CVE-2025-8604

CVE-2025-8604 – WP Table Builder vulnerability: Stored Cross-Site Scripting via the wptb shortcode in WordPress Table Plugin versions up to and including 2.0.12, caused by insufficient input sanitization and output escaping on user-supplied attributes. The issue affects authenticated users with c...

CVE-2025-8451

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘data-gallery-items’ parameter in all versions up to, and including, 6.2.2 due to insufficient input sanitization and output escaping. Thi...

CVE-2025-8451 Essential Addons for Elementor – Popular Elementor Templates and Widgets <= 6.2.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'data-gallery-items'

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘data-gallery-items’ parameter in all versions up to, and including, 6.2.2 due to insufficient input sanitization and output escaping. Thi...

CVE-2025-8451

CVE-2025-8451 — The WordPress plugin Essential Addons for Elementor – Popular Elementor Templates & Widgets (Essential Addons for Elementor Lite) is vulnerable to a DOM-based Stored XSS via the data-gallery-items parameter in all versions up to and including 6.2.2. The issue arises from insuffici...

CVE-2025-8867

The Graphina - Elementor Charts and Graphs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple chart widget parameters in version 3.1.3 and below. This is due to insufficient input sanitization and output escaping on user supplied attributes such as chart categories,...

CVE-2025-8867 Graphina - Elementor Charts and Graphs <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Graphina - Elementor Charts and Graphs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple chart widget parameters in version 3.1.3 and below. This is due to insufficient input sanitization and output escaping on user supplied attributes such as chart categories,...

CVE-2025-8867 Graphina - Elementor Charts and Graphs <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Graphina - Elementor Charts and Graphs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple chart widget parameters in version 3.1.3 and below. This is due to insufficient input sanitization and output escaping on user supplied attributes such as chart categories,...

PT-2025-33457 · WordPress · Radius Blocks

Name of the Vulnerable Software and Affected Versions: Radius Blocks plugin for WordPress versions up to and including 2.2.1 Description: The Radius Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the subHeadingTagName parameter due to insufficient input sanitization...

PT-2025-33466 · WordPress · Plugin Readme Parser

Name of the Vulnerable Software and Affected Versions: Plugin README Parser versions up to and including 1.3.15 Description: The Plugin README Parser plugin for WordPress is susceptible to Stored Cross-Site Scripting via the target parameter due to insufficient input sanitization and output...

PT-2025-33467 · WordPress · Inpersttion For Theme

Name of the Vulnerable Software and Affected Versions: Inpersttion For Theme plugin for WordPress versions prior to 1.0 Description: The Inpersttion For Theme plugin for WordPress is susceptible to Remote Code Execution in versions up to and including 1.0 via the theme section shortcode function...

PT-2025-33452 · WordPress · Wp Table Builder +1

Name of the Vulnerable Software and Affected Versions: WP Table Builder – WordPress Table Plugin versions up to and including 2.0.12 Description: The WP Table Builder – WordPress Table Plugin for WordPress is susceptible to Stored Cross-Site Scripting via the plugin’s wptb shortcode due to...

PT-2025-33431 · Elementor +1 · Elementor +1

Name of the Vulnerable Software and Affected Versions: Graphina - Elementor Charts and Graphs plugin for WordPress versions 3.1.3 and below Description: The Graphina - Elementor Charts and Graphs plugin for WordPress is susceptible to Stored Cross-Site Scripting through multiple chart widget...

PT-2025-33448 · WordPress +1 · Essential Addons For Elementor +1

Name of the Vulnerable Software and Affected Versions: Essential Addons for Elementor versions up to and including 6.2.2 Description: The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the...

PT-2025-33461 · WordPress · Gestion De Tarifs

Name of the Vulnerable Software and Affected Versions: Gestion de tarifs plugin for WordPress versions prior to 1.5 Description: The Gestion de tarifs plugin for WordPress is vulnerable to SQL Injection via the tarif and intitule shortcodes due to insufficient escaping on user-supplied parameters...

CVE-2025-8874

The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 2.0.8.6 due to insufficient input sanitization and output...

CVE-2025-8621

The Mosaic Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘c’ parameter in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access an...

CVE-2025-8690

The Simple Responsive Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inje...

CVE-2025-8462

The RT Easy Builder – Advanced addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the social URL parameter in all versions up to, and including, 2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2025-8688

The Inline Stock Quotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's stock shortcode in all versions up to, and including, 0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-8568

The GMap Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘h’ parameter in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...