CVE-2024-13586

CVE-2024-13586 (Masy Gallery, WordPress) is a stored cross-site scripting vulnerability in the Masy Gallery plugin for WordPress, exploitable via the justified-gallery shortcode. Affected versions are up to 1.7, with the issue caused by insufficient input sanitization and output escaping on user-...

CVE-2024-13586 Masy Gallery <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Masy Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'justified-gallery' shortcode in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-11825 Broadstreet <= 1.51.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via zone Parameter

The Broadstreet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘zone’ parameter in all versions up to, and including, 1.51.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2024-13458

The CVE-2024-13458 entry concerns the WordPress plugin WordPress SEO Friendly Accordion FAQ with AI assisted content generation (versions

CVE-2024-12529 brodos.net Onlineshop Plugin <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The brodos.net Onlineshop Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'BrodosCategory' shortcode in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

CVE-2024-12512 Ask Me Anything (Anonymously) <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Ask Me Anything Anonymously plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'askmeanythingpeople' shortcode in all versions up to, and including, 1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possib...

CVE-2024-12512

CVE-2024-12512 : The Ask Me Anything (Anonymously) WordPress plugin is affected up to version 1.6 by a Stored Cross‑Site Scripting flaw in the askmeanythingpeople shortcode, enabling authenticated users with contributor+ rights to inject and execute scripts on pages loaded by other users. The iss...

CVE-2024-12816 NOTICE BOARD BY TOWKIR <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The NOTICE BOARD BY TOWKIR plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'notice-board' shortcode in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-10552

The CVE-2024-10552 entry concerns the Flexmls IDX Plugin for WordPress, with a Stored Cross-Site Scripting (XSS) vulnerability in the api_key and api_secret parameters present in all versions up to 3.14.26. The root cause is insufficient input sanitization and output escaping, enabling authentica...

CVE-2024-10552 Flexmls® IDX Plugin <= 3.14.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via API parameters

The Flexmls® IDX Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘apikey’ and 'apisecret' parameters in all versions up to, and including, 3.14.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-13721

CVE-2024-13721 affects the Plethora Plugins Tabs + Accordions WordPress plugin (versions

PT-2025-2224 · WordPress · Masy Gallery

Name of the Vulnerable Software and Affected Versions: Masy Gallery plugin for WordPress versions up to, and including, 1.7 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'justified-gallery' shortcode due to insufficient input sanitization and output escaping on...

PT-2025-1886 · WordPress · Brodos.Net Onlineshop Plugin

Name of the Vulnerable Software and Affected Versions: brodos.net Onlineshop Plugin plugin for WordPress versions up to, and including, 2.0.2 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'BrodosCategory' shortcode due to insufficient input sanitization and...

PT-2025-3845 · WordPress · Divi Carousel Maker

Name of the Vulnerable Software and Affected Versions: Divi Carousel Maker plugin for WordPress versions up to, and including, 2.0.4 Description: The Divi Carousel Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Carousel and Logo Carousel in all...

PT-2025-1695 · WordPress · Broadstreet

Name of the Vulnerable Software and Affected Versions: Broadstreet plugin for WordPress versions up to, and including, 1.50.3 Description: The issue is related to Stored Cross-Site Scripting via the zone parameter due to insufficient input sanitization and output escaping. This allows authenticat...

PT-2025-2214 · WordPress · Power Ups For Elementor

Name of the Vulnerable Software and Affected Versions: Power Ups for Elementor plugin for WordPress versions up to, and including, 1.2.2 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'magic-button' shortcode due to insufficient input sanitization and output...

PT-2025-1593 · Unknown · Flexmls Idx Plugin

Name of the Vulnerable Software and Affected Versions: Flexmls® IDX Plugin versions up to, and including, 3.14.26 Description: The issue is related to Stored Cross-Site Scripting via the api key and api secret parameters due to insufficient input sanitization and output escaping. This allows...

PT-2025-2173 · WordPress · Bilingual Linker

Name of the Vulnerable Software and Affected Versions: Bilingual Linker plugin for WordPress versions up to, and including, 2.4 Description: The issue is related to Stored Cross-Site Scripting, which occurs due to insufficient input sanitization and output escaping. This allows authenticated...

CVE-2024-10324

The RomethemeKit For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.5.2 via the registercontrols function in widgets/offcanvas-rometheme.php. This makes it possible for authenticated attackers, with Contributor-level access a...

CVE-2024-10324

The RomethemeKit For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.5.2 via the registercontrols function in widgets/offcanvas-rometheme.php. This makes it possible for authenticated attackers, with Contributor-level access a...