CVE-2025-1489

The WP-Appbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's appbox shortcode in all versions up to, and including, 4.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...

CVE-2024-13455

CVE-2024-13455 (igumbi Online Booking for WordPress) affects the igumbi Online Booking plugin for WordPress up to version 1.40. It is a Stored XSS vulnerability in the igumbi_calendar shortcode caused by insufficient input sanitization and output escaping on user-supplied attributes. Exploitation...

CVE-2024-13648

The Maps for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'MapOnePoint' shortcode in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-13648

The CVE-2024-13648 entry for Maps for WP is supported by connected Wordfence details that describe a Stored Cross-Site Scripting via the MapOnePoint shortcode in all versions up to 1.2.4, exploitable by authenticated users with contributor+ privileges. The underlying issue is insufficient input s...

CVE-2024-12452 Ziggeo <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Ziggeo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ziggeoevent' shortcode in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacker...

CVE-2025-1407

CVE-2025-1407 affects AMO Team Showcase for WordPress. The vulnerability is a Stored Cross-Site Scripting via the amoteam_skills shortcode in all versions up to and including 1.1.4, caused by insufficient input sanitization and output escaping of user-supplied attributes. Attack scenario requires...

CVE-2024-13388: Improper Neutralization of Input During Web Page Generation

The TCBD Tooltip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tcbdtooltiptext' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

PT-2025-7503

Name of the Vulnerable Software and Affected Versions Newpost Catch plugin for WordPress versions up to, and including, 1.3.19 Description The issue is related to Stored Cross-Site Scripting via the plugin's npc shortcode due to insufficient input sanitization and output escaping on user-supplied...

PT-2025-7352

Name of the Vulnerable Software and Affected Versions Autoship Cloud for WooCommerce Subscription Products plugin for WordPress versions up to, and including, 2.8.0 Description The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on...

CVE-2025-1402: Missing Authorization

The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ajaxticketdelete' function in all versions up to, and including, 5.19.1.1. This makes it possible for authenticated attackers, with Contributor-level access...

PT-2025-7504

Name of the Vulnerable Software and Affected Versions AMO Team Showcase plugin for WordPress versions up to, and including, 1.1.4 Description The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on user-supplied attributes in the amoteam...

PT-2025-7351

Name of the Vulnerable Software and Affected Versions igumbi Online Booking plugin for WordPress versions up to, and including, 1.40 Description The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on user-supplied attributes in the plugin...

PT-2025-7333

Name of the Vulnerable Software and Affected Versions Ziggeo plugin for WordPress versions up to, and including, 3.1 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'ziggeo event' shortcode due to insufficient input sanitization and output escaping on user-supplie...

PT-2025-7505

Name of the Vulnerable Software and Affected Versions The Events Calendar Made Simple – Pie Calendar plugin for WordPress versions up to, and including, 1.2.5 Description The issue is related to Stored Cross-Site Scripting via the plugin's piecal shortcode due to insufficient input sanitization a...

CVE-2024-12452: Improper Neutralization of Input During Web Page Generation

The Ziggeo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ziggeoevent' shortcode in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacker...

CVE-2025-1406: Improper Neutralization of Input During Web Page Generation

The Newpost Catch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's npc shortcode in all versions up to, and including, 1.3.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacker...

CVE-2024-13461: Improper Neutralization of Input During Web Page Generation

The Autoship Cloud for WooCommerce Subscription Products plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'autoship-create-scheduled-order-action' shortcode in all versions up to, and including, 2.8.0 due to insufficient input sanitization and output escaping on...

CVE-2024-13455: Improper Neutralization of Input During Web Page Generation

The igumbi Online Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'igumbicalendar' shortcode in all versions up to, and including, 1.40 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-13648: Improper Neutralization of Input During Web Page Generation

The Maps for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'MapOnePoint' shortcode in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

PT-2025-7373

Name of the Vulnerable Software and Affected Versions Maps for WP plugin for WordPress versions up to, and including, 1.2.4 Description The issue is related to Stored Cross-Site Scripting via the plugin's 'MapOnePoint' shortcode due to insufficient input sanitization and output escaping on...