CVE-2025-1405: Improper Neutralization of Input During Web Page Generation

The Product Catalog Simple plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's showproducts shortcode in all versions up to, and including, 1.7.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-12820: Improper Neutralization of Input During Web Page Generation

The MK Google Directions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'MKGD' shortcode in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-1560: Improper Neutralization of Input During Web Page Generation

The WOW Entrance Effects WEE! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wee' shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...

CVE-2024-13832: Authorization Bypass Through User-Controlled Key

The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.8 via the 'utelementor' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with...

CVE-2024-13469: Improper Neutralization of Input During Web Page Generation

The Pricing Table by PickPlugins plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Button Link in all versions up to, and including, 1.12.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-lev...

CVE-2025-1690

The CVE-2025-1690 entry concerns ThemeMakers Stripe Checkout for WordPress, which has a Stored Cross-Site Scripting (XSS) flaw in the stripe shortcode up to version 1.0.1 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level permissions can inj...

CVE-2024-6261

CVE-2024-6261 affects the Image Photo Gallery Final Tiles Grid plugin for WordPress. It is a Stored DOM-based Cross-Site Scripting vulnerability via the FinalTilesGallery shortcode in all versions up to 3.6.0. Exploitation requires authenticated access at contributor level or higher, enabling inj...

CVE-2025-0469

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the slider template data in all versions up to, and including, 1.39.2 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2025-0469

CVE-2025-0469 : Forminator Forms – Contact Form, Payment Form & Custom Form Builder (WordPress) is affected by a Stored Cross-Site Scripting vulnerability up to version 1.39.2 due to insufficient input sanitization and output escaping in the slider template data. An attacker with Contributor+ pri...

PT-2025-8916

Name of the Vulnerable Software and Affected Versions Image Photo Gallery Final Tiles Grid plugin for WordPress versions up to, and including, 3.6.0 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the 'FinalTilesGallery'...

PT-2025-8913

Name of the Vulnerable Software and Affected Versions The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress versions up to, and including, 1.39.2 Description The issue arises from insufficient input sanitization and output escaping in the slider template dat...

CVE-2024-6261: Improper Neutralization of Input During Web Page Generation

The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'FinalTilesGallery' shortcode in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes ...

CVE-2024-13734: Improper Neutralization of Input During Web Page Generation

The Card Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Profile Card widget in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-13803: Improper Neutralization of Input During Web Page Generation

The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-marker’ parameter in all versions up to, and including, 5.2.3 due to insufficient input sanitization and output escaping. This makes it possib...

CVE-2025-1489

The WP-Appbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's appbox shortcode in all versions up to, and including, 4.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...

CVE-2024-12452

The Ziggeo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ziggeoevent' shortcode in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacker...

CVE-2024-13648

The Maps for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'MapOnePoint' shortcode in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-13445

The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the border, margin and gap parameters in all versions up to, and including, 3.27.4 due to insufficient input sanitization and output escaping. This makes it possible...

PT-2025-7368

Name of the Vulnerable Software and Affected Versions Rife Elementor Extensions & Templates plugin for WordPress versions up to, and including, 1.2.5 Description The issue is related to Stored Cross-Site Scripting via the plugin's Writing Effect Headline shortcode due to insufficient input...

CVE-2024-13564: Improper Neutralization of Input During Web Page Generation

The Rife Elementor Extensions & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Writing Effect Headline shortcode in all versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping on user supplied attributes. This...