versions up to, and including, 2.1.16 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-9849

The Html Social share buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'zmshbtn' shortcode in all versions up to, and including, 2.1.16 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-6067

Summary: CVE-2025-6067 affects the WordPress plugin “Easy Social Feed – Social Photos Gallery – Post Feed – Like Box” (versions up to 6.6.7). It exposes a stored DOM-based cross-site scripting vulnerability via the data-caption and data-linktext parameters, exploitable by authenticated users with...

CVE-2025-6067 Easy Social Feed – Social Photos Gallery – Post Feed – Like Box <= 6.6.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

The Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-caption and data-linktext parameters in all versions up to, and including, 6.6.7 due to insufficient input sanitization and output escaping. This make...

PT-2025-36346

Name of the Vulnerable Software and Affected Versions: Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin for WordPress versions through 6.6.7 Description: The Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin for WordPress is susceptible to Stored...

PT-2025-36350

Name of the Vulnerable Software and Affected Versions: LA-Studio Element Kit for Elementor plugin for WordPress versions up to and including 1.5.5.1 Description: The LA-Studio Element Kit for Elementor plugin for WordPress is susceptible to Stored Cross-Site Scripting through multiple widgets. Th...

PT-2025-36359

Name of the Vulnerable Software and Affected Versions: SKT Addons for Elementor plugin for WordPress versions prior to 3.8 Description: The SKT Addons for Elementor plugin for WordPress is susceptible to Stored Cross-Site Scripting via multiple widgets due to insufficient input sanitization and...

PT-2025-36358

Name of the Vulnerable Software and Affected Versions: aThemes Addons for Elementor plugin for WordPress versions prior to 1.1.3 Description: The aThemes Addons for Elementor plugin for WordPress is susceptible to Stored Cross-Site Scripting via the Countdown widget. Insufficient input sanitizati...

PT-2025-36360

Name of the Vulnerable Software and Affected Versions: Content Views plugin for WordPress versions prior to 4.2 Description: The Content Views plugin for WordPress is susceptible to Stored Cross-Site Scripting via the plugin's Grid and List widgets. This is due to insufficient input sanitization...

PT-2025-36364

Name of the Vulnerable Software and Affected Versions: Recent Posts Widget Extended plugin for WordPress versions up to and including 2.0.2 Description: The Recent Posts Widget Extended plugin for WordPress is susceptible to Stored Cross-Site Scripting through the plugin’s rpwe shortcode...

PT-2025-36361

Name of the Vulnerable Software and Affected Versions: Smart Table Builder plugin for WordPress versions up to and including 1.0.1 Description: The Smart Table Builder plugin for WordPress is susceptible to Stored Cross-Site Scripting via the id parameter due to insufficient input sanitization an...

PT-2025-36353

Name of the Vulnerable Software and Affected Versions: Html Social share buttons plugin for WordPress versions prior to 2.1.17 Description: The Html Social share buttons plugin for WordPress is susceptible to Stored Cross-Site Scripting through the plugin’s zm sh btn shortcode. Insufficient input...

CVE-2025-9378

The Vayu Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple attributes in the Lottie block in all versions up to, and including, 1.3.9 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-8684 Flatsome <= 3.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Flatsome Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's shortcodes in all versions up to, and including, 3.20.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...

CVE-2025-8684 Flatsome <= 3.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Flatsome Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's shortcodes in all versions up to, and including, 3.20.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...

PT-2025-36323

Name of the Vulnerable Software and Affected Versions: Biagiotti Core plugin for WordPress versions prior to 2.1.4 Description: The Biagiotti Core plugin for WordPress is susceptible to Stored Cross-Site Scripting through shortcodes due to inadequate input sanitization and output escaping of...

PT-2025-36108

Name of the Vulnerable Software and Affected Versions: Flatsome Theme for WordPress versions prior to 3.20.0 Description: The Flatsome Theme for WordPress is susceptible to Stored Cross-Site Scripting through its shortcodes. This is due to inadequate input sanitization and output escaping of...

CVE-2025-9378

The Vayu Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple attributes in the Lottie block in all versions up to, and including, 1.3.9 due to insufficient input sanitization and output escaping. This makes it possible for...