CVE-2025-1703 Ultimate Blocks <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via content Parameter

The Ultimate Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘content’ parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level acce...

CVE-2025-1439

CVE-2025-1439 — The WordPress plugin Advanced iFrame is vulnerable to a Stored Cross-Site Scripting (XSS) condition through the host header and the plugin’s advanced_iframe/src attributes in versions up to and including 2024.5. Exploitation requires authentication at contributor level or higher, ...

CVE-2025-2167

CVE-2025-2167 pertains to the WordPress plugin Event post. It enables a Stored Cross-Site Scripting (XSS) via the plugin’s events_list shortcode in all versions up to and including 5.9.9, due to insufficient input sanitization and output escaping on user-supplied attributes. The vulnerability req...

PT-2025-12859

Name of the Vulnerable Software and Affected Versions The Spectra – WordPress Gutenberg Blocks plugin versions up to, and including, 2.19.0 Description The issue is related to Stored Cross-Site Scripting via the uagb block due to insufficient input sanitization and output escaping. This allows...

PT-2025-12872

Name of the Vulnerable Software and Affected Versions Ultimate Blocks plugin for WordPress versions up to and including 3.2.7 Description The issue is related to Stored Cross-Site Scripting via the content parameter, caused by insufficient input sanitization and output escaping. This allows...

PT-2025-12866

Name of the Vulnerable Software and Affected Versions Event post plugin for WordPress versions up to, and including, 5.9.9 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's 'events list' shortcodes. This allows...

CVE-2025-2302: Improper Neutralization of Input During Web Page Generation

The Advanced Woo Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's awssearchterms shortcode in all versions up to, and including, 3.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-1439: Improper Neutralization of Input During Web Page Generation

The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advancediframe' shortcode in all versions up to, and including, 2024.5 due to insufficient input sanitization and output escaping on user supplied attributes through the 'src' attribute when th...

CVE-2025-1784: Improper Neutralization of Input During Web Page Generation

The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the uagb block in all versions up to, and including, 2.19.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-1437: Improper Neutralization of Input During Web Page Generation

The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advancediframe' shortcode in all versions up to, and including, 2025.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2025-12879

Name of the Vulnerable Software and Affected Versions The Ultimate Blocks – WordPress Blocks Plugin versions up to, and including, 3.2.7 Description The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, specifically via the buttonTextColor...

CVE-2024-12623 DICOM Support <= 0.10.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

The DICOM Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dcm' shortcode in all versions up to, and including, 0.10.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

PT-2025-12779

Name of the Vulnerable Software and Affected Versions The Alert Box Block – Display notice/alerts in the front end. plugin for WordPress versions up to, and including, 1.1.2 Description The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping ...

PT-2025-12766

Name of the Vulnerable Software and Affected Versions DICOM Support plugin for WordPress versions 0.10.6 and earlier Description The issue is related to Stored Cross-Site Scripting via the plugin's 'dcm' shortcode due to insufficient input sanitization and output escaping on user-supplied...

PT-2025-12836

Name of the Vulnerable Software and Affected Versions Advanced Woo Search plugin for WordPress versions up to, and including, 3.28 Description The issue is related to Stored Cross-Site Scripting via the plugin's aws search terms shortcode due to insufficient input sanitization and output escaping...

CVE-2024-12623: Improper Neutralization of Input During Web Page Generation

The DICOM Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dcm' shortcode in all versions up to, and including, 0.10.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-13731: Improper Neutralization of Input During Web Page Generation

The Alert Box Block – Display notice/alerts in the front end. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Alert Box block in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This...

CVE-2025-2108

The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Site Title’ widget's 'titletag' and 'htmltag' parameters in all versions up to, and including, 1.4.6.8 due to insufficient input sanitization and output escaping. This...

PT-2025-12470

Name of the Vulnerable Software and Affected Versions The Block Logic – Full Gutenberg Block Display Control plugin for WordPress versions 1.0.8 and earlier Description The Block Logic – Full Gutenberg Block Display Control plugin for WordPress is vulnerable to Remote Code Execution due to the...

CVE-2025-2108

The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Site Title’ widget's 'titletag' and 'htmltag' parameters in all versions up to, and including, 1.4.6.8 due to insufficient input sanitization and output escaping. This...